Notebook的反應是打開一個新browser，連上這條一點也不cooool的url，跟著forward 到好像PerfSpot.com的網站，這個網站應是假的，因為看佢用frameset特徵，而且其backend 屬兩個唔同的domain名，加上browser address 還是顯示這個coool咩咩，所以肯定有古怪!當然沒有理這個site(遇到這些site，切記不可做任何register或提供資料！)，跟後立即查這是什麼一回事，以及delete晒所以browser 的temporary file、cookie、history、password(DeepC從不用自動完成功能的，所以不會有password 留下，但安全起見，還是按 delete auto password button)，還有offline Full scan 整台notebook，run 左近三個鐘，好彩沒有Virus。還有一點很重要，就是將電腦離線!
而這個site，看似專偷IM user 資料，用來發放垃圾郵件及信息。（如上面提及的offine message）**所以大家收到這個網址時不要點擊它, 也不要理會相關信息**
而在網上的搜尋結果小得很，連McAfee都只有一個記錄，還是同一天貼上的，可見這個這隻東西是多新。McAfee還未有報告出來，但他們大約估計是spammer "distributed through email and instant messaging spam, uses browser exploits to distribute spyware etc"，相信報告會在幾天後發出。
小心多點，今早在網上繼續找資料，以及跟IT人談談，得Alexander兄台出手支援，贈一良方處理spyware，並取得同意跟大家分享，方法如下：
| Since your computer might be infected with spyware, before you complete the following list do not use your computer for security-sensitive activities like online banking. Fastest way: System Restore (1). Change your MSN Messenger/Hotmail/MSN Passport password on another computer immediately (2). Restore your computer back to any time earlier than 《 the spyware detonation time 》, restart your computer as instructed (3). Download and install a anti-spyware software, update it; scan and clean your computer If you need more information on anti-spyware, you can try Spybot S&D or Spyware Doctor from Google Pack. If the system restore is disabled on your computer, then you will have to do it manually: Safest way: Scan and Clean [1]. Change your MSN Messenger/Hotmail/MSN Passport password on another computer immediately [2]. Download and install an anti-spyware software (as suggested above) [3]. Update it and immunize it (for Sypbot S&D you can immunize your computer for more protection) [4]. Scan your computer for spyware, clean and remove all threads [5]. Try restarting your computer, monitor for any unknown thread/process running [6]. Try to locate the unknown thread/process from Windows Explorer -> Search and confirm it they are something real and necessary for operations [7]. If something problematic found, locate the entry from Registry and remove it, delete the related files by [Shift]+[Del] to bypass Recycle Bin [8]. Return to step 6 until all possible problematic thread/process cleaned Let me know if you need more information on this. |
以上第(2)點是指，用「系統還原」功能，還原到估計觸發spamware時間前的時段；這個功能的位置在：「程式集」＞「附屬應用程式」＞「系統工具」＞「系統還原」
DeepC現在用desktop出blog及email，MSN password 用不同的電腦改過兩次，而 Notebook呢，就還原到27 Mar 2008，另裝多一個 Spyware Doctor，以及用這個新software full scan左兩次，結果沒有大問題，多是廣告cookies 那類東東吧，將所有懷疑的東西己刪去，相信９９％沒事了，但還會繼續觀察，跟平日一樣，而大家也要小心些啊。 :)
前陣子買過一款
Osage Gallery (奧沙畫廊)近期舉辦Sharing Memory (記憶共享)及 Ambient Art(縱橫流-新媒體藝術)藝術展覽，同時在同一層大廈展出，分左右兩邊。
這款糖果名 "熊出沒燒粟米糖"，Donan出品。它的盒面設計好正，以一隻惡騰騰的熊做封面，太有型喇，在趕Assignment的眼瞓日子看到它也立即醒精！而且名子又特別，所以了一盒試試。一盒18糖，粟米香味很濃，很甜，較軟身，水準算過得去。
