大砲開講

MSN台灣新聞網站被植入惡意連結

2008 年 06 月 16 日 – 13:37:46

MSN台灣新聞網站被植入惡意連結，此惡意程式為 Win32/PSW.OnLineGames，最近有瀏覽這個網頁的網友，請要盡速檢查自己的電腦是否有中毒的情形。(Credit: Google)

對此網址，Google Search、McAfee SiteAdvisor、趨勢科技網頁信譽評等(Web Reputation Service)查詢結果，都顯示正常，證明此種技術並非Web安全威脅的完美解決分案。

惡意連結/程式碼是放置在上述網址 (其他頁面，可能要仔細檢查一下囉) 中的：

Google Search查詢結果(未發現異狀)，如下圖所示：

McAfee SiteAdvisor查詢結果(未發現異狀)，如下圖所示：

趨勢科技網頁信譽評等查詢結果(未發現異狀)，如下圖所示：

執行之後，有下面的行為：

[Added process]
C:\WINDOWS\system394841.exe
C:\WINDOWS\system572232.exe
C:\WINDOWS\~tmp5068.exe
C:\WINDOWS\system32\aspimgr.exe

[DLL injection]
C:\Documents and Settings\Administrator\Local Settings\Temp\dat98.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\system333314ow.dll
C:\WINDOWS\system32\dbi102.dll

[Added service]
NAME: aspimgr
DISPLAY: Microsoft ASPI Manager
FILE: C:\WINDOWS\system32\aspimgr.exe

NAME: seictrl
DISPLAY: Security Control
FILE: c:\windows\system32\rundll32.exe dbi102.dll,scan

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\dat98.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\dat99.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\dat9A.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\system333314ow.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\_check32.bat
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\4561[1].swf
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\dj[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\ydcm[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\14[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\456[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\bak[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\b[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\click[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\k[1].js
C:\WINDOWS\2.log
C:\WINDOWS\s32.txt
C:\WINDOWS\system32\aspimgr.exe
C:\WINDOWS\system32\dbi102.dll
C:\WINDOWS\system394841.exe
C:\WINDOWS\system572232.exe
C:\WINDOWS\ws386.ini
C:\WINDOWS\~tmp5068.exe

[Added COM/BHO]
{00B58F06-D7A2-456A-AE04-EB9ABF822FE4}-C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\system333314ow.dll
{425882B0-B0BF-11CE-B59F-00AA006CB37D}-C:\WINDOWS\system32\npp\ndisnpp.dll
{E25C29AB-12B9-4523-A53C-324B5FBA648C}-C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dat98.tmp

[Added registry]
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value=Shell
Data="C:\WINDOWS\system32\Rundll32.exe" "C:\WINDOWS\system32\shell32.dll",Control_RunDLL "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dat98.tmp"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value=butme.exe
Data=C:\WINDOWS\system572232.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value=solo
Data=C:\WINDOWS\system394841.exe

