Nov 24 2009
Piloyd worm pwning exe, asp and html files in PRC
HT to Sunbelt for this article about the piloyd worm jacking up web pages in the PRC. Not enough details yet to determine the vector. According to Sunbelt’s article, it is 8/41 on virustotal.com. I’ll update this post if I’m able to collect a sample for analysis.
Here are some details from threatexpert.com.


