大砲開講

最近有幾則報導指出，IE 和 FireFox 存在一個安全漏洞，使得攻擊者可以存取受害者的硬碟資料，然後，上傳至遠端伺服器。

當使用者連上一個惡意網站，並且輸入和送出一些訊息之後，瀏覽器會將使用者的硬碟資料上傳至遠端伺服器。例如，將 C:\WINDOWS\system32\config\SAM (帳號與密碼存在此檔中)上傳至攻擊者的伺服器。

受影響瀏覽器：

• IE (7.0 和 7.0 以前的版本)


• FireFox (1.5, 2.0)


• 其他瀏覽器 (可能存在此安全漏洞)

還是一句老生常談的話「不要隨便執行一個來路不明的連結」。

至於詳細的資訊，可以參考下面的相關的報導：

MSIE / Firefox focus stealing vulnerabilities (for Windows) (包含此安全漏洞的展示： IE 和 FireFox)

IE and Firefox cough up hard drive contents

Firefox focus stealing vulnerability (possibly other browsers)

因應西洋情人節的到來，搜尋引擎巨人 Google 將他們的企業識別標誌 (商標) 改為另一種格式，但怎麼看都怪怪的，剛剛看了 TechCrunch 的報導，才恍然大悟，原來少一個英文字 --「L」，所以，Google 就變成了 Googe，真是難得一見。



關於 Google 商標，請參考這裡。

昨天在台灣論壇上，看見有一個網友 (熾熱狂風) 張貼了一個疑似即時通訊惡意程式，其對話蠻具吸引力的 (如下所示)，一般使用者很可能會執行它。



上圖的網怎麼這麼奇怪呢？寫錯了嗎？沒錯，這是另一種網址表示方式，經過轉換後，網址為：



惡意程式碼的一部分為：



執行之後，有下面的行為 (在我的測試機器上，會產生一些應用程式錯誤，就是病毒碼寫得不好啦)：

[Added process]
C:\WINDOWS\system32\a.exe

[DLL injection]
C:\WINDOWS\java\classes\66A75.dll (注入某些執行程序如檔案總管等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.Exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\tpp[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\top[1].exe
C:\WINDOWS\java\classes\66A75.dll
C:\WINDOWS\java\classes\66A75.exe
C:\WINDOWS\system32\a.exe

[Added COM/BHO]
{C8D81FE1-EF3D-4755-BA05-0BE477385679}-C:\WINDOWS\java\classes\66A75.dll

到目前為止，下面的防毒軟體可以偵測到這些惡意檔案：

66A75.exe:
[ Trend ], "TSPY_LINEAGE.EOP"
a.exe:
[ Trend ], "TSPY_LINEAGE.EOP"
svchost.Exe:
[ Trend ], "TSPY_LINEAGE.EOP"
top[1].exe:
[ Trend ], "TSPY_LINEAGE.EOP"
tpp[1].exe:
[ Trend ], "TSPY_LINEAGE.EOP"
66A75.dll:
[ Kaspersky ], "PAK:PE_Patch.UPX, PAK:UPX, PAK:PE_Patch.MaskPE"
[ Panda ], "Trj/QQPass.SR"
[ Nod32 ], "a variant of Win32/PSW.Lineage.DN trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "HEUR/Crypted"
[ Grisoft ], "Trojan horse PSW.Generic3.DNA"

最近，即時通訊病毒還真多，勸各位不要亂執行來路不明的連結，甚至，連您的朋友送過來的，也要先確認一下，不過，這裡要注意，有可能駭客已經取得您朋友的即時通訊帳號和密碼，所以，要小心一點。-----

今天在台灣論壇上，看見另一個網友 (傻气≠朱哥) 張貼了一個疑似即時通訊惡意程式，各位可以參考一下他們的對話 (如下圖所示)。還是老生常談的一句話「不要亂執行來路不明的連結」。