到目前為止 (2008/6/16 @ 11:01)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

dat9A.tmp:
[ Trend ], "TROJ_AGENT.ALDB"
k[1].js:
[ HBEDV ], "HEUR/HTML.Malware"
[ Norman ], "Trojan HTML/Exploit!IFrame.H"
index.htm:
[ Alpha_Gen ], "Possible_EncScr"
[ Beta_Gen ], "Possible_EncScr"
[ WebWasher ], "BlockReason.46 (suspicious)"
system333314ow.dll:
[ Kaspersky ], "PAK:PE_Patch.PECompact, PAK:PecBundle, PAK:PECompact"
[ Sophos ], "Mal/Heuri-E"
[ HBEDV ], "TR/Spy.Gen"
[ eAladdin ], "Suspicious File [100]"
[ Authentium ], "W32/Threat-HLLIP-based!Maximus"
[ WebWasher ], "Trojan.Spy.Gen"
system394841.exe:
[ IntelliTrap ], "PAK_Generic.006″
[ Alpha_Gen ], "AP_MALPK-2″
[ Beta_Gen ], "AP_MALPK-2″
[ Kaspersky ], "PAK:PE_Patch, PAK:UPack"
[ Sophos ], "Mal/Behav-010″
[ Panda ], "Suspicious file"
[ Panda_Beta ], "Suspicious file"
[ Nod32 ], "probably unknown NewHeur_PE virus [7]"
[ Fortinet ], "suspicious"
[ Norman ], "Trojan W32/Suspicious_U.gen"
[ eAladdin ], "Suspicious File [104]"
[ WebWasher ], "BlockReason.46 (suspicious)"
dbi102.dll:
[ IntelliTrap ], "PAK_Generic.001″
[ Alpha_Gen ], "AP_Bits"
[ Beta_Gen ], "AP_Bits"
[ Sophos ], "Mal/Behav-204″
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.XPACK.Gen"
[ Rising ], "Trojan.PSW.Win32.GameOL.npo"
[ Ikarus ], "Trojan.Crypt.AV"
[ eAladdin ], "Suspicious File [100]"
[ WebWasher ], "Trojan.Crypt.XPACK.Gen"
[ bitdefender ], "Trojan.Crypt.AV"
aspimgr.exe:
[ Beta_Gen ], "Possible_Asprox"
[ Microsoft ], "Trojan:Win32/Danmec.gen!A"
[ McAfee ], "Proxy-Agent.af.gen"
[ McAfee_Beta ], "Proxy-Agent.af.gen"
[ Nod32 ], "probably a variant of Win32/Agent.NEQ trojan"
[ Ikarus ], "Virus.Win32.Agent.GPS"
[ WebWasher ], "BlockReason.46 (suspicious)"
system572232.exe:
[ McAfee ], "New Downloader-b !!"
[ McAfee_Beta ], "New Downloader-b !!"
[ Sophos ], "Mal/Heuri-E"
[ Panda ], "Suspicious file"
[ Panda_Beta ], "Suspicious file"
[ Nod32 ], "probably unknown NewHeur_PE virus [7]"
[ Fortinet ], "suspicious"
[ HBEDV ], "HEUR/Crypted"
[ Authentium ], "W32/Downloader-Sml-based!Maximus"
[ WebWasher ], "BlockReason.46 (suspicious)"
[ bitdefender ], "Generic.Malware.Sdld!!.41E2F2EA"
dat99.tmp:
[ IntelliTrap ], "PAK_Generic.001″
[ Alpha_Gen ], "AP_Bits"
[ Beta_Gen ], "AP_Bits"
[ Microsoft ], "PWS:Win32/Frethog.D"
[ McAfee ], "Generic PWS.y"
[ McAfee_Beta ], "Generic PWS.y"
[ Sophos ], "Mal/Packer"
[ Nod32 ], "a variant of Win32/PSW.OnLineGames.NOT trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Norman ], "Trojan W32/Suspicious_N.gen"
[ eAladdin ], "Suspicious File [101]"
[ Authentium ], "W32/Threat-INLIB-based!Maximus"
[ WebWasher ], "Trojan.Crypt.NSPM.Gen"
dat98.tmp:
[ IntelliTrap ], "PAK_Generic.001″
[ Alpha_Gen ], "AP_Bits"
[ Beta_Gen ], "AP_Bits"
[ Microsoft ], "TrojanDropper:Win32/Rootkit.AFH"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.aoqx"
[ McAfee ], "Generic Dropper"
[ McAfee_Beta ], "Generic Dropper"
[ Sophos ], "Mal/Packer"
[ Nod32 ], "a variant of Win32/PSW.OnLineGames.NOT trojan"
[ Fortinet ], "W32/OnLineGames.AOQX!tr.pws"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
[ Norman ], "Trojan W32/Suspicious_N.gen"
[ Rising ], "[>>nspack]:Trojan.PSW.Win32.GameOL.gca"
[ eAladdin ], "Suspicious File [101]"
[ WebWasher ], "Trojan.Crypt.NSPM.Gen"
b[1].js:
[ Microsoft ], "Trojan:JS/Redirector.N"
[ Sophos ], "Troj/Iframe-AG"
[ Norman ], "Trojan HTML/Exploit!IFrame.G"
dj[1].htm:
[ McAfee ], "[00000066.js]:VBS/Psyme"
[ McAfee_Beta ], "[00000066.js]:VBS/Psyme"
[ HBEDV ], "HEUR/HTML.Malware"
[ Ikarus ], "Trojan-Downloader.JS.Agent.di"
[ Ewido ], "Downloader.Multi.cb"
[ Authentium ], "JS/Agent.FW"
[ WebWasher ], "BlockReason.46 (suspicious)"
bak[1].exe:
[ Microsoft ], "TrojanDownloader:Win32/Small.gen!D"
[ Kaspersky ], "PAK:MPRESS"
[ Nod32 ], "probably unknown NewHeur_PE virus [7]"
[ Fortinet ], "suspicious"
[ Rising ], "[>>vmppacker]:Packer.Win32.VmpPacker.a"
[ eAladdin ], "Suspicious File [100]"
[ WebWasher ], "BlockReason.46 (suspicious)"
4561[1].swf:
[ Symantec ], "Downloader.Swif.C"
[ Kaspersky ], "PAK:Swf2Swc, Trojan-Downloader.SWF.Small.bi"
[ Sophos ], "Troj/SWFdlr-Gen, Troj/SWFdlr-Gen, Troj/SWFdlr-Gen"
[ Panda ], "Exploit/Flash.C"
[ Panda_Beta ], "Exploit/Flash.C"
[ HBEDV ], "TR/Dldr.SWF.Small.BI"
[ Ikarus ], "Win32.SuspectCrc"
[ WebWasher ], "Trojan.Dldr.SWF.Small.BI"
456[1].htm:
[ Kaspersky ], "Trojan-Downloader.HTML.Agent.jz, Trojan-Downloader.HTML.Agent.jz"
[ Sophos ], "Troj/Dwnldr-HED"
[ HBEDV ], "HEUR/HTML.Malware"
[ vba32 ], "Trojan-Downloader.JS.Agent.nh"
[ Authentium ], "JS/Agent.HQ"
[ WebWasher ], "BlockReason.46 (suspicious)"
14[1].htm:
[ Microsoft ], "[->(SCRIPT0000)]:TrojanDownloader:JS/Psyme.H"
[ Kaspersky ], "Trojan-Downloader.JS.Small.ly"
[ McAfee ], "VBS/Psyme"
[ McAfee_Beta ], "VBS/Psyme"
[ Sophos ], "Mal/Psyme-A"
[ HBEDV ], "HEUR/HTML.Malware"
[ Norman ], "Trojan VBS/Psyme.BF"
[ Ikarus ], "Trojan-Downloader.JS.Psyme.kq"
[ Authentium ], "JS/Psyme.CN"
[ WebWasher ], "BlockReason.46 (suspicious)"
[ bitdefender ], "Trojan.Downloader.Js.Psyme.KQ"
[ drweb ], "VBS.Psyme.239″
~tmp5068.exe:
[ Microsoft ], "TrojanDownloader:Win32/Small.gen!D"
[ Kaspersky ], "PAK:MPRESS"
[ Nod32 ], "probably unknown NewHeur_PE virus [7]"
[ Fortinet ], "suspicious"
[ Rising ], "[>>vmppacker]:Packer.Win32.VmpPacker.a"
[ eAladdin ], "Suspicious File [100]"
[ WebWasher ], "BlockReason.46 (suspicious)"