Not very cool 的 coooolstuff.info

昨晚收到友人一條offline MSN message，由於友人同是IT界的，對network及hardware有豐富的認識，所以很信任他，但那message 的內容很可疑，“hey check this .. http:// very.cooolstuff.info .. brb !!”，所以去查證下是否有問題，用touchpad highlight，諗住hightlight full message and paste 來搜尋，點知，嘿嘿，甩手，咁就變左觸發開啓。

Notebook的反應是打開一個新browser，連上這條一點也不cooool的url，跟著forward 到好像PerfSpot.com的網站，這個網站應是假的，因為看佢用frameset特徵，而且其backend　屬兩個唔同的domain名，加上browser address 還是顯示這個coool咩咩，所以肯定有古怪!當然沒有理這個site(遇到這些site，切記不可做任何register或提供資料！)，跟後立即查這是什麼一回事，以及delete晒所以browser 的temporary file、cookie、history、password(DeepC從不用自動完成功能的，所以不會有password 留下，但安全起見，還是按 delete auto password button)，還有offline Full scan 整台notebook，run 左近三個鐘，好彩沒有Virus。還有一點很重要，就是將電腦離線!

而這個site，看似專偷IM user 資料，用來發放垃圾郵件及信息。（如上面提及的offine message）**所以大家收到這個網址時不要點擊它, 也不要理會相關信息**

而在網上的搜尋結果小得很，連McAfee都只有一個記錄，還是同一天貼上的，可見這個這隻東西是多新。McAfee還未有報告出來，但他們大約估計是spammer "distributed through email and instant messaging spam, uses browser exploits to distribute spyware etc"，相信報告會在幾天後發出。

小心多點，今早在網上繼續找資料，以及跟IT人談談，得Alexander兄台出手支援，贈一良方處理spyware，並取得同意跟大家分享，方法如下：

Since your computer might be infected with spyware, before you complete the following list do not use your computer for security-sensitive activities like online banking. Fastest way: System Restore (1). Change your MSN Messenger/Hotmail/MSN Passport password on another computer immediately (2). Restore your computer back to any time earlier than 《 the spyware detonation time 》, restart your computer as instructed (3). Download and install a anti-spyware software, update it; scan and clean your computer If you need more information on anti-spyware, you can try Spybot S&D or Spyware Doctor from Google Pack. If the system restore is disabled on your computer, then you will have to do it manually: Safest way: Scan and Clean [1]. Change your MSN Messenger/Hotmail/MSN Passport password on another computer immediately [2]. Download and install an anti-spyware software (as suggested above) [3]. Update it and immunize it (for Sypbot S&D you can immunize your computer for more protection) [4]. Scan your computer for spyware, clean and remove all threads [5]. Try restarting your computer, monitor for any unknown thread/process running [6]. Try to locate the unknown thread/process from Windows Explorer -> Search and confirm it they are something real and necessary for operations [7]. If something problematic found, locate the entry from Registry and remove it, delete the related files by [Shift]+[Del] to bypass Recycle Bin [8]. Return to step 6 until all possible problematic thread/process cleaned Let me know if you need more information on this.

以上第(2)點是指，用「系統還原」功能，還原到估計觸發spamware時間前的時段；這個功能的位置在：「程式集」＞「附屬應用程式」＞「系統工具」＞「系統還原」

DeepC現在用desktop出blog及email，MSN password 用不同的電腦改過兩次，而 Notebook呢，就還原到27 Mar 2008，另裝多一個 Spyware Doctor，以及用這個新software full scan左兩次，結果沒有大問題，多是廣告cookies 那類東東吧，將所有懷疑的東西己刪去，相信９９％沒事了，但還會繼續觀察，跟平日一樣，而大家也要小心些啊。 :)