大砲開講

惡意連結是放置在首頁中的：

惡意程式碼的一部份為：

當執行此惡意程式後，會產生一個應用程式錯誤的訊息：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Debug\UserMode\32BB5B6.dll (注入某些執行程序如檔案總管、IE 等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\gz002.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\help[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\click[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gh02[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gh1[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gtai[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\mian[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\gh[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\gh[2].htm
C:\WINDOWS\Debug\UserMode\32BB5B6.dll
C:\WINDOWS\Debug\UserMode\32BB5B6.exe

[Added COM/BHO]
{F2319AD4-D519-45AC-86A7-02FE9B851F37}-C:\WINDOWS\debug\userMode\32BB5B6.dll

到目前為止 (2007/4/13 @ 20:57)，下面的防毒軟體可以偵測到這些惡意檔案：

32BB5B6.dll:
[ Trend ], “TSPY_LINEAGE.FFU”
[ Symantec ], “Infostealer.Lineage”
[ McAfee ], “PWS-Lineage.dll”
[ Sophos ], “Mal/GamePSW-C”
[ Panda ], “Trj/Lineage.DAO”
32BB5B6.exe:
[ Trend ], “TSPY_LINEAGE.FFT”
[ Symantec ], “Infostealer.Lineage”
[ Kaspersky ], “PAK:FSG”
[ McAfee ], “[0000a200.EXE]:PWS-Lineage.dll”
[ Sophos ], “Mal/Packer”
gh02[1].exe:
[ Trend ], “TSPY_LINEAGE.FFT”
[ Symantec ], “Infostealer.Lineage”
[ Kaspersky ], “PAK:FSG”
[ McAfee ], “[0000a200.EXE]:PWS-Lineage.dll”
[ Sophos ], “Mal/Packer”
[ Ikarus ], “Maybe A Virus”
gh[1].htm:
[ Trend ], “VBS_PSYME.AKW”
gz002.exe:
[ Trend ], “TSPY_LINEAGE.FFT”
[ Symantec ], “Infostealer.Lineage”
[ Kaspersky ], “PAK:FSG”
[ McAfee ], “[0000a200.EXE]:PWS-Lineage.dll”
[ Sophos ], “Mal/Packer”
[ Ikarus ], “Maybe A Virus”
mian[1].jpg:
[ Trend ], “EXPL_ANICMOO.GEN”
[ AhnLab-V3 ], “Win-Trojan/Exploit-ANI.B”
[ AntiVir ], “EXP/Ani.Gen”
[ Avast ], “CVE-2007-0038〃
[ AVG ], “Exploit”
[ BitDefender ], “Exploit.Win32.MS05-002.Gen”
[ CAT-QuickHeal ], “Exploit.MS05-002〃
[ ClamAV ], “Exploit.W32.MS05-002〃
[ DrWeb ], “Exploit.ANIFile”
[ eTrust-Vet ], “Win32/MS07-017!exploit”
[ Fortinet ], “W32/ANI07.A!exploit”
[ F-Prot ], “CVE-2007-1765〃
[ McAfee ], “Exploit-ANIfile.c”
[ NOD32v2 ], “a variant of Win32/TrojanDownloader.Ani.Gen”
[ Panda ], “Exploit/LoadImage”
[ Sophos ], “Exp/Animoo-A”
[ Sunbelt ], “Trojan-Exploit.Anicmoo.ax (v)”
[ Symantec ], “Trojan.Anicmoo”
[ VBA32 ], “suspected of Exploit.Signature”
[ VirusBuster ], “Exploit.ANIFile.L”
[ Webwasher-Gateway ], “Exploit.Win32.MS05-002.gen”
gtai[1].htm:
[ McAfee ], 『Exploit-MS06-014″
[ Nod32 ], 『VBS/TrojanDownloader.Agent.E trojan』
[ Rising ], 『Trojan.DL.VBS.Agent.cll』
[ Ewido ], 『Downloader.Agent.e』
svchost.vbs:
[ Kaspersky ], 『Trojan.VBS.Starter.k』
[ Fortinet ], 『VBS/Starter.K!tr』
[ Ewido ], 『Trojan.Starter.k』