课件：新一代防病毒挑战与防病毒理念.ppt

* If the worm successfully infects a web server, it uses the HTTP service to propagate itself to clients that browse the web server’s pages. Upon infecting a victim server, the worm creates a MIME-encoded copy of itself named README.EML and traverses the directory tree searching for web-related files such as those with .HTML, .HTM, or .ASP extensions. Each time the worm finds a web content file, it appends a piece of JavaScript to the file. The JavaScript forces a download of README.EML to any client that views the file via a browser. Some versions of Internet Explorer will automatically execu