惡意連結為：



惡意程式碼的一部分為：



執行之後，有下面的行為：

[Added process]
C:\Program Files\Internet Explorer\SVCHOST.EXE
C:\Program Files\Internet Explorer\SMSS.EXE
C:\Program Files\Internet Explorer\SERVICES.EXE
C:\Program Files\Internet Explorer\9Sy.exe
C:\Program Files\Internet Explorer\WINLOGON.EXE
C:\Program Files\Internet Explorer\LSASS.EXE

[DLL injection]
C:\Program Files\Internet Explorer\SVCHOST.EXE (注入 svchost.exe 的執行程序)
C:\Program Files\Internet Explorer\WINLOGON.EXE (注入 winlogon.exe 的執行程序)
C:\Program Files\Windows Media Player\svchost.exe (注入 svchost.exe 的執行程序)
C:\WINDOWS\system32\dllf.dll (注入某些執行程序如檔案總管等)
C:\WINDOWS\system32\dllran.dll (注入某些執行程序如檔案總管等)
C:\WINDOWS\system32\msndll.dll (注入某些執行程序如檔案總管等)
C:\WINDOWS\system32\PDLL.dll (注入某些執行程序如檔案總管等)
C:\WINDOWS\system32\qmdll.dll (注入某些執行程序如檔案總管等)
C:\WINDOWS\system32\xgdll.dll (注入某些執行程序如檔案總管等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\$$a1C.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Ding.com
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\run[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\tt1[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\z4[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\qm[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\fg[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\xg[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\mf[1].exe
C:\Program Files\Internet Explorer\9Sy.exe
C:\Program Files\Internet Explorer\LSASS.EXE
C:\Program Files\Internet Explorer\SERVICES.EXE
C:\Program Files\Internet Explorer\SMSS.EXE
C:\Program Files\Internet Explorer\SVCHOST.EXE
C:\Program Files\Internet Explorer\WINLOGON.EXE
C:\Program Files\Microsoft\svhost32.exe
C:\Program Files\svhost32.exe
C:\Program Files\Windows Media Player\svchost.exe
C:\WINDOWS\$hf_mig$\svhost32.exe
C:\WINDOWS\Config\svhost32.exe
C:\WINDOWS\Help\rundll32.exe
C:\WINDOWS\Logo1_.exe
C:\WINDOWS\RichDll.dll
C:\WINDOWS\system32\dllf.dll
C:\WINDOWS\system32\dllran.dll
C:\WINDOWS\system32\msndll.dll
C:\WINDOWS\system32\PDLL.dll
C:\WINDOWS\system32\qmdll.dll
C:\WINDOWS\system32\xgdll.dll
C:\WINDOWS\uninstall\rundl132.exe
C:\_desktop.ini

[Added registry]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,
Value=load,Data=C:\WINDOWS\uninstall\rundl132.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,
Value=qm,Data=C:\Program Files\Microsoft\svhost32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,
Value=fzg,Data=C:\WINDOWS\Config\svhost32.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,
Value=xg,Data=C:\Program Files\svhost32.exe

