財團法人維他露社會福利慈善事業基金會網站被植入惡意連結
2007 年 06 月 21 日 – 10:14:00財團法人維他露社會福利慈善事業基金會網站被植入惡意連結，此惡意程式為 Lineage 變種，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦，請各位暫時不要瀏覽這個網站，以免中毒，等確認他們已經修復後，會在此更新訊息 (此惡意程式應該會偷帳號與密碼)。對此有興趣的網友，可以在虛擬機器上測試一下，然後，回報修復的情形，而且，幫忙通知他們，謝謝。
惡意連結是放置在 index.asp (其他頁面可能要仔細檢查一下囉) 中的：
執行之後，有下面的行為：
[DLL injection]
C:\WINDOWS\Debug\UserMode\CBD61.dll
[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\moi.com
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\gmsex[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\live[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\selfs[1].htm
C:\kao.reg
C:\Program Files\Common Files\live.exe
C:\Program Files\Internet Explorer\loadie.EXE
C:\WINDOWS\Debug\UserMode\CBD61.dll
C:\WINDOWS\Debug\UserMode\CBD61.exe
[Added COM/BHO]
{3CD55043-005A-49B8-B298-0618D55A543C}-C:\WINDOWS\debug\userMode\CBD61.dll
[Added registry]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=AutoRun
Data=C:\Program Files\Internet Explorer\loadie.EXE
到目前為止 (2007/6/21 @ 09:29)，下面的防毒軟體可以偵測到這些惡意檔案：
CBD61.dll:
[ Trend ], "Possible_Infostl"
selfs[1].htm:
[ Trend ], "VBS_SMALL.GUK"
CBD61.exe:
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ Nod32 ], "a variant of Win32/PSW.Lineage.ACN trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
gmsex[1].exe:
[ Microsoft ], "TrojanDownloader:Win32/Small.gen!N"
[ McAfee ], "New Malware.an !!"
[ Alwil ], "Win32:Delf-BSS [Trj]"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "[Heuristic Sandbox detection]:Virus W32/Malware"
[ Ewido ], "Downloader.Delf.awr"
kao.reg:
[ Panda ], "Trj/QQPass.MW"
[ Nod32 ], "Win32/TrojanDownloader.Delf.NVO trojan"
[ HBEDV ], "TR/Dldr.Delf.NVO"
live.exe:
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ Nod32 ], "a variant of Win32/PSW.Lineage.ACN trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
loadie.EXE:
[ Microsoft ], "TrojanDownloader:Win32/Small.gen!N"
[ McAfee ], "New Malware.an !!"
[ Alwil ], "Win32:Delf-BSS [Trj]"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "[Heuristic Sandbox detection]:Virus W32/Malware"
[ Ewido ], "Downloader.Delf.awr"
moi.com:
[ Microsoft ], "TrojanDownloader:Win32/Small.gen!N"
[ McAfee ], "New Malware.an !!"
[ Alwil ], "Win32:Delf-BSS [Trj]"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Delphi.Downloader.Gen"
[ Norman ], "[Heuristic Sandbox detection]:Virus W32/Malware"
[ Ewido ], "Downloader.Delf.awr"
