大砲開講

澎湖逍遙遊網站被植入惡意連結

2008 年 06 月 19 日 – 10:35:27

澎湖逍遙遊網站被植入惡意連結，此惡意程式為 Trojan.PSW.Win32.OnlineGames.faw，最近有瀏覽這個網頁的網友，請要盡速檢查自己的電腦是否有中毒的情形。

對此惡意連結，Google Search、McAfee SiteAdvisor、趨勢科技網頁信譽評等(Web Reputation Service)查詢結果，都顯示正常，證明此種技術並非Web安全威脅的完美解決分案。

惡意連結/程式碼是放置在上述網址 (其他頁面，可能要仔細檢查一下囉) 中的：

McAfee SiteAdvisor查詢結果(未發現異狀)，如下圖所示：

趨勢科技網頁信譽評等查詢結果(未發現異狀)，如下圖所示：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Help\F3C74E3FA248.dll

[Added file]
C:\bocl.com
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\w1[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\index[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\images[1].htm
C:\WINDOWS\Help\F3C74E3FA248.dll
C:\WINDOWS\Help\F3C74E3FA248.exe

[Added COM/BHO]
{1DBD6574-D6D0-4782-94C3-69619E719765}-C:\WINDOWS\HELP\F3C74E3FA248.dll

到目前為止 (2008/6/19 @ 1:25)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

F3C74E3FA248.dll:
[ Trend ], “Mal_Infostl”
F3C74E3FA248.exe:
[     IntelliTrap  ], “PAK_Generic.001″
[     Microsoft    ], “[->(UPX)]:Trojan:Win32/Helpud.A”
[     Kaspersky    ], “PAK:BeRo, PAK:PE_Patch.UPX, PAK:UPX, PAK:PE_Patch.MaskPE”
[     Alwil        ], “Win32:OnLineGames-AHK [Trj]”
[     Nod32        ], “a variant of Win32/PSW.OnLineGames.NNS trojan”
[     Fortinet     ], “suspicious”
[     HBEDV        ], “TR/ATRAPS.Gen”
[     Norman       ], “[Heuristic Sandbox detection]:Virus W32/Malware”
[     Rising       ], “[>>packlz]:Trojan.PSW.Win32.OnlineGames.faw”
[     Ikarus       ], “Virus.Win32.OnLineGames.AHK”
[     eAladdin     ], “Suspicious File [100]”
[     WebWasher    ], “BlockReason.0″
[     bitdefender  ], “GenPack:Trojan.PWS.OnlineGames.QZJ”
[     drweb        ], “Trojan.PWS.Lineage.origin”
images[1].htm:
[     HBEDV        ], “HTML/Crypted.Gen”
[     WebWasher    ], “BlockReason.0″
index[1].htm:
[     WebWasher    ], “BlockReason.0″
w1[1].exe:
[     IntelliTrap  ], “PAK_Generic.001″
[     Microsoft    ], “[->(UPX)]:Trojan:Win32/Helpud.A”
[     Kaspersky    ], “PAK:BeRo, PAK:PE_Patch.UPX, PAK:UPX, PAK:PE_Patch.MaskPE”
[     Alwil        ], “Win32:OnLineGames-AHK [Trj]”
[     Nod32        ], “a variant of Win32/PSW.OnLineGames.NNS trojan”
[     Fortinet     ], “suspicious”
[     HBEDV        ], “TR/ATRAPS.Gen”
[     Norman       ], “[Heuristic Sandbox detection]:Virus W32/Malware”
[     Rising       ], “[>>packlz]:Trojan.PSW.Win32.OnlineGames.faw”
[     Ikarus       ], “Virus.Win32.OnLineGames.AHK”
[     eAladdin     ], “Suspicious File [100]”
[     WebWasher    ], “BlockReason.0″
[     bitdefender  ], “GenPack:Trojan.PWS.OnlineGames.QZJ”
[     drweb        ], “Trojan.PWS.Lineage.origin”
bocl.com:
[     IntelliTrap  ], “PAK_Generic.001″
[     Microsoft    ], “[->(UPX)]:Trojan:Win32/Helpud.A”
[     Kaspersky    ], “PAK:BeRo, PAK:PE_Patch.UPX, PAK:UPX, PAK:PE_Patch.MaskPE”
[     Alwil        ], “Win32:OnLineGames-AHK [Trj]”
[     Nod32        ], “a variant of Win32/PSW.OnLineGames.NNS trojan”
[     Fortinet     ], “suspicious”
[     HBEDV        ], “TR/ATRAPS.Gen”
[     Norman       ], “[Heuristic Sandbox detection]:Virus W32/Malware”
[     Rising       ], “[>>packlz]:Trojan.PSW.Win32.OnlineGames.faw”
[     Ikarus       ], “Virus.Win32.OnLineGames.AHK”
[     eAladdin     ], “Suspicious File [100]”
[     WebWasher    ], “BlockReason.0″
[     bitdefender  ], “GenPack:Trojan.PWS.OnlineGames.QZJ”
[     drweb        ], “Trojan.PWS.Lineage.origin”