到目前為止，下面的防毒軟體可以偵測到這些惡意檔案：

svhost32.exe:
[ Trend ], "PE_LOOKED.SI"
svhost32.exe:
[ Trend ], "PE_LOOKED.SI"
tt1[1].exe:
[ Trend ], "TSPY_LINEAGE.EKJ"
xg[1].exe:
[ Trend ], "TSPY_LINEAGE.DNH"
xgdll.dll:
[ Trend ], "TSPY_LINEAGE.ELM"
z4[1].exe:
[ Trend ], "PE_LOOKED.SI-O"
Ding.com:
[ Trend ], "PE_LOOKED.SI-O"
Logo1_.exe:
[ Trend ], "PE_LOOKED.SI-O"
msndll.dll:
[ Trend ], "TSPY_LINEAGE.EHS"
rundl132.exe:
[ Trend ], "PE_LOOKED.SI-O"
SMSS.exe:
[ Trend ], "TSPY_LINEAGE.EKJ"
svchost.exe:
[ Trend ], "TSPY_LINEAGE.EKJ"
svhost32.exe:
[ Alpha_Gen ], "Possible_MLWR.01"
[ Beta_Gen ], "Possible_MLWR-1"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
WINLOGON.exe:
[ Alpha_Gen ], "Possible_MLWR.01"
[ Beta_Gen ], "Possible_MLWR-1"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
9Sy.exe:
[ Alpha_Gen ], "Possible_MLWR.01"
[ Beta_Gen ], "Possible_MLWR-1"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
dllf.dll:
[ Alpha_Gen ], "PAK_LookWow"
[ Beta_Gen ], "Possible_MLWR-3"
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ McAfee ], "New Malware.w !!"
[ Nod32 ], "Win32/PSW.Lineage.NDI trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
dllran.dll:
[ Alpha_Gen ], "Possible_MLWR.01"
[ Beta_Gen ], "Possible_MLWR-1"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
fg[1].exe:
[ Alpha_Gen ], "PAK_LookWow"
[ Beta_Gen ], "Possible_MLWR-3"
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ Nod32 ], "Win32/PSW.Lineage.NDI trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Grisoft ], "Trojan horse Generic3.VZ"
LSASS.exe:
[ Kaspersky ], "PAK:PE_Patch"
[ McAfee ], "New Malware.w !!"
[ Panda ], "Trj/Lineage.CFA"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Grisoft ], "Trojan horse PSW.Generic3.DQP"
mf[1].exe:
[ Alpha_Gen ], "Possible_MLWR.01"
[ Beta_Gen ], "Possible_MLWR-1"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
PDLL.dll:
[ Alpha_Gen ], "PAK_LookWow"
[ Beta_Gen ], "Possible_MLWR-3"
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ McAfee ], "PWS-Gamania.dll"
[ Nod32 ], "Win32/PSW.Lineage.DN trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
qm[1].exe:
[ Alpha_Gen ], "Possible_MLWR.01"
[ Beta_Gen ], "Possible_MLWR-1"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
qmdll.dll:
[ Alpha_Gen ], "Possible_Infostl"
[ Beta_Gen ], "Possible_Infostl"
[ McAfee ], "PWS-Lineage.dll"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
RichDll.dll:
[ Alpha_Gen ], "PAK_LookWow"
[ Beta_Gen ], "Possible_MLWR-3"
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ Kaspersky ], "Worm.Win32.Viking.gb"
[ McAfee ], "New Malware.w !!"
[ Panda ], "W32/Viking.GZ.drp"
[ Nod32 ], "Win32/Viking.CN virus"
[ Fortinet ], "W32/Viking.GB"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Grisoft ], "Virus identified Worm/Delf.ARI"
run[1].exe:
[ Alpha_Gen ], "Possible_MLWR.01"
[ Beta_Gen ], "Possible_MLWR-1"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
rundll32.exe:
[ Alpha_Gen ], "Possible_MLWR.01"
[ Beta_Gen ], "Possible_MLWR-1"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
SERVICES.exe:
[ Alpha_Gen ], "PAK_LookWow"
[ Beta_Gen ], "Possible_MLWR-3"
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ Nod32 ], "Win32/PSW.Lineage.NDI trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Grisoft ], "Trojan horse Generic3.VZ"
SVCHOST.exe:
[ Alpha_Gen ], "Possible_MLWR.01"
[ Beta_Gen ], "Possible_MLWR-1"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
svhost32.exe:
[ Alpha_Gen ], "PAK_LookWow"
[ Beta_Gen ], "Possible_MLWR-3"
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ Nod32 ], "Win32/PSW.Lineage.NDI trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Grisoft ], "Trojan horse Generic3.VZ"

