Worm offers seasonal greeting with a catch

An email bearing New Year greetings also contains a malicious worm that is spreading in Europe and the US, according to experts.

Computer Associates (CA) International has assigned a 'medium-to-high' risk to Reeezak, also known as W32/Reeezak.A@mm, W32/Zacker.C@mm and W32.Maldal.C@mm, which masquerades as a Macromedia Flash holiday greeting.

"Holiday themed threats, such as Reeezak, remind us that computer users should never let their guard down when using the internet. Be on the lookout for suspicious messages as they may be bearing gifts that you don't want," said Ian Hameroff, director of antivirus solutions at CA.

Vendors should make sure that users are aware of the virus and update customers' antivirus software, Hameroff said.

Reeezak arrives as an email with the subject line 'Happy New Year' and the message body text 'Hii, I can't describe my feelings but all i can say is Happy New Year :) bye'. The attachment reads 'Christmas.exe'.

The worm, which infects Windows-based systems, uses Microsoft Outlook and MSN Messenger to collect email addresses. It also deletes the Windows System Directory, disables antivirus software and has the ability to disable selective keys on an infected user's keyboard. Reeezak may also spread across networks with open network shares.

In a virus alert posted on its website, Symantec said the worm also tries to spread using the mIRC (Internet Relay Chat) application or through shared folders, and modifies the Internet Explorer start page to a malicious homepage.

Symantec and McAfee have rated Reeezak as a 'low' risk. The worm first appeared in the UK and other parts of Europe and was then detected in the US.