大砲開講

惡意連結是放置在首頁 (只要掛 *.wudi.com.tw 的網址，很多都被植入惡意連結) 中的：

惡意程式碼的一部份為：

ANI 攻擊的部份為：

當執行此惡意程式後，會產生一個應用程式錯誤的訊息：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\qing.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\7888p[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\test[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\mystat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\update[1].htm

到目前為止 (2007/4/16 @ 23:17)，下面的防毒軟體可以偵測到這些惡意檔案：

qing.exe:
[ Trend ], “TROJ_NSANTI.CV”
[ Kaspersky, “Trojan-PSW.Win32.Maran.di”
[ McAfee ], “PWS-Lineage”
[ Sophos ], “Mal/Packer”
update[1].exe:
[ Trend ], “TROJ_NSANTI.CV”
[ Kaspersky, “Trojan-PSW.Win32.Maran.di”
[ McAfee ], “PWS-Lineage”
[ Sophos ], “Mal/Packer”
7888p[1].jpg:
[ Trend ], “TROJ_ANICMOO.AX”
[ Symantec ], “Trojan.Anicmoo”
[ Kaspersky ], “Exploit.Win32.IMG-ANI.k”
[ McAfee ], “Exploit-ANIfile.c”
[ Sophos ], “Troj/Animoo-L”
update[1].htm:
[ Kaspersky ], “Exploit.HTML.Ascii.f”

惡意連結是放置在首頁 (其他頁面可能也有) 中的：

惡意程式碼的一部份為：

ANI 攻擊的部份為：

當執行此惡意程式後，會產生一個應用程式錯誤的訊息：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\qing.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\7888p[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\test[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\mystat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\update[1].htm

到目前為止 (2007/4/16 @ 23:17)，下面的防毒軟體可以偵測到這些惡意檔案：

qing.exe:
[ Trend ], "TROJ_NSANTI.CV"
[ Kaspersky, "Trojan-PSW.Win32.Maran.di"
[ McAfee ], "PWS-Lineage"
[ Sophos ], "Mal/Packer"
update[1].exe:
[ Trend ], "TROJ_NSANTI.CV"
[ Kaspersky, "Trojan-PSW.Win32.Maran.di"
[ McAfee ], "PWS-Lineage"
[ Sophos ], "Mal/Packer"
7888p[1].jpg:
[ Trend ], "TROJ_ANICMOO.AX"
[ Symantec ], "Trojan.Anicmoo"
[ Kaspersky ], "Exploit.Win32.IMG-ANI.k"
[ McAfee ], "Exploit-ANIfile.c"
[ Sophos ], "Troj/Animoo-L"
update[1].htm:
[ Kaspersky ], "Exploit.HTML.Ascii.f"

惡意連結是放置在首頁 (其他頁面可能也有) 中的：

執行之後，有下面的行為 (蠻慘的)：

[Added process]
C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE
C:\Program Files\Internet Explorer\iexplore.exe (產生幾個隱藏的 IE)

[DLL injection]
C:\Program Files\superutilbar\superutilbar.dll (注入 IE 的執行程序)
C:\WINDOWS\system32\3724DC06.DLL (注入 winlogon 和檔案總管的執行程序)

[Added service]
NAME: 3724DC06
DISPLAY: 3724DC06
FILE: C:\WINDOWS\system32\3724DC06.EXE -service

NAME: DiRVIn
DISPLAY: Intranet Messenger
FILE: C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE C:\WINDOWS\SYSTEM32\WBEM\USYAC.DLL,Export 1087

