Aliz, a worm first discovered earlier this year, is actively spreading itself through the Internet. The worm's malicious code is spread as an infected file attached to e-mail.
The attachment is about 4Kb in length and is usually named whatever.exe. The worm was first recorded in May and most anti-virus vendors have already added the worm to their definition lists.
The worm is similar in operation to the Nimda worm in that it launches itself by taking advantage of an IFRAME security flaw. Reading or viewing an e-mail message activates the attachment.
When the attachment is run, the executable unpacks the main worm code into memory and then sends infected messages to e-mail addresses found in the Windows Address Book. The worm does not attach itself to the system, and is only re-activated by users clicking on the attachment.
However, Eugene Kaspersky, head of anti-virus research at Kaspersky Labs, says the worm's e-mail replication routine contains a number of flaws rendering the worm incapable of spreading on most e-mail server configurations.
Kaspersky says he is surprised that the worm could suddenly create such an epidemic so long after it was initially detected, but believes the reason is that "users continue not to pay attention to the most basic computer safety principles".
"It is obvious that that many virus epidemics to date have not taught users even the basic lessons [of security]."
Share
Editorial contacts