Konstiga filer i System32mappen

Ursprungligen inskrivet av pytonOrm
winamp.exe är juh för Winamp om du har den installerad ? inga av dom är virus eller spionprogram... helt normalt

(Discovered on: May 21, 2005)

W32.Linkbot.M is a worm that exploits the Microsoft Windows LSASS Buffer Overrun Vulnerability (Microsoft Security Bulletin MS04-011) in order to propagate. It also creates a back door on the system accessible through IRC.

When W32.Linkbot.M is executed, it performs the following actions:

1. Copies itself as one of the following:

* %System%\lssas.exe
* %System%\Isass.exe
* %System%\csrs.exe
* %System%\logon.exe
* %System%\winIogon.exe
* %System%\explorer.exe
* %System%\winamp.exe
* %System%\firewall.exe
* %System%\spoolsvc.exe
* %System%\spooIsv.exe
* %System%\algs.exe
* %System%\iexplore.exe

Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).