得利影視娛樂網又被值入惡意連結
2007 年 05 月 28 日 – 07:22:00得利影視娛樂網又被值入惡意連結，此惡意程式為 DELF 和 DOWNLOADER 變種，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦，請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式應該會偷帳號與密碼)。對此有興趣的網友，可以在 VMWare 上測試一下，然後，回報修復的情形，而且，幫忙通知他們，謝謝。
惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：
執行之後，有下面的行為 (會重新開機)：
[Added file]
C:\1.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\g0ld.com
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\System32[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\d[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\qsvj[1].htm
C:\pass.dic
C:\Program Files\Common Files\System\commond.pif
C:\WINDOWS\system32\Shell.exe
C:\WINDOWS\system32\Shell.pci
到目前為止 (2007/5/27 @ 23:44)，下面的防毒軟體可以偵測到這些惡意檔案：
qsvj[1].htm:
[ McAfee ], "ObfuscatedHtml"
[ Norman ], "Trojan AsciiExploit.gen"
Shell.exe:
[ Kaspersky ], "PAK:PE_Patch.UPX, PAK:UPX"
[ McAfee ], "[GenUnp]:New Malware.b !!"
[ Sophos ], "Mal/Basine-A"
[ Nod32 ], "a variant of Win32/Delf.BO worm"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "[Heuristic Sandbox detection]:Virus W32/Malware"
System32[1].exe:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Beta_Gen ], "Possible_MLWR-5″
[ Symantec ], "Bloodhound.Packed.29″
[ McAfee ], "New Malware.bx !!"
[ Sophos ], "Mal/EncPk-F"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Norman ], "Virus W32/Viking.gen5″
commond.pif:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Beta_Gen ], "Possible_MLWR-5″
[ Symantec ], "Bloodhound.Packed.29″
[ McAfee ], "New Malware.bl !!"
[ Sophos ], "Mal/EncPk-F"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Norman ], "Virus W32/Viking.gen5″
d[1].exe:
[ Kaspersky ], "PAK:PE_Patch.UPX, PAK:UPX"
[ McAfee ], "[GenUnp]:New Malware.b !!"
[ Sophos ], "Mal/Basine-A"
[ Nod32 ], "a variant of Win32/Delf.BO worm"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "[Heuristic Sandbox detection]:Virus W32/Malware"
g0ld.com:
[ Kaspersky ], "PAK:PE_Patch.UPX, PAK:UPX"
[ McAfee ], "[GenUnp]:New Malware.b !!"
[ Sophos ], "Mal/Basine-A"
[ Nod32 ], "a variant of Win32/Delf.BO worm"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "[Heuristic Sandbox detection]:Virus W32/Malware"
pass.dic:
[ Microsoft ], "Worm:Win32/Datheens!pwd"
[ McAfee ], "W32/Emerleox.worm"
[ Nod32 ], "Win32/Hensis.A worm"
