| Aliz Virus | |||||||||||||||||
| Sleeper Worm Wakes Up for Holiday | |||||||||||||||||
When I think of Thanksgiving, I think of the nice nap I'll be taking after eating way too much turkey. While many of us might be hibernating for the holiday, the Aliz virus has chosen this time to wake up and stretch. According to MessageLabs ThreatList, the Aliz worm jumped from 383 infections on November 20th, 2001 to 1511 infections 24 hours later. At this rate of spread, Aliz may soon overtake November 2001 counts for viruses such as Nimda and Klez.
According to antivirus vendor F-Secure, Aliz may be one of the smallest Win32 infectors to date. Weighing in at only 4Kb, Aliz randomly composes its infection carrying email from five lists of options and then sends itself using the system's defaults SMTP server.
Alexey Podrezov of F-Secure notes that the worm chooses one option from each of the following five lists to compose the subject line of the email: For example, the subject line might be "Fw: Cool website to see !!" or "Fw: Re: funky mp3s for you :-)". The body is blank HTML and the attachment is named "Whatever.exe".
The Aliz worm takes advantage of a MIME header vulnerability to automatically execute on systems running unpatched versions of Microsoft® Internet Explorer versions 5.01 and 5.5. Users of these versions should either patch their browsers or make sure the settings for their mail client do not allow file downloads. Tips for securing your mail client can be found in the Email Help Center.
The worm does not install itself to the system. Instead, it terminates its process after the mass-mailing routine is complete.
|
|||||||||||||||||
Explore Antivirus Software
Must Reads
About.com Special Features
Stay connected and entertained with reviews on tips on the latest HDTVs, cellphones and more. More >
Easy ways to connect two computers for networking purposes. More >
©2009 About.com, a part of The New York Times Company.
All rights reserved.