昨天微軟發佈 2007 年 2 月 安全漏洞修補程式，包含 12 個安全公告，6 個為重大嚴重性 (Critical)，6 個為重要嚴重性 (Important)，如下所示：

• Step-by-Step Interactive Training (MS07-005)
  
  
  
  • 最高的嚴重性等級：重要 (Important)
  
  
  • 允許遠端執行程式碼 (Could Allow Remote Code Execution)
  
  
  
  


• Windows Shell (MS07-006)
  
  
  
  • 最高的嚴重性等級：重要 (Important)
  
  
  • 允許提升權限 (Could Allow Elevation of Privilege )
  
  
  
  


• Windows Image Acquisition Service (MS07-007)
  
  
  
  • 最高的嚴重性等級：重要 (Important)
  
  
  • 允許提升權限
  
  
  
  


• HTML Help ActiveX Control (MS07-008)
  
  
  
  • 最高的嚴重性等級：重大 (Critical)
  
  
  • 允許遠端執行程式碼
  
  
  
  


• Microsoft Data Access Components (MS07-009)
  
  
  
  • 最高的嚴重性等級：重大 (Critical)
  
  
  • 允許遠端執行程式碼
  
  
  
  


• Microsoft Malware Protection Engine (MS07-010)
  
  
  
  • 最高的嚴重性等級：重大 (Critical)
  
  
  • 允許遠端執行程式碼
  
  
  
  


• Microsoft OLE Dialog (MS07-011)
  
  
  
  • 最高的嚴重性等級：重要 (Important)
  
  
  • 允許遠端執行程式碼
  
  
  
  


• Microsoft MFC (MS07-012)
  
  
  
  • 最高的嚴重性等級：重要 (Important)
  
  
  • 允許遠端執行程式碼
  
  
  
  


• Microsoft RichEdit (MS07-013)
  
  
  
  • 最高的嚴重性等級：重要 (Important)
  
  
  • 允許遠端執行程式碼
  
  
  
  


• Microsoft Word (MS07-014)
  
  
  
  • 最高的嚴重性等級：重大 (Critical)
  
  
  • 允許遠端執行程式碼
  
  
  
  


• Microsoft Office (MS07-015)
  
  
  
  • 最高的嚴重性等級：重大 (Critical)
  
  
  • 允許遠端執行程式碼
  
  
  
  


• Cumulative Security Update for Internet Explorer (MS07-016)
  
  
  
  • 最高的嚴重性等級：重大 (Critical)
  
  
  • 允許遠端執行程式碼
  
  
  
  

至於其他詳細的部份，請參考 Microsoft Security Bulletin Summary for February, 2007。-----

國立政治大學外交學系中文首頁被植入惡意連結，又是 Lineage 變種。請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式會偷帳號與密碼)。(感謝 Jimau)

**請幫忙通知他們，謝謝**



惡意連結是放置在中文的首頁中：



惡意程式的一部分為：



執行之後，有下面的行為：

[DLL injection]
C:\Program Files\Common Files\search.dll (注入某些執行程序如檔案總管等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\update.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\update[1].exe
C:\Program Files\Common Files\search.dll
C:\WINDOWS\system32\winCreate.exe

[ Added COM/BHO ]
{6F4747B0-4094-4200-A251-866989504B17}-C:\Program Files\Common Files\search.dll

到目前為止，下面的防毒軟體可以偵測到這些惡意檔案：

search.dll
[ Trend ], "TSPY_LINEAGE.BNA"
update.exe:
[ Trend ], "TSPY_LINEAGE.BNA"
update[1].exe:
[ Trend ], "TSPY_LINEAGE.BNA"
winCreate.exe:
[ Trend ], "TSPY_LINEAGE.BNA"

