大砲開講

正宗萬巒林家豬腳網站被植入惡意連結，此惡意程式為 PE_LOOKED (應該會感染執行檔)，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦。請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息。對此有興趣的網友，可以在 VMWare 上測試一下，順便通知他們。(Credit: Snow, Ada)

**請幫忙通知他們，謝謝**




惡意連結是放置在首頁和 inside.asp 中的：



惡意程式碼的一部份為：



執行之後，有下面的行為：

[DLL injection]
C:\viDll.dll (注入 IE 的執行程序)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\winlogin.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\jpg[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\jpg[1].htm
C:\viDll.dll
C:\WINDOWS\rundl132.exe
C:\_desktop.ini (每個資料夾都出現此檔案)

到目前為止 (2007/4/13 @ 20:16)，下面的防毒軟體可以偵測到這些惡意檔案：

jpg[1].exe:
[ Trend ], "PE_LOOKED.BE-O"
[ Symantec ], "W32.Looked.P"
[ Kaspersky ], "PAK:UPack, Worm.Win32.Viking.r"
[ McAfee ], "W32/HLLP.Philis.aq"
[ Sophos ], "W32/Looked-I"
[ Ikarus ], "Net-Worm.Win32.Mytob.X"
viDll.dll:
[ Trend ], "TROJ_LOOKED.BE"
[ Symantec ],"Downloader"
[ Kaspersky ], "Worm.Win32.Viking.r"
[ McAfee ], "W32/HLLP.Philis.dll"
[ Panda ], "W32/Viking.T.worm"
[ Ikarus ], "Trojan Dropper.Win32.Delf.LY"
winlogin.exe:
[ Trend ], "PE_LOOKED.BE-O"
[ Symantec ], "W32.Looked.P"
[ Kaspersky ], "PAK:UPack, Worm.Win32.Viking.r"
[ McAfee ], "W32/HLLP.Philis.aq"
[ Sophos ], "W32/Looked-I"
[ Ikarus ], "Net-Worm.Win32.Mytob.X"
jpg[1].htm:
[ Kaspersky ], "Trojan-Downloader.JS.Psyme.cf"
[ HBEDV ], "HEUR/Exploit.HTML"
[ Ewido ], "Hijacker.Linker.e"