|
|
|
頗糟糕的木馬..
|
wintems.exe - infected by Email-Worm.Win32.Bagle.gi
hidn2.exe - infected by Email-Worm.Win32.Bagle.gm
m_hook.sys - infected by Email-Worm.Win32.Bagle.gm
re_file.exe - OK
flec006.exe - infected by Trojan-Downloader.Win32.Bagle.y
ixnkmdixmpva.exe - infected by Email-Worm.Win32.Bagle.gm
隨著Email傳播,會有一個加密壓縮檔外加一個圖檔
圖檔為壓縮檔的密碼
笨笨的會以為是重要檔案就解開來執行........
ixnkmdixmpva.exe為信件附檔解開來的原始木馬
其它為衍生物及復活檔
|
|
