Aliz worm is relatively easy to disinfect.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
To propagate, it is able to scan for computers vulnerable to a number of exploits to spread itself; it can also perform a dictionary attack on network share passwords.
Additionally, the worm performs a Denial of Service (DoS) attack on a number of websites based in Estonia.
The worm copies itself multiple times to a hard drive and also affects HTML files.
The worm's file is polymorphically encrypted, which means every copy of the worm is different. The only constant aspect of the worm's code is the size of its executable file - 57856 bytes.
The worm creates a different CLSID for every copy of itself that it creates on the hard drive. The number of these copies can be quite large. The names of the worm's files are random. For example:
After the worm's file is run it goes through the polymorphic decryptor and then proceeds to the static part of the code that allocates a memory buffer and extracts the main worm's code into it. Then the control is passed directly to the extracted worm's code.
After getting control, the worm creates a few threads. One thread scans for vulnerable computers (on TCP ports 139 and 445) and sends exploits there in order to infect them.
The other thread scans for .HTM and .HTML files on all local hard disks and infects them by prepending a reference to worm's CLSID there.
One of the remaining threads performs a DoS attack on three websites located in Estonia. The following TCP ports used during the DoS attack:
The worm also tries to brute-force network share passwords by performing a dictionary attack on them. The following passwords are used: