IRC group decrypts Fizzer commands
Using what is essentially a password that changes daily, members of the chat-security group IRC/Unity have started telling Fizzer-compromised PCs to uninstall the virus.
The Fizzer virus connects from an infected PC to a randomly selected Internet relay chat (IRC) network using a list of more than 300 such networks contained in the virus. Once connected, Fizzer creates a chat channel and listens for commands from a specific user nickname. The IRC/Unity group discovered the algorithm that determines what that name should be.
"It's a three-letter nickname that is only valid for the current date," said John McGarrigle, the newly elected chairman of the IRC/Unity group, a collection of administrators from more than 50 different chat networks. "Once you have that, you can control the bot (virus program) through IRC."
The discovery occurred less than a week after smaller IRC networks became inundated with connection requests from compromised PCs. Late last week, the IRC/Unity group--formed in response to the Fizzer worm--started work on decompiling the program in an attempt to block the worm.
This weekend, the IRC/Unity group discovered that access to computers infected by the Fizzer worm is regulated by a three-letter nickname, which is generated by an algorithm that depends on the current date. A person who knows the nickname can issue commands to any computer that's compromised by the virus and listening to the current chat channel.
Several IRC operators have started using the information to command any PC infected with the virus that connects to their network to uninstall itself.
"A lot of networks are actively sending out the command to all IRC Fizzer clients," said McGarrigle. "When they send the uninstall command, it leaves no trace of the bot."
While the legality of the tactic is questionable, the actions could eradicate the virus from PCs in the coming weeks.
Still, the IRC/Unity group is not done yet. While it has determined the latest authorized nicknames for the virus, it hasn't learned all the specifics of the algorithm, which could hinder efforts to automate any response to the virus.
"There is still a lot of work," McGarrigle said. "Just because we have figured this out doesn't mean that we are going to (eliminates) the threat."