[Added file]
C:\Documents and Settings\Administrator\Favorites\嗣杻璃桴-郔假溫陑腔璃桴.url
C:\Documents and Settings\Administrator\Local Settings\Temp\bind_50202.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\temp.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\caiyi8[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\css[1].css
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\css[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\main[1].css
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\stat[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\foot[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\searchbg[1].png
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\top[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\update[1].txt
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\wm[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\yoqoo580[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\760all7[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\bind_50202[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\js[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\css[2].js
C:\Program Files\Common Files\System\Updaterun.exe
C:\Program Files\Ethereal\snmp\mibs\.index
C:\Program Files\superutilbar\superutilbar.dll
C:\Program Files\superutilbar\uninst.exe
C:\WINDOWS\bar.exe
C:\WINDOWS\system32\3724DC06.DLL
C:\WINDOWS\system32\3724DC06.EXE
C:\WINDOWS\system32\advport.dll
C:\WINDOWS\system32\iylsz.dll
C:\WINDOWS\system32\rundll2kxp.exe
C:\WINDOWS\system32\Score.txt
C:\WINDOWS\system32\wbem\ocmor.dll
C:\WINDOWS\system32\wbem\usyac.dll

[Added COM/BHO]
{03465FF5-00AE-411a-9C34-960ED566EC03}-C:\Program Files\superutilbar\superutilbar.dll
{425882B0-B0BF-11CE-B59F-00AA006CB37D}-C:\WINDOWS\system32\npp\ndisnpp.dll
{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2}-C:\Program Files\superutilbar\superutilbar.dll

[Added registry]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value=System
Data=C:\Program Files\Common Files\System\Updaterun.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\妗蚚刲坰馱撿沭
Value=DisplayName
Data=妗蚚刲坰馱撿沭

到目前為止 (2007/4/16 @ 23:17)，下面的防毒軟體可以偵測到這些惡意檔案：

bar.exe:
[ Trend ], "ADW_BAIDU.BJ"
[ Kaspersky ], "ARC:NSIS, [data0002]:Trojan-Clicker.Win32.Agent.io"
[ McAfee ], "Adware-Baidu"
[ Sophos ], "Troj/QQHelp-DX"
bind_50202.exe:
[ Trend ], "TROJ_QQHHELPE.I"
[ Sophos ], "Mal/TinyDL-D"
css[2].js:
[ Trend ], "EXPL_ANICMOO.GEN"
[ Symantec ], "Trojan.Anicmoo"
[ Kaspersky ], "Exploit.Win32.IMG-ANI.gen"
[ McAfee ], "Exploit-ANIfile.c"
[ Sophos ], "Troj/Animoo-M"
iylsz.dll:
[ Kaspersky ], "PAK:PE_Patch"
[ Alwil ], "Win32:Qqhelper-J [Trj]"
[ Nod32 ], "a variant of Win32/TrojanDownloader.QQHelper trojan"
[ HBEDV ], "TR/Drop.Multi.D.2″
ocmor.dll:
[ HBEDV ], "TR/Dldr.QQHe.FT.5.D"
[ Ewido ], "Downloader.QQHe.ft"
RUNDLL2KXP.EXE:
[ HBEDV ], "TR/Agent.10240.A"
[ Ewido ], "Trojan.Agent"
superutilbar.dll:
[ Microsoft ], "BrowserModifier:Win32/SuperUtilBar"
[ Kaspersky ], "Trojan-Clicker.Win32.Agent.io"
[ Panda ], "Application/SuperUtilBar"
[ Nod32 ], "Win32/Adware.Toolbar.Baidu application"
[ Fortinet ], "PossibleThreat"
[ HBEDV ], "TR/Click.Agent.IO.2″
[ Ewido ], "Hijacker.Agent.io"
temp.exe:
[ Nod32 ], "a variant of Win32/TrojanDownloader.QQHelper trojan"
[ HBEDV ], "TR/Dldr.QQhelper.DB"
uninst.exe:
[ Kaspersky ], "ARC:NSIS"
[ McAfee ], "Adware-Baidu"
[ Panda ], "Adware/BaiduBar"
[ Fortinet ], "Adware/Baidu"
[ HBEDV ], "ADSPY/BaiduBar.BR"
Updaterun.exe:
[ Nod32 ], "a variant of Win32/Adware.Toolbar.Baidu application"
usyac.dll:
[ Alpha_Gen ], "Suspicious_Rsrc"
[ Kaspersky ], "PAK:PE_Patch"
[ Nod32 ], "a variant of Win32/TrojanDownloader.QQHelper trojan"
[ HBEDV ], "HEUR/Malware"
wm[1].htm:
[ HBEDV ], "VBS/Dldr.Psyme.FV"
3724DC06.DLL:
[ Alpha_Gen ], "NSPM_Protected"
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ Nod32 ], "a variant of Win32/Agent.NEO trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "HEUR/Malware"
[ Rising ], "Trojan.IMMSG.TBMSG.dn"
[ Ewido ], "Backdoor.Agent.ahj"
3724DC06.EXE:
[ Alpha_Gen ], "NSPM_Protected"
[ Microsoft ], "VirTool:Win32/Obfuscator.A"
[ McAfee ], "N
ew Malware.ce !!"
[ Panda ], "Suspicious file"
[ Nod32 ], "a variant of Win32/Agent.NEO trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "HEUR/Crypted"

