我发现：只要（在IE没有禁用活动脚本时）打开联盟首页dos.e-stone.cn,就会自动链上http://833200.com/index/ 执行一个lhxyhta.hta的HTML应用程序，它会进一步产生在C盘根目录下的win.hta文件，最后在WINDOWS系统目录下生成一个intrenat.exe的程序，并运行（长驻）且修改注册表使它随WINDOWS启动，此程序加了壳，似乎是盗取密码什么的。
这是为什么？！
I found that: as long as (when Active Scripting is not disabled in IE) opening the union homepage dos.e-stone.cn, it will automatically chain to http://833200.com/index/ to execute an HTML application of lhxyhta.hta, which will further generate the win.hta file under the root directory of the C drive, and finally generate a program of intrenat.exe under the WINDOWS system directory, and run (resident) and modify the registry to start with WINDOWS. This program is shelled, and it seems to be stealing passwords or something.
Why is this?!
