大砲開講

中國E網網頁被置入惡意程式碼，請各位小心囉。





惡意連結是放置在 menu.js 的檔案中：



解碼之後為 hxxp://www.cf9388.com/enlish/map.htm

惡意程式碼為：



執行之後，有下面行為：

[Added process]
C:\Documents and Settings\Administrator\Local Settings\Temp\SVCHOST.EXE
C:\Documents and Settings\Administrator\Local Settings\Temp\SVCH0ST.exe

[DLL injection]
C:\Documents and Settings\Administrator\Local Settings\Temp\SVCHOST.EXE (注入某些執行程序如 svchost.exe 等)

[Added service]
NAME: microsoft basicnet service
DISPLAY: microsoft network service
FILE: C:\WINDOWS\msnet.exe

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\g0ld.com
C:\Documents and Settings\Administrator\Local Settings\Temp\SVCH0ST.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\SVCHOST.EXE
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\a[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\network[2].exe
C:\SVCHOST.exe
C:\WINDOWS\msnet.exe

[Added registry]
HKCU\Software\Microsoft\Windows\CurrentVersion\Run||Value=system||Data=c:\SVCHOST.exe
HKU\S-1-5-21-515967899-583907252-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run||Value=system||Data=c:\SVCHOST.exe



請注意下面的防毒軟體可以偵測到這些惡意檔案：

msnet.exe:
[ Trend ], "BKDR_HUPIGON.UH"
SVCH0ST.exe:
[ Kaspersky ], "PAK:FSG"
[ Sophos ], "Mal/Packer"
[ Nod32 ], "probably unknown NewHeur_PE virus [7]"
[ Fortinet ], "suspicious"
[ HBEDV ], "HEUR/Malware"
[ Norman ], "Security Risk Suspicious_F.gen"
[ Rising ], "[>>FSG2.0]:Trojan.DL.Agent.cjq"-----

哇！部落格上了聯合新聞網 (別讓網頁上的惡意程式，入侵你的個人電腦)！



昨天晚上，以前的同事 MSN 我說大砲開講部落格上了聯合新聞網，還一臉疑惑，連上去看了以後，原來是在介紹軟體，各位可連上去看看囉，我就不多說了。

不過，在這裡還是要感謝網友 Jimau 這麼支持，一直提供惡意網址，還有其他網友的支援，謝謝囉。-----

巧軒水草網網站被放置惡意程式碼，還找不到網頁有沒有被放置這惡意程式碼，不過，連進他們的論壇，會出現一個很奇怪 Help 的視窗，與執行這個惡意程式碼是一樣的，也許是無法在我的測試機器上執行，不過，我還是把它抓下來執行看看，結果，真的有問題，所以，請各位小心。

更新：惡意程式被放在 default.asp (hxxp://www.g-h.idv.tw/web/ghforum/default.asp) 的檔案裡。









執行之後，會有下面的行為：

[DLL Injection]
C:\WINDOWS\KZAEAD.DAT (注入瀏覽器的執行程序)
C:\WINDOWS\XWDVXS.DAT (注入某些執行程序如檔案總管等)

[Added service]
NAME: Workstation Service
DISPLAY: Workstation Service
FILE: C:\WINDOWS\svchostr.exe (找不到這個檔案)

[Modified service]
NAME: ALG
DISPLAY: Application Layer Gateway Service
FILE: C:\WINDOWS\System32\alg.exe

NAME: IpNat
DISPLAY: IP Network Address Translator
FILE: System32\DRIVERS\ipnat.sys

NAME: SharedAccess
DISPLAY: Windows Firewall/Internet Connection Sharing (ICS)
FILE: C:\WINDOWS\System32\svchost.exe -k netsvcs

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\1[1].exe
C:\Temp\xiexie.exe
C:\WINDOWS\KZAEAD.DAT
C:\WINDOWS\svchostr.exe
C:\WINDOWS\system32\PluginENLOG.DLL
C:\WINDOWS\XWDVXS.DAT



