Not-so-stealth worm
Generally speaking, most worm authors do not want you to know that their malware is on your machine. However, the author of W32/Agent-FOW must be proud, as there is a log file left on the machine, listing all removable drives successfully infected.
From the log file…
found_removable!
217946263-
copy: e:\autorun.inf
copy: e:\krag.exe
done
COPYING
found_removable!
217946263-
copy: e:\autorun.inf
done
COPYING
found_removable!
217946263-
copy: e:\autorun.inf
done
Filed under: Malware
Windows 7 security - A great leap forward or business as usual?
