WORM_PIZZER.A

Posted: May 27, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	13,331
Threat Level:	1/10
Infected PCs:	604

First Seen:	May 27, 2013
Last Seen:	September 13, 2023
OS(es) Affected:	Windows

WORM_PIZZER.A is a worm that inserts copies of itself into various accessible archive files, even including password-protected ones, by abusing a baseline WinRAR feature. PCs that open these archive files will become infected with WORM_PIZZER.A and continue the cycle, as per typical worm propagation strategies. Other information on WORM_PIZZER.A's capabilities remain under investigation, although SpywareRemove.com malware experts often find similar PC threats being used as part of a set of targeted attacks against various government or point-of-sale business infrastructures. To be certain of deleting all copies of WORM_PIZZER.A along with any other PC threats that may be related to its presence, you should use anti-malware scanners that are capable of analyzing archive files along with all other files on your hard drive.

WORM_PIZZER.A: Adding a Piece of Itself to Your Other Files as It Pleases

WORM_PIZZER.A, like all worms, handles its own distribution efficiently, although WORM_PIZZER.A also has been seen being installed by other PC threats, such as the fellow worm WORM_SWYSINN.SM. What caught the eyes of the workers at Trend Micro, not to mention those of SpywareRemove.com own malware analysts, was WORM_PIZZER.A's ability to circumvent even the standard password protection features offered by programs like WinRAR and WinZip. By exploiting a default command line option in the former archiving program, WORM_PIZZER.A creates a copy of itself that's placed inside even a password-protected ZIP or RAR file.

Unfortunately, an analysis of WORM_PIZZER.A's payload is not available at this time, but SpywareRemove.com malware researchers can verify that WORM_PIZZER.A doesn't attempt to compromise the passwords of the archived files WORM_PIZZER.A infects. The purpose of infecting these files appears to be limited to distributing WORM_PIZZER.A to other computers after they're used to open the archive. Worms like WORM_PIZZER.A also often employ secondary distribution methods (such as e-mail spambot attacks) that exploit the infected PC's resources without showing any symptoms.

Playing Pied Piper to Lead WORM_PIZZER.A Out of Your Archives

PCs without WinRAR installed may very well be immune to WORM_PIZZER.A's primary method of copying itself, but that isn't necessarily indicative of safety from WORM_PIZZER.A's other attacks, or from attacks by PC threats that are associated with your WORM_PIZZER.A infection. Since worms like WORM_PIZZER.A often include many backup copies of themselves that are concealed in what often turn out to be difficult-to-ascertain locations, SpywareRemove.com malware experts generally discourage trying to find and remove WORM_PIZZER.A by hand.

Despite these caveats, anti-malware products with sufficiently exhaustive scanning features should be able to find and delete WORM_PIZZER.A, including copies that are hidden in any archive files on your computer. You also should take particular care to scan removable devices and network-accessible locations, which are some of the favorite infection vectors of worms just like WORM_PIZZER.A. Removing WORM_PIZZER.A should not, under any circumstances, harm any archive files that were infected with WORM_PIZZER.A.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

ResizeImagesSetup.exe

File name: ResizeImagesSetup.exe
MD5: 971311e5f3326538698d94f5495d757b
Detection count: 62
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: May 25, 2023

%PROGRAMFILES(x86)%\resize images\resize images.exe

File name: resize images.exe
Size: 87.04 KB (87040 bytes)
MD5: 6a7b69fb71e15ec8422e78184045db26
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\resize images
Group: Malware file
Last Updated: May 25, 2023