Not-so-stealth worm

Generally speaking, most worm authors do not want you to know that their malware is on your machine. However, the author of W32/Agent-FOW must be proud, as there is a log file left on the machine, listing all removable drives successfully infected.

From the log file…

 found_removable!
217946263-
copy: e:\autorun.inf
copy: e:\krag.exe
done
COPYING
found_removable!
217946263-
copy: e:\autorun.inf
done
COPYING
found_removable!
217946263-
copy: e:\autorun.inf
done