%User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\ on Windows 2000, XP, and Server 2003.) (Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003. %Windows%\reader_sl.exe - also detected as WORM_BLAKCONT.W.%User Profile%\Application Data\SystemProc\lsass.exe - also detected as WORM_BLAKCONT.W.%System%\reader_sl.exe - also detected as WORM_BLAKCONT.W.%System%\hp-24570.exe - also detected as WORM_BLAKCONT.W.It drops the following file(s)/component(s): (Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.) (Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.) This worm drops the following copies of itself into the affected system and executes them: It may be unknowingly downloaded by a user while visiting malicious websites. It may be downloaded by other malware/grayware/spyware from remote sites. This worm arrives as attachment to mass-mailed email messages.
Payload: Drops files, Hides files and processes, Terminates processes
0 kommentar(er)