媽媽寶寶首頁被植入惡意連結，此惡意程式會偽裝為卡巴斯基防毒軟體的執行程序 (與「MSN Messenger 木馬」相似)。此網站為專業婦幼保健雜誌，是新手父母懷孕生產育兒的必讀雜誌，我猜測受害者應該不少。請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式會偷帳號與密碼，也有可能會偷信用卡卡號，而且，會監控網路情形)。(感謝 Jimau)

**請幫忙通知他們，謝謝**



惡意連結放置在首頁中：



惡意程式碼的一部分為：



執行之後，有下面的行為：

[Added process]
C:\WINDOWS\avp.exe

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL (安裝此服務，但這是正常的服務，不能移除，否則，網路連線會有問題)
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\elven[1].exe
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\ld6media.dll (被使用在 LSP)

[Added LSP] (在 Windows XP SP2 下，可以用「netsh winsock show catalog」命令查看)
ID: 1012
NAME: MSAFD Tcpip [RAW/IP]

ID: 1013
NAME: MSAFD Tcpip [TCP/IP]

到目前為止，下面的防毒軟體可以偵測到這些惡意檔案：

elven[1].exe:
[ Trend ], "Possible_Virus"
ld6media.dll:
[ Trend ], "Possible_Virus"
avp.exe:
[ Trend ], "Possible_Virus"

國立成功大學資訊工程學系網頁遭駭。這裡要注意的是這個網站是有可能被植入惡意連結或惡意程式碼，所以，他們的網管應該要找出問題的關鍵，而不是只是移除這些遭駭的內容。

**請幫忙通知他們，謝謝**

首頁：



遭置換網頁：



至於詳細的資訊，可以參考 zone-h。-----

桃園縣政府文化局網頁遭駭。這裡要注意的是這個網站是有可能被植入惡意連結或惡意程式碼，所以，他們的網管應該要找出問題的關鍵，而不是只是移除這些遭駭的內容。

**請幫忙通知他們，謝謝**

文化局首頁：



遭置換的網頁：



至於詳細的資訊，可以參考 zone-h。-----

昨天新華網和聯合新聞網都相繼報導熊貓燒香病毒作者被逮捕大陸公安部門逮捕的消息。熊貓燒香病毒是 2006 年大陸地區十大病毒之首，其所造成的損害，可想而知。

至於詳細的資訊，請看下面的相關報導：

“熊??香”病毒案告破

偵破「熊貓燒香」電腦病毒案 8人被捕

W32/Fujacks: Panda Malware Breeders Arrested -----

天喜旅行社網頁又被置入惡意連結 ，他們的網管人員應該要檢查系統或軟體是否有安全漏洞。此惡意程式為 Lineage 的變種，在我的測試機器上，會產生應用程式錯誤，不曉得在各位的機器上是否會有相同的結果，請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式會偷帳號與密碼)。

**請幫忙通知他們，謝謝**



惡意連結是放置在 index_main_new.htm 檔案中：



惡意程式碼的一部分為：



執行之後，有下面的行為 (產生應用程式錯誤)：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\update.exe

到目前為止，下面的防毒軟體可以偵測到這些惡意檔案：

update.exe:
[ Trend ], "TSPY_LINEAGE.BNA"

**高度危險網站：常常被植入惡意連結**

社團法人台北市野鳥學會首頁又被植入惡意連結 (太多次了吧)，又是 Lineage 的另一個變種。他們的網管人員應該沒有找出會發生問題的關鍵，所以，系統常常被攻擊者植入惡意連結，只能說沒事不要瀏覽他們的網站或利用其他系統 (如 VMWare) 瀏覽。請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式會偷帳號與密碼)。

**請幫忙通知他們，謝謝**


惡意連結是放置在首頁中：



惡意程式碼的一部分為：



執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Help\46A89379.DLL (注入某些執行程序如檔案總管等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\gmsex[1].exe
C:\WINDOWS\Help\46A89379.DLL
C:\WINDOWS\Help\46A89379.EXE

