大砲開講

景誠音響網站被植入惡意連結，此惡意程式為 Lineage 和 Agent 的變種，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦。請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式應該會偷帳號與密碼)。另外，此惡意程式是利用微軟所公佈的安全漏洞 (Vulnerability in Windows Animated Cursor Handling) (此為零時差攻擊)。對此有興趣的網友，可以在 VMWare 上測試一下，然後，回報修復的情形，而且，順便通知他們。(Credit: 東東東)

**請幫忙通知他們，謝謝**



惡意連結是放置在首頁中的：



惡意程式碼的一部份為：



當執行此惡意程式後，會產生一個應用程式錯誤的訊息：



執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Debug\UserMode\32BB5B6.dll (注入某些執行程序如檔案總管、IE 等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\gz002.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\help[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\click[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gh02[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gh1[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gtai[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\mian[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\gh[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\gh[2].htm
C:\WINDOWS\Debug\UserMode\32BB5B6.dll
C:\WINDOWS\Debug\UserMode\32BB5B6.exe

[Added COM/BHO]
{F2319AD4-D519-45AC-86A7-02FE9B851F37}-C:\WINDOWS\debug\userMode\32BB5B6.dll

到目前為止 (2007/4/13 @ 20:57)，下面的防毒軟體可以偵測到這些惡意檔案：

32BB5B6.dll:
[ Trend ], “TSPY_LINEAGE.FFU”
[ Symantec ], “Infostealer.Lineage”
[ McAfee ], “PWS-Lineage.dll”
[ Sophos ], “Mal/GamePSW-C”
[ Panda ], “Trj/Lineage.DAO”
32BB5B6.exe:
[ Trend ], “TSPY_LINEAGE.FFT”
[ Symantec ], “Infostealer.Lineage”
[ Kaspersky ], “PAK:FSG”
[ McAfee ], “[0000a200.EXE]:PWS-Lineage.dll”
[ Sophos ], “Mal/Packer”
gh02[1].exe:
[ Trend ], “TSPY_LINEAGE.FFT”
[ Symantec ], “Infostealer.Lineage”
[ Kaspersky ], “PAK:FSG”
[ McAfee ], “[0000a200.EXE]:PWS-Lineage.dll”
[ Sophos ], “Mal/Packer”
[ Ikarus ], “Maybe A Virus”
gh[1].htm:
[ Trend ], “VBS_PSYME.AKW”
gz002.exe:
[ Trend ], “TSPY_LINEAGE.FFT”
[ Symantec ], “Infostealer.Lineage”
[ Kaspersky ], “PAK:FSG”
[ McAfee ], “[0000a200.EXE]:PWS-Lineage.dll”
[ Sophos ], “Mal/Packer”
[ Ikarus ], “Maybe A Virus”
mian[1].jpg:
[ Trend ], “EXPL_ANICMOO.GEN”
[ AhnLab-V3 ], “Win-Trojan/Exploit-ANI.B”
[ AntiVir ], “EXP/Ani.Gen”
[ Avast ], “CVE-2007-0038〃
[ AVG ], “Exploit”
[ BitDefender ], “Exploit.Win32.MS05-002.Gen”
[ CAT-QuickHeal ], “Exploit.MS05-002〃
[ ClamAV ], “Exploit.W32.MS05-002〃
[ DrWeb ], “Exploit.ANIFile”
[ eTrust-Vet ], “Win32/MS07-017!exploit”
[ Fortinet ], “W32/ANI07.A!exploit”
[ F-Prot ], “CVE-2007-1765〃
[ McAfee ], “Exploit-ANIfile.c”
[ NOD32v2 ], “a variant of Win32/TrojanDownloader.Ani.Gen”
[ Panda ], “Exploit/LoadImage”
[ Sophos ], “Exp/Animoo-A”
[ Sunbelt ], “Trojan-Exploit.Anicmoo.ax (v)”
[ Symantec ], “Trojan.Anicmoo”
[ VBA32 ], “suspected of Exploit.Signature”
[ VirusBuster ], “Exploit.ANIFile.L”
[ Webwasher-Gateway ], “Exploit.Win32.MS05-002.gen”
gtai[1].htm:
[ McAfee ], "Exploit-MS06-014"
[ Nod32 ], "VBS/TrojanDownloader.Agent.E trojan"
[ Rising ], "Trojan.DL.VBS.Agent.cll"
[ Ewido ], "Downloader.Agent.e"
svchost.vbs:
[ Kaspersky ], "Trojan.VBS.Starter.k"
[ Fortinet ], "VBS/Starter.K!tr"
[ Ewido ], "Trojan.Starter.k"