大砲開講

惡意連結/程式碼是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

展示影片，請看這裡。

Google Search查詢的結果，如下所示：

執行之後，有下面的行為：

[Added process]
C:\WINDOWS\System32\CcEvtSvc.exe

[Added service]
NAME: CcEvtSvc
DISPLAY: CcEvtSvc
FILE: C:\WINDOWS\System32\CcEvtSvc.exe -k netsvcs

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\in[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\nautica-taiwan.com[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\stat[1].htm
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\CcEvtSvc.exe
C:\WINDOWS\system32\MI84.tmp
C:\WINDOWS\system32\reeppoor.tmp
C:\winzvdi.exe

到目前為止 (2008/2/22 @ 20:35)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

CcEvtSvc.exe:
[ Trend ], "TROJ_BMVD.A"
MI84.tmp:
[ Trend ], "TROJ_BMVD.A"
winzvdi.exe:
[ Trend ], "TROJ_DLOADER.EMD"
in[1].htm:
[ Kaspersky ], "Trojan-Downloader.JS.Zapchast.f"
[ HBEDV ], "HEUR/Exploit.HTML"
nautica-taiwan.com[1].htm:
[ Alpha_Gen ], "Heur_Infrm-1″
[ Sophos ], "Mal/Iframe-F"
[ HBEDV ], "HTML/Dldr.Iframe.U"
[ WebWasher ], "Script.Dldr.Iframe.U"
[ bitdefender ], "Trojan.IFrame.AK"
stat[1].htm:
[ WebWasher ], "BlockReason.46 (suspicious)"