財團法人證券投資人及期貨交易人保護中心網站遭駭 (很可能他們客戶資料已經被偷了) 且被植入惡意連結，此惡意程式為 Lineage 的變種，另外，也利用了 ANI 的安全漏洞，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦，請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息。對此有興趣的網友，可以在 VMWare 上測試一下，然後，回報修復的情形，而且，幫忙通知他們，謝謝。
遭置換的頁面：
財團法人證券投資人及期貨交易人保護中心網站首頁：
惡意連結是放置在 left.asp (其他頁面可能要仔細檢查一下囉) 中的：
惡意程式碼的一部份為：
執行之後，有下面的行為：
[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\20070418a.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\614[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\a2[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\20070418a[1].exe
到目前為止 (2007/4/24 @ 23:17)，下面的防毒軟體可以偵測到這些惡意檔案：
20070418a.exe:
[ Alpha_Gen ], "Possible_MLWR-5"
[ Beta_Gen ], "Possible_MLWR-1"
[ Symantec ], "Infostealer.Lineage"
[ McAfee ], "New Malware.bc !!"
[ Sophos ], "Mal/EncPk-F"
[ Nod32 ], "Win32/Pacex.Gen virus"
[ Fortinet ], "PossibleThreat"
[ HBEDV ], "TR/Crypt.XPACK.Gen"
[ Ewido ], "Trojan.Small"
xiong.gif:
[ Beta_Gen ], "EXPL_ANICMOO.GEN"
[ Symantec ], "Trojan.Exploit.131"
[ Microsoft ], "Exploit:Win32/Anicmoo.A"
[ Kaspersky ], "Exploit.Win32.IMG-ANI.ac"
[ McAfee ], "Exploit-ANIfile.c"
[ Sophos ], "Exp/Animoo-A"
[ Panda ], "Exploit/LoadImage"
[ Nod32 ], "a variant of Win32/TrojanDownloader.Ani.Gen trojan"
[ Fortinet ], "W32/ANI07.A!exploit"
[ HBEDV ], "EXP/Ani.Gen"
[ Rising ], "Hack.SuspiciousAni"
[ Ewido ], "Not-A-Virus.Exploit.Win32.IMGANI.ac"
614[1].htm:
[ HBEDV ], "VBS/Dldr.Agent.6171"
遭置換的頁面：
財團法人證券投資人及期貨交易人保護中心網站首頁：
惡意連結是放置在 left.asp (其他頁面可能要仔細檢查一下囉) 中的：
惡意程式碼的一部份為：
執行之後，有下面的行為：
[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\20070418a.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\614[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\a2[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\20070418a[1].exe
到目前為止 (2007/4/24 @ 23:17)，下面的防毒軟體可以偵測到這些惡意檔案：
20070418a.exe:
[ Alpha_Gen ], "Possible_MLWR-5"
[ Beta_Gen ], "Possible_MLWR-1"
[ Symantec ], "Infostealer.Lineage"
[ McAfee ], "New Malware.bc !!"
[ Sophos ], "Mal/EncPk-F"
[ Nod32 ], "Win32/Pacex.Gen virus"
[ Fortinet ], "PossibleThreat"
[ HBEDV ], "TR/Crypt.XPACK.Gen"
[ Ewido ], "Trojan.Small"
xiong.gif:
[ Beta_Gen ], "EXPL_ANICMOO.GEN"
[ Symantec ], "Trojan.Exploit.131"
[ Microsoft ], "Exploit:Win32/Anicmoo.A"
[ Kaspersky ], "Exploit.Win32.IMG-ANI.ac"
[ McAfee ], "Exploit-ANIfile.c"
[ Sophos ], "Exp/Animoo-A"
[ Panda ], "Exploit/LoadImage"
[ Nod32 ], "a variant of Win32/TrojanDownloader.Ani.Gen trojan"
[ Fortinet ], "W32/ANI07.A!exploit"
[ HBEDV ], "EXP/Ani.Gen"
[ Rising ], "Hack.SuspiciousAni"
[ Ewido ], "Not-A-Virus.Exploit.Win32.IMGANI.ac"
614[1].htm:
[ HBEDV ], "VBS/Dldr.Agent.6171"
文章標籤
全站熱搜
已修復嚕