注意：有一個 ANI 的樣本，所有的防毒軟體都不能夠偵測到，難道，有新的變形嗎？

惡意連結是放置在首頁 (其他頁面可能也有) 中的：

惡意程式碼的一部份為：

當執行此惡意程式後，會產生一個應用程式錯誤的訊息：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\src[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\stat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\t[1].exe
C:\ieinst12.exe
C:\WINDOWS\~tmp3389.exe

到目前為止 (2007/4/17 @ 11:05)，下面的防毒軟體可以偵測到這些惡意檔案：

~tmp3389.exe:
[ Trend ], "TROJ_SMALL.DSA"
[ Kaspersky ], "PAK:Petite"
[ Ikarus ], "Email-Worm.Win32.Netsky.R"
a.gif:
[ Trend ], "TROJ_ANICMOO.AX"
[ Symantec ], "Trojan.Anicmoo"
[ Kaspersky ], "Exploit.Win32.IMG-ANI.k"
[ McAfee ], "Exploit-ANIfile.c"
[ Sophos ], "Troj/Animoo-L"
b.gif:
[ Trend ], "EXPL_ANICMOO.GEN"
[ Symantec ], "Trojan.Anicmoo"
[ Kaspersky ], "Exploit.Win32.IMG-ANI.m"
[ McAfee ], "Exploit-ANIfile.c"
[ Sophos ], "Exp/Animoo-A"
t[1].exe:
[ Trend ], "TROJ_SMALL.DSA"
ieinst12.exe:
[ Sophos ], "Mal/EncPk-F"
[ Nod32 ], "Win32/Pacex.Gen virus"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Drop.Ag.344576.B"
[ Ewido ], "Trojan.Maran"
update[1].exe:
[ Sophos ], "Mal/EncPk-F"
[ Nod32 ], "Win32/Pacex.Gen virus"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Drop.Ag.344576.B"
[ Ewido ], "Trojan.Maran"

• 2007/4/16 @ 15:30 開始，Malware-Test Lab 網站就一直顯示「被暫停服務」或「連不上來」，剛開始我也覺得納悶，不曉得為什麼？就打電話給美國 BlueHost 的客服人員，他們說某個程式造成 CPU 使用量過高 (80% 以上)，但記錄檔也沒有記錄有此情形，所以，我也就沒有懷疑。在他們將服務恢復正常後，不到幾分鐘，又發生同樣的事情，然後，他們又停掉我們的網站，然後，就一直不自動處理，也沒有說到底是哪裡出了問題。
• 原本以為是論壇 (SMF) 的問題或被攻擊，結果不是啦，最後懷疑到 WordPress，果然不出所料，它造成 CPU 使用量過高的情形 (高的嚇人)，然後，查詢 Google 找解決方案，找到了 WP-Cache，安裝之後，CPU 使用量就降至 10% 左右。問題好像就獲得解決了。

在這裡，我有幾點要抱怨一下：

• 這個 Blog 也沒有幾篇文章，怎麼 WordPress 這麼容易造成 CPU 使用量過高的情形呢？難道 WordPress 的研發人員不知道嗎？如果知道，為何不改善呢？
• 這些套件都是 Web Hosting 廠商提供的，我們只是安裝使用而已，不知道會發生這種情形，他們 (BlueHost) 應該要知道這些問題才對，不能只提供這些軟體，然後，遇到問題，就說是我們程式造成的問題，我勒！那我付錢要這種服務，不是自找罪受嗎？我看得找另一個 Web Hosting 廠商。

