大砲開講

Career 就業情報網網站被植入惡意連結 (網友登錄的資料，非常有可能已經被入侵者竊取，也許調查局應該要查查囉)，此惡意程式為 QQPass 或 Infostealer，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦。請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息。另外，此惡意程式是利用微軟所公佈的安全漏洞 (Vulnerability in Windows Animated Cursor Handling) (此為零時差攻擊)。對此有興趣的網友，可以在 VMWare 上測試一下，然後，回報修復的情形，而且，幫忙通知他們，謝謝。(Credit: Jimau)





惡意連結是放置在查詢頁面如 comp_list.asp?compid=70617268 (最好詳細檢查一下) 中：



惡意程式碼的一部份為：



ANI 零時差攻擊的部份為：



執行之後，有下面的行為：

[DLL injection]
C:\Program Files\Common Files\Microsoft Shared\MSInfo\NewInfo.dll (注入檔案總管得執行程序)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\sas.com
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\1[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\ad[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\mm[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\qq[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\mm[1].jpg
C:\Program Files\Common Files\Microsoft Shared\MSInfo\NewInfo.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\system.2dt

[Added COM/BHO]
{A6011F8F-A7F8-49AA-9ADA-49127D43138F}-C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.dll

到目前為止 (2007/4/16 @ 08:21)，下面的防毒軟體可以偵測到這些惡意檔案：

ad[1].exe:
[ Trend ], "PAK_Generic.001"
[ Symantec ], "Infostealer"
[ Kaspersky ], "PAK:UPX"
[ McAfee ], "PWS-QQPass"
[ Sophos, "[FILE:0000]:Mal/QQPass-B"
mm[1].jpg:
[ Trend ], "EXPL_ANICMOO.GEN"
[ Symantec ], "Trojan.Anicmoo"
[ Sophos ], "Exp/Animoo-A"
NewInfo.dll:
[ Sophos ], "Mal/QQPass-B"
sas.com:
[ Trend ], "PAK_Generic.001"
[ Symantec ], "Infostealer"
[ Kaspersky ], "PAK:UPX"
[ McAfee ], "PWS-QQPass"
[ Sophos, "[FILE:0000]:Mal/QQPass-B"
system.2dt:
[ Trend ], "PAK_Generic.001"
[ Symantec ], "Infostealer"
[ Kaspersky ], "PAK:UPX"
[ McAfee ], "PWS-QQPass"
[ Sophos, "[FILE:0000]:Mal/QQPass-B"