Technical Introduction to Bots ◾ 115
ecard.exe
FlashPostcard.exe
FlashPostcard.exe
Full Story.exe
FullClip.exe
F
ullNews.exe
FullVideo.exe
GreetingCard.exe
GreetingPostcard.exe
MoreHere.exe
Nfl
StatTracker.exe
Patch-6654.zip
Postcard.exe
Re
ad More.exe
ReadMore.exe
Video.exe
e original Storm worm installed as an executable on the computer that is
visible within Windows Task Manager. It created an executable within the user
d
irectory of the infected computer, such as USER\d8OnbPR.exe (32,387 bytes).
It also created strange “.t” files, which turned out to be Windows rootkit compo-
nents. Filenames of the rootkit component varied, with names like vrstedcl.t and
a
aaaahjx.t, all with the size of 48,259 bytes. A copy of the original Trojan was
created in the Windows ...