[Added COM/BHO]
{7A645271-F10F-4D5C-AAF4-07E088640D7C}-C:\WINDOWS\Help\46A89379.DLL

到目前為止，下面的防毒軟體可以偵測到這些惡意檔案：

46A89379.EXE:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact"
[ HBEDV ], "HEUR/Malware"
gmsex[1].exe:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact"
[ HBEDV ], "HEUR/Malware"
46A89379.DLL:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact"
[ Nod32 ], "probably a variant of Win32/PSW.Lineage.DN trojan"
[ HBEDV ], "HEUR/Malware"-----

台北市電器商業同業公會網頁遭駭。這裡要注意的是這個網站是有可能被植入惡意連結或惡意程式碼，所以，他們的網管應該要找出問題的關鍵，而不是只是移除這些遭駭的內容。

**請幫忙通知他們，謝謝**

公會首頁：



遭置換網頁 (被植入一個後端管理介面，意思是說駭客可以透過這個管理介面，存取內部資料)：



至於詳細的資訊，可以參考 zone-h。

另外，此網站首頁也被植入一個惡意連結 (如下圖)，而此連結是放置另一個正常的網站中，不過，目前無法存取。

-----

雅琥汽車空調首頁被植入惡意連結 (在 Hinet 個人網頁中，Hinet 是不是應該要負責此網站的安全呢？)，這個公司的名字和網址都與 Yahoo 很像，不曉得會不會被告呢？。請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式具有遠端控制能力)。(感謝 CM)

**請幫忙通知他們，謝謝**



此網站在 Hinet 上有另一個備份網站 (hxxp://yahooo.myhinet.hinet.net)，惡意連結是放置在備份網站首頁中 (原本的網頁會執行備份網站的惡意連結) ：



惡意程式碼的一部分為：



執行之後，有下面的行為：

[Added process]
C:\Program Files\Internet Explorer\IEXPLORE.EXE (開啟一個看不見的瀏覽器)

[Added service]
NAME: win
DISPLAY: win
FILE: C:\WINDOWS\win1.exe

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\1[1].exe
C:\WINDOWS\win1.exe

到目前為止，下面的防毒軟體可以偵測到這些惡意檔案：

1[1].exe:
[ Trend ], "BKDR_HUPIGON.BSH"
win1.exe:
[ Trend ], "BKDR_HUPIGON.BSH"-----

屏東縣里港國小網頁被植入惡意連結。這隻惡意程式在系統安裝了非常多的元件，請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式會偷帳號與密碼)。(感謝 Jimau)

**請幫忙通知他們，謝謝**



惡意連結放置在我的圖片冊的首頁中 (有很多筆)：



惡意程式碼的一部分為：



執行之後，有下面的行為：

[Added process]
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\伀縐勘.EXE
C:\WINDOWS\svch0st.exe
C:\Documents and Settings\Temp.exe
C:\WINDOWS\system32\bot7.exe
c:\bot2.exe

[DLL injection]
C:\WINDOWS\system32\Kav26.dll (注入某些執行程序如檔案總管等)

[Added service]
NAME: qrffsdfsdf
DISPLAY: qrffsdfsdf
FILE: C:\WINDOWS\Hacker.com.cn.ini

NAME: svcname
DISPLAY: 督昢靡
FILE: C:\WINDOWS\system32\bot7.exe

[Added file]

C:\bot2.exe
C:\bot5.exe
C:\bot6.exe
C:\bot7.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\bt5400.bat
C:\Documents and Settings\Administrator\Local Settings\Temp\haotian.bat
C:\Documents and Settings\Administrator\Local Settings\Temp\IXP000.TMP\Server.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\IXP000.TMP\伀縐勘.EXE
C:\Documents and Settings\Administrator\Local Settings\Temp\yt.vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\2[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\6[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\mimi[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\yg[1].vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\2[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\admin_book[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\network[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\恀毞2堎5蔬綬惘鎮[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\1[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\1[2].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\4[1].exe
C:\Documents and Settings\Temp.exe
C:\WINDOWS\Hacker.com.cn.ini
C:\WINDOWS\svch0st.exe
C:\WINDOWS\system32\bot7.exe
C:\WINDOWS\system32\ctfnom.exe
C:\WINDOWS\system32\drivers\usbue.sys
C:\WINDOWS\system32\Kav26.dll
C:\WINDOWS\yg.exe

