國家圖書館臺灣記憶系統網站被植入惡意連結
2007 年 07 月 19 日 – 16:09:00國家圖書館臺灣記憶系統網站被植入惡意連結 (早上通知他們，到現在尚未處理)，此惡意程式為 Infostealer.Gampass、PWS:Win32/Whoran.A 或 Trojan-Spy.Win32.Agent.qn 變種，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦，請各位暫時不要瀏覽這個網站，以免中毒 (此惡意程式應該會偷帳號與密碼)。(感謝網友通知)
惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：
執行之後，有下面的行為：
[Added process]
C:\Documents and Settings\Administrator\Local Settings\Temp\Microsoft.com
C:\Documents and Settings\Administrator\Local Settings\Temp\Cike.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe
[DLL injection]
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe
C:\WINDOWS\system32\winlokc.dll
[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\Cike.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\Microsoft.com
C:\Documents and Settings\Administrator\Local Settings\Temp\Microsoft.vbs
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.vbs
C:\Documents and Settings\Administrator\Local Settings\Temp\taskmgr.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\index[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\svchost[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\z1[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\ck[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\dns[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\index[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\zl[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\06014[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\ie[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\xl1[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\xl[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\click[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\dns[1].ani
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\index[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\z2[1].jpg
C:\WINDOWS\system32\winlokc.dll
[Added registry]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=Syetesn
Data=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Microsoft.com
到目前為止 (2007/7/19 @ 09:27)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：
Microsoft.com:
[ Kaspersky ], "PAK:PE_Patch, PAK:UPX"
[ HBEDV ], "TR/Spy.Agent.QN.16″
Microsoft.vbs:
[ Symantec ], "Trojan Horse"
[ Kaspersky ], "Trojan.VBS.Runner.o"
[ HBEDV ], "VBS/Runner.O.3″
[ Ewido ], "Trojan.Runner.o"
svchost.exe:
[ Kaspersky ], "PAK:PE_Patch, PAK:UPX"
[ HBEDV ], "TR/Spy.Agent.QN.16″
winlokc.dll:
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "PWS:Win32/Whoran.A"
[ Kaspersky ], "Trojan-Spy.Win32.Agent.qn"
[ HBEDV ], "TR/Spy.Agent.QN.16″
xl1[1].htm:
[ Microsoft ], "Exploit:HTML/Expascii.gen"
[ McAfee ], "ObfuscatedHtml"
[ Fortinet ], "HTML/ASCII.gen!exploit"
[ Norman ], "Trojan AsciiExploit.gen"
xl[1].htm:
[ Nod32 ], "JS/TrojanDownloader.Agent.ID trojan"
[ HBEDV ], "JS/Dldr.Agent.25076″
[ Rising ], "Trojan.DL.JS.Agent.let"
[ Ewido ], "Downloader.Agent.id"
zl[1].htm:
[ Microsoft ], "Exploit:HTML/Expascii.gen"
[ McAfee ], "ObfuscatedHtml"
[ Fortinet ], "HTML/ASCII.gen!exploit"
[ Norman ], "Trojan AsciiExploit.gen"
06014[1].htm:
[ Microsoft ], "[->(SCRIPT0000)]:TrojanDownloader:JS/Agent.FT"
[ Kaspersky ], "Trojan-Downloader.JS.Psyme.fk"
[ McAfee ], "[000000bc.vbs]:Exploit-MS06-014.gen !!"
[ Fortinet ], "VBS/Psyme.DN!tr.dldr"
[ Rising ], "Trojan.DL.VBS.Agent.clx"
[ Ewido ], "Downloader.Psyme.hl"
Cike.exe:
[ Kaspersky ], "PAK:PE_Patch, PAK:UPX"
[ HBEDV ], "TR/Spy.Agent.QN.16″
ck[1].htm:
[ Alpha_Gen ], "Possible_EncScr"
[ McAfee ], "[00000008.js]:Exploit-MS06-014″
[ HBEDV ], "VBS/Dldr.Psyme.BH.2″
ie[1].htm:
[ Alpha_Gen ], "Heur_Infrm-1″
[ Fortinet ], "JS/Agent.HC!tr.dldr"
[ Rising ], "Trojan.DL.JS.Agent.lgm"