注意：下面的防毒軟體可以偵測到這些惡意檔案。

xiexie.exe:
[ Trend ], "WORM_DELF.DXF"
KZAEAD.DAT:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact, PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact, Backdoor.Win32.Hupigon.avh"
[ McAfee ], "BackDoor-AWQ.b"
[ Alwil ], "Win32:Hupigon-GL [Trj]"
[ Nod32 ], "probably a variant of Win32/Hupigon trojan"
[ Fortinet ], "suspicious"
[ Rising ], "[>>PECompact2.x>>PECompact2.x]:Trojan.Spy.Keylogger.acx"
[ Grisoft ], "Trojan horse BackDoor.Generic3.RGV"
XWDVXS.DAT:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact, Backdoor.Win32.Hupigon.avg"
[ McAfee ], "BackDoor-AWQ.b"
[ Nod32 ], "Win32/Hupigon trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "BDS/Hupigon.jm.1.B"
[ Rising ], "[>>PECompact2.x]:Trojan.Spy.Keylogger.acy"
[ Grisoft ], "Trojan horse BackDoor.Delf.18.AS"
1[1].exe:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact, PAK:PEPatch, Backdoor.Win32.Hupigon.gs"
[ McAfee ], "[000c7200.EXE]:BackDoor-AWQ.b, [000b8400.EXE]:BackDoor-AWQ.b"
[ Sophos ], "Troj/GrayBr-Gen"
[ Alwil ], "Win32:Hupigon-BX [Trj]"
[ Nod32 ], "a variant of Win32/Hupigon trojan"
[ Fortinet ], "W32/Hupigon.GS!tr.bdr"
[ HBEDV ], "BDS/Hupigon.GS.268"
[ Norman ], "Trojan W32/Hupigon.THT"
[ Rising ], "[>>PECompact2.x>>PE_PATCH(07)]:Backdoor.Gpigeon.gen"
[ Ewido ], "Backdoor.Hupigon.gs"
[ Grisoft ], "Trojan horse BackDoor.Generic3.RJJ"-----

喜多喜卡網首頁被植入惡意程式碼，雖然，目前無法在我的測試機器上執行，但無法保證惡意程式不會更新，所以，請小心囉。(感謝 Jimau)





惡意程式連結放置在首頁的：



惡意程式碼為：





注意：下面的防毒軟體可以偵測到這些惡意檔案：

ghosttop103.exe:
[ Trend ], "TSPY_LINEAGE.AYD"
ghosttop1229.exe:
[ Trend ], "TSPY_LINEAGE.AYD"-----

104baby幼教網首頁被植入惡意程式碼，病毒程式在我的測試機器上，會產生錯誤，不過，還是請各位小心囉。





惡意程式碼是被放置在首頁有 iframe 的地方：



程式碼為：





注意：下列的防毒軟體可以偵測到這些惡意程式檔案。

Player.exe:
[ Symantec ], "Backdoor.Graybird"
[ Kaspersky ], "PAK:PE_Patch.NSAnti, PAK:NSAnti, Packed.Win32.NSAnti"
[ McAfee ], "BackDoor-AWQ"
[ Sophos ], "Troj/GrayBr-Gen"
[ Alwil ], "Win32:MianCrypt-gen [Trj]"
[ Fortinet ], "BDoor.AWQ!tr.bdr"
[ HBEDV ], "TR/Crypt.NSAnti.Gen"
[ Rising ], "Backdoor.Gpigeon.ldp"
svchost.exe:
[ Symantec ], "Backdoor.Graybird"
[ Kaspersky ], "PAK:PE_Patch.NSAnti, PAK:NSAnti, Packed.Win32.NSAnti"
[ McAfee ], "BackDoor-AWQ"
[ Sophos ], "Troj/GrayBr-Gen"
[ Alwil ], "Win32:MianCrypt-gen [Trj]"
[ Fortinet ], "BDoor.AWQ!tr.bdr"
[ HBEDV ], "TR/Crypt.NSAnti.Gen"
[ Rising ], "Backdoor.Gpigeon.ldp"-----

朱銘美術館首頁有惡意程式碼，之前已經通知他們，但他們似乎不太理會，現在，又有新的惡意程式碼，請各位小心。




惡意程式碼是首頁 (是指到在惠安移民網頁，但又被指到其他地方，最後是指到 hxxp://www.gamaniatw.com/img/dadi.htm)：



程式碼為：



執行之後，有下列行為：

[Added process]
C:\WINDOWS\avp.exe

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL (這個是正常的，是為了建立LSP)
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\king[1].exe
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\ldvwer10.dll

[Added LSP]
NAME: MSAFD Tcpip [RAW/IP] (C:\WINDOWS\system32\ldvwer10.dll)
NAME: MSAFD Tcpip [TCP/IP] (C:\WINDOWS\system32\ldvwer10.dll)



注意:大部分防毒軟體都偵測不到，除了下列的：

king[1].exe:
[ Trend ], Possible_Virus
ldvwer10.dll:
[ Trend ], Possible_Virus
avp.exe:
[ Sophos ], "Troj/Maran-Gen"
[ Panda ], "Trj/Maran.L"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ HBEDV ], "TR/Agent.63902.B"
[ Rising ], "Trojan.Delf.njo"
[ Ewido ], "Trojan.Lineage.ajf"

1111進修網首頁被植入惡意程式碼，與朱銘美術館中的是一樣的，請各位小心。(感謝 Jimau)





