大砲開講

OSS Lab網站被植入惡意程式碼

OSS Lab（開放原始碼軟體實驗室）網站被植入惡意程式碼 (利用超過十種不同的安全漏洞)，此惡意程式為 TR/Dropper.Gen，最近有瀏覽這個網頁的網友，請要盡速檢查自己的電腦是否有中毒的情形 (Credit: Anderson)。

惡意連結/程式碼是放置在上述網址 (其他網頁，應該要仔細檢查) 中的：

下面是網頁信譽評等掃描的結果(從這裡可以知道，如果惡意程式碼放置在正常網站中，大部分的網頁信譽評等是無法掃描到的)：

Google Search 查詢結果(未發現異狀)，如下圖所示：

McAfee SiteAdvisor 查詢結果(未發現異狀)，如下圖所示：

趨勢科技網頁信譽評等查詢結果(未發現異狀)，如下圖所示：

finjan 網頁信譽評等查詢結果(發現異狀)，如下圖所示：

Dr.Web 網頁信譽評等查詢結果(未發現異狀)，如下圖所示：

Exploit Prevention Labs 網頁信譽評等查詢結果(未發現異狀)，如下圖所示：

賽門鐵克 Safe Web 查詢結果(未發現異狀)，如下圖所示：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\system32\6to4ex.dll

[Added service]
NAME: 6to4
DISPLAY: Microsoft Device Manager
FILE: C:\WINDOWS\System32\svchost.exe -k netsvcs

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\200808[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\bfyy[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\ms07055[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\Thunder[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\uc[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\xlkk[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\Yahoomessenger[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\300×250_mermaid_child_01[1].swf
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\Home[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\index[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\js[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\lz[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\Media[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\ms06042[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\ms07033[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\Opera[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\Baidu[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\bfyy[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\CA7QWR7T.swf
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\CAUV4XEF.swf
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\exe[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\ms06014[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\ms07027[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\qvod[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\200808[1].html
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\cx[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\cx[2].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\d[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\Main[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\Mcafee[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\ms07017[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\Ruising[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\TTplayer[1].htm
C:\WINDOWS\system32\6to4ex.dll

下列是 VirusTotal 掃描結果 (僅提供參考)：

File file.exe-1 received on 08.27.2008 04:44:07 (CET)