[Added registry]
HKCU\Software\Microsoft\Windows\CurrentVersion\Run,
Value=z7d10vf8dyg8m8q,Data=C:\WINDOWS\svch0st.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,
Value=MYIE2,Data=c:\bot2.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,
Value=wextract_cleanup0,Data=rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\IXP000.TMP\"

HKU\S-1-5-21-515967899-583907252-839522115-500\Software\Microsoft\Windows\
CurrentVersion\Run,Value=z7d10vf8dyg8m8q,Data=C:\WINDOWS\svch0st.exe

到目前為止，下面的防毒軟體可以偵測到這些惡意檔案：

1[1].exe:
[ Trend ], "TROJ_Generic"
bot7.exe:
[ Trend ], "TROJ_PANDDOS.B"
bot7.exe:
[ Trend ], "TROJ_PANDDOS.B"
ctfnom.exe:
[ Trend ], "TROJ_Generic"
mimi[1].exe:
[ Trend ], "TROJ_PANDDOS.B"
usbue.sys:
[ Trend ], "TROJ_SMALL.DQM"
1[2].exe:
[ Symantec ], "Backdoor.Hupigeon"
[ Kaspersky ], "PAK:Expressor, Backdoor.Win32.Hupigon.drc"
[ McAfee ], "BackDoor-ARR"
[ Sophos ], "Troj/GrayBr-Gen"
[ Panda ], "Suspicious file"
[ Nod32 ], "a variant of Win32/Hupigon trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "BDS/Hupigon.Gen"
[ Rising ], "[>>eXPressor1.2]:Backdoor.Gpigeon.gen"
[ Ewido ], "Backdoor.Hupigon.128"
[ Ahnlab ], "infected by Win-Trojan/Hupigon.353148.B"
[ Grisoft ], "Trojan horse BackDoor.Generic3.TEB"
2[1].exe:
[ Kaspersky ], "PAK:NSPack, PAK:PE_Patch.MaskPE, Backdoor.Win32.Hupigon.dzq"
[ McAfee ], "New Malware.u !!"
[ Sophos ], "Troj/GrayBr-Gen"
[ Nod32 ], "a variant of Win32/Hupigon trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "BDS/Hupigon.Gen"
[ Norman ], "Trojan W32/Klone.J"
2[1].exe:
[ Symantec ], "Infostealer.Gampass"
[ Kaspersky ], "PAK:UPack, Trojan-PSW.Win32.Delf.ub"
[ McAfee ], "Generic Downloader.y"
[ Sophos ], "Mal/Packer"
[ Nod32 ], "a variant of Win32/PSW.Delf.NEV trojan"
[ Fortinet ], "Dloader.Y!tr"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "Trojan W32/DLoader.BYPF"
[ Ewido ], "Downloader.Murlo.ez"
[ Grisoft ], "Trojan horse Downloader.Generic3.NVY"
4[1].exe:
[ Symantec ], "Infostealer.Gampass"
[ Kaspersky ], "Trojan-PSW.Win32.Nilage.bft"
[ Fortinet ], "W32/Nilage.BFT!tr.pws"
[ HBEDV ], "TR/PSW.Nilage.bft.29"
[ Ewido ], "Trojan.Nilage.bft"
[ Grisoft ], "Trojan horse PSW.Generic3.DRT"
6[1].exe:
[ Fortinet ], "PossibleThreat!022954"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Grisoft ], "Trojan horse PSW.Generic3.DUB"
admin_book[1].exe:
[ Kaspersky ], "ARC:DotFix NiceProtect, ARC:[data0000.cab]:CAB, ARC:[data0000.cab/?.EXE]:QuickBatch, PAK:[data0000.cab/Server.exe]:NSPack, PAK:[data0000.cab/Server.exe]:ASPack, PAK:[data0000.cab/Server.exe]:PE_Patch.UPX, PAK:[data0000.cab/Server.exe]:UPX, [data0000.cab/Server.exe]:unknown format."