惡意程式碼的網頁在：



置於執行之後的行為，請參考朱銘美術館首頁又有新的惡意程式碼。

社團法人台北市野鳥學會首頁被植入惡意程式碼，與中華民國銀行公會中華民國銀行公會網頁被植入惡意程式碼是一樣的，不過，病毒檔案已經更新，請各位小心。(感謝 Jimau)





執行之後，有下列的行為：

[DLL Injection]
C:\WINDOWS\Help\46364C67.dll (注入某些執行程序如檔案總管等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\update.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\gmsex[1].exe
C:\WINDOWS\Help\46364C67.dll
C:\WINDOWS\Help\46364C67.exe

[Added COM/BHO]
{A41F7C10-93C3-4177-9212-6831FF3B1714}-C:\WINDOWS\help\46364C67.dll



注意：大部分的防毒軟體都偵測不到，除了下列的：

46364C67.exe:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact"
[ HBEDV ], "HEUR/Malware"
gmsex[1].exe:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact"
[ HBEDV ], "HEUR/Malware"
update.exe:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact"
[ HBEDV ], "HEUR/Malware"
46364C67.dll:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact"
[ Nod32 ], "probably a variant of Win32/PSW.Lineage.DN trojan"
[ HBEDV ], "HEUR/Malware"-----

這幾天幾乎都把心力花費在測試反間諜軟體上，本來想在今年的最後一天把測試報告公佈，但要測試的軟體實在是太多，而且機器數量不夠，所以，有一點點延遲，要等到2007年初，才能完成這份報告。不過，也有一個好消息要告訴各位，那就是我的英文部落格在今天誕生了，雖然，內容還不多，而且，都是從我的中文部落格直接翻譯過來，不過，沒關係，最主要的用意是以後可以分享一些東西給其他國家的同好。我的英文部落格：http://malware-test.com/weblog/

Happy New Year !!

:-)-----

每得科技首頁被植入惡意程式碼，跟之前一些中毒的網站相同，不過，檔案好像變動過了，以至於防毒軟體也不是都偵測的道，所以，請各位小心囉。(建議使用 FireFox)







惡意程式碼是被放在下列的位置：



程式碼為：



執行之後，有下列的行為：

[Added process]
c:\Program Files\chinadu.exe

[DLL Injection]
C:\WINDOWS\java\classes\66A75.dll (注入某些執行程序如檔案總管等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\top[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\top[2].exe
C:\logex.txt (記錄檔)
C:\Program Files\chinadu.exe
C:\WINDOWS\java\classes\66A75.dll
C:\WINDOWS\java\classes\66A75.exe

[Added BHO]
{C8D81FE1-EF3D-4755-BA05-0BE477385679}-C:\WINDOWS\java\classes\66A75.dll



注意：下列的防毒軟體可以偵測到這些病毒檔案：

66A75.exe:
[ Kaspersky ], "PAK:UPack, Trojan-PSW.Win32.Nilage.bdt"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/QQPass.PR"
[ Nod32 ], "a variant of Win32/PSW.Lineage.ACN trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Agent.52144.A"
[ Norman ], "Virus W32/Viking.EQ"
[ Ewido ], "Trojan.OnLineGames.cy"
chinadu.exe:
[ Kaspersky ], "PAK:UPack, Trojan-PSW.Win32.Nilage.bdt"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/QQPass.PR"
[ Nod32 ], "a variant of Win32/PSW.Lineage.ACN trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Agent.52144.A"
[ Norman ], "Virus W32/Viking.EQ"
[ Ewido ], "Trojan.OnLineGames.cy"
top[1].exe:
[ Kaspersky ], "PAK:NSPack, PAK:PE_Patch, PAK:MEW, Trojan-Downloader.Win32.Agent.bds"
[ Sophos ], "Mal/Packer"
[ Nod32 ], "probably unknown NewHeur_PE virus [7]"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Agent.4554"
[ Norman ], "Trojan W32/Malware.FHI"
[ Ewido ], "Downloader.Agent.bds"
top[2].exe:
[ Kaspersky ], "PAK:UPack, Trojan-PSW.Win32.Nilage.bdt"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/QQPass.PR"
[ Nod32 ], "a variant of Win32/PSW.Lineage.ACN trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Agent.52144.A"
[ Norman ], "Virus W32/Viking.EQ"
[ Ewido ], "Trojan.OnLineGames.cy"
66A75.dll:
[ Kaspersky ], "Trojan-PSW.Win32.Nilage.bdt"
[ Panda ], "Trj/QQPass.PR"
[ Nod32 ], "a variant of Win32/PSW.Lineage.DN trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/PSW.Nilage.bdt"