大砲開講

惡意連結/程式碼是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

Google Search查詢的結果，如下圖所示：

執行之後，有下面的行為：

[DLL Injection]
C:\WINDOWS\Debug\0C9C4681802F.dll

[Added file]
C:\Documents and Settings\Administrator\Desktop\2.bat
C:\Documents and Settings\Administrator\Local Settings\Temp\microsofts.vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\js[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\ms06014[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\ma2[1].exe
C:\WINDOWS\Debug\0C9C4681802F.dll
C:\WINDOWS\Debug\0C9C4681802F.exe

[Added COM/BHO]
{083A5F21-BCB9-4B21-A121-2584BEEFBFEF}-C:\WINDOWS\Debug\0C9C4681802F.dll

到目前為止 (2008/3/25 @ 11:)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

0C9C4681802F.dll:
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "PWS:Win32/Gamania.gen!D"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.tdw"
[ Panda ], "Trj/Lineage.HTK"
[ Panda_Beta ], "Trj/Lineage.HTK"
[ Alwil ], "Win32:Gamania-EB [Trj]"
[ CAV ], "Win32/Lineage!generic"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/PSW.Online.tdw"
[ Norman ], "Trojan W32/OnLineGames.ALRD"
[ Rising ], "Trojan.PSW.Win32.QMOnline.gl"
[ Ikarus ], "Generic.Lineage"
[ quickheal ], "TrojanPSW.OnLineGames.rzt"
[ vba32 ], "MalwareScope.Trojan-PSW.Game.14″
[ WebWasher ], "Trojan.PSW.Online.tdw"
0C9C4681802F.exe:
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "PWS:Win32/Gamania.gen!D"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.spw"
[ McAfee ], "New Malware.x !!"
[ McAfee_Beta ], "New Malware.x !!"
[ Alwil ], "Win32:Gamania-EB [Trj]"
[ CAV ], "Win32/Lineage!generic"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/PSW.OnlineGames.spw"
[ Norman ], "Trojan W32/OnLineGames.ALND"
[ Rising ], "Trojan.Win32.Agent.zri"
[ Clamav ], "Trojan.Spy-26631″
[ Ikarus ], "Trojan-Spy.Win32.Delf.GI"
[ Grisoft ], "Trojan horse Generic9.BGHG"
[ quickheal ], "TrojanPSW.OnLineGames.spw"
[ vba32 ], "MalwareScope.Trojan-PSW.Game.14″
[ WebWasher ], "Trojan.PSW.OnlineGames.spw"
ma2[1].exe:
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "PWS:Win32/Gamania.gen!D"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.spw"
[ McAfee ], "New Malware.x !!"
[ McAfee_Beta ], "New Malware.x !!"
[ Alwil ], "Win32:Gamania-EB [Trj]"
[ CAV ], "Win32/Lineage!generic"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/PSW.OnlineGames.spw"
[ Norman ], "Trojan W32/OnLineGames.ALND"
[ Rising ], "Trojan.Win32.Agent.zri"
[ Clamav ], "Trojan.Spy-26631″
[ Ikarus ], "Trojan-Spy.Win32.Delf.GI"
[ Grisoft ], "Trojan horse Generic9.BGHG"
[ quickheal ], "TrojanPSW.OnLineGames.spw"
[ vba32 ], "MalwareScope.Trojan-PSW.Game.14″
[ WebWasher ], "Trojan.PSW.OnlineGames.spw"
ms06014[1].htm:
[ Microsoft ], "[->(SCRIPT0000)]:TrojanDownloader:VBS/Psyme.gen!D"
[ Kaspersky ], "Trojan-Downloader.VBS.Agent.lb"
[ Sophos ], "Mal/Psyme-A"
[ HBEDV ], "JS/Dldr.Noopt.1969″
[ Rising ], "Trojan.DL.Script.VBS.Small.fb"
[ Ikarus ], "JS.Downloader.Noopt.1969″
[ Ewido ], "Downloader.AniLoad.nae"
[ Grisoft ], "Virus found JS/Downloader.Agent"
[ WebWasher ], "Script.Dldr.Noopt.1969″