Door-to-Door Worm Cleaner

A hands-on incident report of a compromised Windows PC reveals an email worm/dropper (MD5 observed) that injected into IE, hooked explorer to capture keystrokes, scanned the local network for new hosts, and POSTed profiling/exfiltration data to .ru command-and-control endpoints; the analyst isolated the host, dumped the malicious process from memory (Postcards.exe) and cleaned the machine using anti-spyware tools.