如果各位正在使用 WordPress，我想最好安裝 WP-Cache，否則，一定會遇到這種情形 (也許是其他的問題)。

最後，不曉得各位可不可以推薦一下，哪個 Web Hosting 廠商比較值得信賴呢 (我比較喜歡 Google，也許會購買他們 App Premier Edition)？謝謝。

惡意連結是放置在查詢頁面如 comp_list.asp?compid=70617268 (最好詳細檢查一下) 中：

惡意程式碼的一部份為：

ANI 零時差攻擊的部份為：

執行之後，有下面的行為：

[DLL injection]
C:\Program Files\Common Files\Microsoft Shared\MSInfo\NewInfo.dll (注入檔案總管得執行程序)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\sas.com
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\1[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\ad[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\mm[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\qq[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\mm[1].jpg
C:\Program Files\Common Files\Microsoft Shared\MSInfo\NewInfo.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\system.2dt

[Added COM/BHO]
{A6011F8F-A7F8-49AA-9ADA-49127D43138F}-C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.dll

到目前為止 (2007/4/16 @ 08:21)，下面的防毒軟體可以偵測到這些惡意檔案：

ad[1].exe:
[ Trend ], "PAK_Generic.001″
[ Symantec ], "Infostealer"
[ Kaspersky ], "PAK:UPX"
[ McAfee ], "PWS-QQPass"
[ Sophos, "[FILE:0000]:Mal/QQPass-B"
mm[1].jpg:
[ Trend ], "EXPL_ANICMOO.GEN"
[ Symantec ], "Trojan.Anicmoo"
[ Sophos ], "Exp/Animoo-A"
NewInfo.dll:
[ Sophos ], "Mal/QQPass-B"
sas.com:
[ Trend ], "PAK_Generic.001″
[ Symantec ], "Infostealer"
[ Kaspersky ], "PAK:UPX"
[ McAfee ], "PWS-QQPass"
[ Sophos, "[FILE:0000]:Mal/QQPass-B"
system.2dt:
[ Trend ], "PAK_Generic.001″
[ Symantec ], "Infostealer"
[ Kaspersky ], "PAK:UPX"
[ McAfee ], "PWS-QQPass"
[ Sophos, "[FILE:0000]:Mal/QQPass-B"

惡意連結是放置在首頁及其他頁面 (最好詳細檢查一下) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\top[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\1[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\play[1].png
C:\WINDOWS\Help\56GH0BNF.dll
C:\WINDOWS\Help\56GH0BNF.exe

[Added COM/BHO]
{79921D3F-7537-463E-9E38-CD503A8FA485}-C:\WINDOWS\help\56GH0BNF.dll

到目前為止 (2007/4/16 @ 00:58)，下面的防毒軟體可以偵測到這些惡意檔案：

56GH0BNF.exe:
[ McAfee ], "New Malware.bc !!"
[ Sophos ], "Mal/EncPk-F"
play[1].png:
[ McAfee ], "New Malware.bc !!"
[ Sophos ], "Mal/EncPk-F"

惡意連結是放置在首頁中的：

惡意程式碼的一部份為：

當執行此惡意程式後，會產生一個應用程式錯誤的訊息：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Debug\UserMode\32BB5B6.dll (注入某些執行程序如檔案總管、IE 等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\gz002.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\help[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\click[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gh02[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gh1[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gtai[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\mian[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\gh[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\gh[2].htm
C:\WINDOWS\Debug\UserMode\32BB5B6.dll
C:\WINDOWS\Debug\UserMode\32BB5B6.exe

[Added COM/BHO]
{F2319AD4-D519-45AC-86A7-02FE9B851F37}-C:\WINDOWS\debug\userMode\32BB5B6.dll

