 |
| Aliz worm became widely spread in the end of November 2001. The worm activates automatically while reading an infected email message.
|
Aliz is a very small e-mail worm written in pure Assembly. The worm's file is only 4 kilobytes long and its code is compressed. It can be considered one of the smallest Win32 worms ever created.
When the worm is run, it first unpacks itself and then passes control to API address setup routine. When all needed API addresses are collected, the control is passed to the main worm's code. The worm checks the Registry for the location of Windows Address Book file and loads it into memory. The worm then connects to default SMTP server (for SMTP server info the worm checks Internet Account Manager data in the Registry) and sends itself to all recepients of Windows Address Book. The infected message looks like that:
Subject: Body:
Attachment: Whatever.exe |
| Tilbake... |
|
|
|
 |
|
 |
 |
