病毒名称:
Worm.Klexe.Set
类别: 蠕虫病毒
病毒资料:
破坏方法:
这是一个利用Microsoft Outlook发送给所有Outlook地址薄中联系人一个有害链接的蠕虫。
这个链接包含此病毒的压缩版,这个蠕虫还带有一个木马组件,病毒使用这个组件来捕获用户的击键记录并发送到指定邮箱。
病毒包含的两个文件为:ecmsetup1.exe and kl.exe.
当ecmsetup1.exe运行时,它首先复制kl.exe到如下目录:
c:\windows\startm~1\programs\startup\Windows EXPlorer.exe
d:\windows\startm~1\programs\startup\Windows Explorer.exe
e:\windows\startm~1\programs\startup\Windows Explorer.exe
f:\windows\startm~1\programs\startup\Windows Explorer.exe
然后病毒使用outlook发送邮件:
主题: Re:
正文:
You received this email because you where sent a 'pass this on e-messenger card' through one of our valued partners.
If you believe you received this message
in error or would no longer like to receive e-mail from us click here http://www.***.com/ecardmessenger/us.htm
To download your card click on the link below:
http://www.***.com/ecardmessenger/ecmsetup1.zip
P.S. If you received this message but do not know the sender or wish to unsubscribe or if you have any questions, please mail to services@emmsconline.com
病毒的清除法:
使用光华反病毒软件,彻底删除。
病毒演示:
病毒FAQ:
Windows下的PE病毒。
发现日期:
2003-7-2