到目前為止 (2007/4/13 @ 20:57)，下面的防毒軟體可以偵測到這些惡意檔案：

32BB5B6.dll:
[ Trend ], “TSPY_LINEAGE.FFU”
[ Symantec ], “Infostealer.Lineage”
[ McAfee ], “PWS-Lineage.dll”
[ Sophos ], “Mal/GamePSW-C”
[ Panda ], “Trj/Lineage.DAO”
32BB5B6.exe:
[ Trend ], “TSPY_LINEAGE.FFT”
[ Symantec ], “Infostealer.Lineage”
[ Kaspersky ], “PAK:FSG”
[ McAfee ], “[0000a200.EXE]:PWS-Lineage.dll”
[ Sophos ], “Mal/Packer”
gh02[1].exe:
[ Trend ], “TSPY_LINEAGE.FFT”
[ Symantec ], “Infostealer.Lineage”
[ Kaspersky ], “PAK:FSG”
[ McAfee ], “[0000a200.EXE]:PWS-Lineage.dll”
[ Sophos ], “Mal/Packer”
[ Ikarus ], “Maybe A Virus”
gh[1].htm:
[ Trend ], “VBS_PSYME.AKW”
gz002.exe:
[ Trend ], “TSPY_LINEAGE.FFT”
[ Symantec ], “Infostealer.Lineage”
[ Kaspersky ], “PAK:FSG”
[ McAfee ], “[0000a200.EXE]:PWS-Lineage.dll”
[ Sophos ], “Mal/Packer”
[ Ikarus ], “Maybe A Virus”
mian[1].jpg:
[ Trend ], “EXPL_ANICMOO.GEN”
[ AhnLab-V3 ], “Win-Trojan/Exploit-ANI.B”
[ AntiVir ], “EXP/Ani.Gen”
[ Avast ], “CVE-2007-0038〃
[ AVG ], “Exploit”
[ BitDefender ], “Exploit.Win32.MS05-002.Gen”
[ CAT-QuickHeal ], “Exploit.MS05-002〃
[ ClamAV ], “Exploit.W32.MS05-002〃
[ DrWeb ], “Exploit.ANIFile”
[ eTrust-Vet ], “Win32/MS07-017!exploit”
[ Fortinet ], “W32/ANI07.A!exploit”
[ F-Prot ], “CVE-2007-1765〃
[ McAfee ], “Exploit-ANIfile.c”
[ NOD32v2 ], “a variant of Win32/TrojanDownloader.Ani.Gen”
[ Panda ], “Exploit/LoadImage”
[ Sophos ], “Exp/Animoo-A”
[ Sunbelt ], “Trojan-Exploit.Anicmoo.ax (v)”
[ Symantec ], “Trojan.Anicmoo”
[ VBA32 ], “suspected of Exploit.Signature”
[ VirusBuster ], “Exploit.ANIFile.L”
[ Webwasher-Gateway ], “Exploit.Win32.MS05-002.gen”
gtai[1].htm:
[ McAfee ], "Exploit-MS06-014″
[ Nod32 ], "VBS/TrojanDownloader.Agent.E trojan"
[ Rising ], "Trojan.DL.VBS.Agent.cll"
[ Ewido ], "Downloader.Agent.e"
svchost.vbs:
[ Kaspersky ], "Trojan.VBS.Starter.k"
[ Fortinet ], "VBS/Starter.K!tr"
[ Ewido ], "Trojan.Starter.k"

惡意連結是放置在首頁和 inside.asp 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為：

[DLL injection]
C:\viDll.dll (注入 IE 的執行程序)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\winlogin.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\jpg[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\jpg[1].htm
C:\viDll.dll
C:\WINDOWS\rundl132.exe
C:\_desktop.ini (每個資料夾都出現此檔案)

