大砲開講

惡意連結是放置在某些頁面 (np3.htm, stenter.htm) 中 (可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\real[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\764994885[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\main[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\css[1].js
C:\WINDOWS\rising639.exe
C:\WINDOWS\system32\drivers\KrnDigger.SYS
C:\WINDOWS\system32\lo.dll
C:\WINDOWS\system32\ss.exe

到目前為止 (2007/10/4 @ 14:19)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

rising639.exe:
[ Trend ], "TROJ_DELF.HYF"
css[1].js:
[ Alpha_Gen ], "Possible_EncScr"
[ Kaspersky ], "Trojan-Downloader.JS.Psyme.mr"
[ HBEDV ], "JS/Dldr.MarcoMedia"
KrnDigger.SYS:
[ Panda ], "Trj/Agent.GII"
[ Nod32 ], "Win32/RiskWare.PsUtils.18 application"
[ Fortinet ], "HackerTool/PsUtils"
[ HBEDV ], "SPR/Tool.PsUtils.18″
[ Rising ], "RootKit.Win32.Agent.ngr"
ss.exe:
[ Beta_Gen ], "AP_MALPK-2″
[ Kaspersky ], "PAK:PE_Patch, PAK:UPack"
[ McAfee ], "New Malware.aj !!"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/Agent.DPE"
[ Nod32 ], "Win32/RiskWare.PsUtils.18 application"
[ Fortinet ], "HackerTool/PsUtils"
[ HBEDV ], "SPR/HideProcess.B.2″
[ Norman ], "Security Risk W32/Suspicious_U.gen"