台中市電腦商業同業公會首頁又被植入惡意連結

台中市電腦商業同業公會首頁又被植入惡意連結，此惡意程式為 MARAN 的變種，最近有瀏覽這些網頁的網友，應該要盡速檢查自己的電腦，請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式會偷帳號與密碼)。另外，此惡意程式是利用微軟所公佈的安全漏洞 (Vulnerability in Windows Animated Cursor Handling) (此為零時差攻擊)。昨天深夜寄郵件給他們，到目前為止 (2007/4/12 @ 12:45)，尚未處理。有興趣的網友，可以在 VMWare 上測試一下，順便通知他們。

**請幫忙通知他們，謝謝**

惡意連結是放置在首頁中的：

惡意程式碼的一部分為：

ANI 零時差攻擊的部份為：

執行之後，有下面的行為：

[Added process]
C:\WINDOWS\avp.exe

[Deleted process]

[----- DLL -----]
C:\Program Files\Internet Explorer\PLUGINS\BinNice.dll (注入某個執行程序如檔案總管、IE 等)
C:\WINDOWS\system32\ldmedia5.dll (注入某個執行程序如 IE 等)

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL (這是正常的服務)
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\autorun.bat
C:\Documents and Settings\Administrator\Local Settings\Temp\css.vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\2[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\ani[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\css[1].vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\flash[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\svchost[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\getflashplayer[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\xskj[1].jpg
C:\Program Files\Internet Explorer\PLUGINS\BinNice.bak
C:\Program Files\Internet Explorer\PLUGINS\BinNice.bkk
C:\Program Files\Internet Explorer\PLUGINS\BinNice.dll
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\ldmedia5.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (連結至 C:\WINDOWS\system32\ldmedia5.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (連結至 C:\WINDOWS\system32\ldmedia5.dll)

[Added COM/BHO]
{03E636B9-AE6C-5E23-638E-B633E22F6338}-C:\Program Files\Internet Explorer\PLUGINS\BinNice.dll

到目前為止 (2007/4/12 @ 03:07)，下面的防毒軟體可以偵測到這些惡意檔案：

ldmedia5.dll:
[ Trend ], "TROJ_MARAN.EN"
avp.exe:
[ Trend ], "TROJ_DELF.DZE"
BinNice.bak:
[ Microsoft ], "[->(FSG-v2.0)]:TrojanDropper:Win32/Dowque.A"
[ Kaspersky ], "PAK:FSG"
[ Sophos ], "Mal/Packer"
[ Panda ], "Suspicious file"
[ Fortinet ], "suspicious"
[ HBEDV ], "DR/Delphi.Gen"
[ Norman ], "Security Risk Suspicious_F.gen"
BinNice.bkk:
[ Microsoft ], "[->(UPX)]:TrojanDropper:Win32/Dowque.A"
[ Kaspersky ], "PAK:UPX"
[ HBEDV ], "HEUR/Crypted"
BinNice.dll:
[ Microsoft ], "[->(UPX)]:TrojanDropper:Win32/Dowque.A"
[ Kaspersky ], "PAK:UPX"
[ HBEDV ], "HEUR/Crypted"
getflashplayer[1].htm:
[ Alpha_Gen ], "Heur_Infrm-1"
[ Kaspersky ], "Trojan-Downloader.VBS.Psyme.fx"
autorun.bat:
[ Microsoft ], "[->(FSG-v2.0)]:TrojanDropper:Win32/Dowque.A"
[ Kaspersky ], "PAK:FSG"
[ Sophos ], "Mal/Packer"
[ Panda ], "Suspicious file"
[ Fortinet ], "suspicious"
[ HBEDV ], "DR/Delphi.Gen"
[ Norman ], "Security Risk Suspicious_F.gen"
xskj[1].jpg:
[ AhnLab-V3 ], “Win-Trojan/Exploit-ANI.B”
[ AntiVir ], “EXP/MS05-002.Ani.A”
[ BitDefender ], “Exploit.Win32.MS05-002.Gen”
[ CAT-QuickHeal ], “Exploit.MS05-002〃
[ ClamAV ], “Exploit.W32.MS05-002〃
[ eTrust-Vet ], “Win32/MSA-935423!exploit”
[ Ewido ], “Not-A-Virus.Exploit.Win32.IMGANI.h”
[ F-Secure ], “Exploit.Win32.IMG-ANI.h”
[ Kaspersky ], “Exploit.Win32.IMG-ANI.h”
[ McAfee ], “Exploit-ANIfile.c”
[ Microsoft ], “TrojanDownloader:Win32/Anicmoo.gen!D”
[ NOD32v2 ], “a variant of Win32/TrojanDownloader.Ani.Gen”
[ Norman ], “RIFF/Ani_exploit.gen”
[ Sophos ], “Troj/Animoo-U”
[ Symantec ], “Trojan.Anicmoo”
[ Trend ], “EXPL_ANICMOO.GEN”
[ VirusBuster ], “Exploit.ANIFile.G”
[ Webwasher-Gateway ], “Exploit.MS05-002.Ani.A”