[ Sophos ], "[SfxArchiveData\Server.exe]:Troj/GrayBr-Gen"
[ Fortinet ], "BDoor.AWQ!tr.bdr"
[ Ewido ], "[/Server.exe]:Backdoor.Hupigon.awp, [/Server.exe]:Backdoor.Hupigon.awp"
[ Grisoft ], "[\Server.exe]:Trojan horse BackDoor.Generic4.PQO, Trojan horse BackDoor.Generic4.PQO"
bot2.exe:
[ Symantec ], "Infostealer.Gampass"
[ McAfee ], "Generic Downloader.y"
[ Sophos ], "Mal/Packer"
[ Nod32 ], "a variant of Win32/PSW.Delf.NEV trojan"
[ Fortinet ], "Dloader.Y!tr"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "Trojan W32/DLoader.BYPF"
[ Ewido ], "Downloader.Murlo.ez"
[ Grisoft ], "Trojan horse Downloader.Generic3.NVY"
bot5.exe:
[ Fortinet ], "PossibleThreat!022954"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Grisoft ], "Trojan horse PSW.Generic3.DUB"
bot6.exe:
[ Fortinet ], "PossibleThreat!022965"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
filename_change1.exe:
[ Fortinet ], "PossibleThreat!022965"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
Kav26.dll:
[ Symantec ], "Infostealer.Gampass"
[ McAfee ], "PWS-Zhengtu"
[ Fortinet ], "W32/Nilage.BFT!tr.pws"
[ HBEDV ], "TR/Dldr.Agent.OL.1"
[ Ewido ], "Trojan.Nilage.bft"
[ Grisoft ], "Trojan horse PSW.Generic3.CJH"
network[1].exe:
[ Microsoft ], "[->(UPX)]:TrojanDropper:Win32/Small.gen"
[ Nod32 ], "probably unknown NewHeur_PE virus [7]"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "[Heuristic Sandbox detection]:Virus W32/Downloader"
[ Grisoft ], "Trojan horse Generic3.OA"
Server.exe:
[ Symantec ], "Backdoor.Graybird"
[ McAfee ], "BackDoor-AWQ"
[ Sophos ], "Troj/GrayBr-Gen"
[ Alwil ], "Win32:Hupigon-OH [Trj]"
[ Nod32 ], "a variant of Win32/Hupigon trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "BDS/Hupigon.Gen"
[ Ewido ], "Backdoor.Hupigon.awp"
[ Grisoft ], "Trojan horse BackDoor.Generic4.PQO"
Temp.exe:
[ Sophos ], "[SfxArchiveData\Server.exe]:Troj/GrayBr-Gen"
[ Fortinet ], "BDoor.AWQ!tr.bdr"
[ Ewido ], "[/Server.exe]:Backdoor.Hupigon.awp, [/Server.exe]:Backdoor.Hupigon.awp"
[ Grisoft ], "[\Server.exe]:Trojan horse BackDoor.Generic4.PQO, Trojan horse BackDoor.Generic4.PQO"
yg.exe:
[ Microsoft ], "[->(UPX)]:TrojanDropper:Win32/Small.gen"
[ Nod32 ], "probably unknown NewHeur_PE virus [7]"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "[Heuristic Sandbox detection]:Virus W32/Downloader"
[ Grisoft ], "Trojan horse Generic3.OA"-----