到目前為止 (2007/4/13 @ 20:16)，下面的防毒軟體可以偵測到這些惡意檔案：

jpg[1].exe:
[ Trend ], "PE_LOOKED.BE-O"
[ Symantec ], "W32.Looked.P"
[ Kaspersky ], "PAK:UPack, Worm.Win32.Viking.r"
[ McAfee ], "W32/HLLP.Philis.aq"
[ Sophos ], "W32/Looked-I"
[ Ikarus ], "Net-Worm.Win32.Mytob.X"
viDll.dll:
[ Trend ], "TROJ_LOOKED.BE"
[ Symantec ],"Downloader"
[ Kaspersky ], "Worm.Win32.Viking.r"
[ McAfee ], "W32/HLLP.Philis.dll"
[ Panda ], "W32/Viking.T.worm"
[ Ikarus ], "Trojan Dropper.Win32.Delf.LY"
winlogin.exe:
[ Trend ], "PE_LOOKED.BE-O"
[ Symantec ], "W32.Looked.P"
[ Kaspersky ], "PAK:UPack, Worm.Win32.Viking.r"
[ McAfee ], "W32/HLLP.Philis.aq"
[ Sophos ], "W32/Looked-I"
[ Ikarus ], "Net-Worm.Win32.Mytob.X"
jpg[1].htm:
[ Kaspersky ], "Trojan-Downloader.JS.Psyme.cf"
[ HBEDV ], "HEUR/Exploit.HTML"
[ Ewido ], "Hijacker.Linker.e"

惡意連結是放置在首頁中的：

惡意程式碼的一部份為：

ANI 零時差攻擊的部份為：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Debug\UserMode\32BB5B6.dll (注入某些執行程序如檔案總管、IE 等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\gz002.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\gh02[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\gh[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\help[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\gh[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\gh1[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\mian[1].jpg
C:\WINDOWS\Debug\UserMode\32BB5B6.dll
C:\WINDOWS\Debug\UserMode\32BB5B6.exe

[Added COM/BHO]
{F2319AD4-D519-45AC-86A7-02FE9B851F37}-C:\WINDOWS\debug\userMode\32BB5B6.dll

到目前為止 (2007/4/13 @ 17:28)，下面的防毒軟體可以偵測到這些惡意檔案：

32BB5B6.dll:
[ Trend ], "TSPY_LINEAGE.FFU"
[ Symantec ], "Infostealer.Lineage"
[ McAfee ], "PWS-Lineage.dll"
[ Sophos ], "Mal/GamePSW-C"
[ Panda ], "Trj/Lineage.DAO"
32BB5B6.exe:
[ Trend ], "TSPY_LINEAGE.FFT"
[ Symantec ], "Infostealer.Lineage"
[ Kaspersky ], "PAK:FSG"
[ McAfee ], "[0000a200.EXE]:PWS-Lineage.dll"
[ Sophos ], "Mal/Packer"
gh02[1].exe:
[ Trend ], "TSPY_LINEAGE.FFT"
[ Symantec ], "Infostealer.Lineage"
[ Kaspersky ], "PAK:FSG"
[ McAfee ], "[0000a200.EXE]:PWS-Lineage.dll"
[ Sophos ], "Mal/Packer"
[ Ikarus ], "Maybe A Virus"
gh[1].htm:
[ Trend ], "VBS_PSYME.AKW"
gz002.exe:
[ Trend ], "TSPY_LINEAGE.FFT"
[ Symantec ], "Infostealer.Lineage"
[ Kaspersky ], "PAK:FSG"
[ McAfee ], "[0000a200.EXE]:PWS-Lineage.dll"
[ Sophos ], "Mal/Packer"
[ Ikarus ], "Maybe A Virus"
mian[1].jpg:
[ Trend ], "EXPL_ANICMOO.GEN"
[ AhnLab-V3 ], "Win-Trojan/Exploit-ANI.B"
[ AntiVir ], "EXP/Ani.Gen"
[ Avast ], "CVE-2007-0038″
[ AVG ], "Exploit"
[ BitDefender ], "Exploit.Win32.MS05-002.Gen"
[ CAT-QuickHeal ], "Exploit.MS05-002″
[ ClamAV ], "Exploit.W32.MS05-002″
[ DrWeb ], "Exploit.ANIFile"
[ eTrust-Vet ], "Win32/MS07-017!exploit"
[ Fortinet ], "W32/ANI07.A!exploit"
[ F-Prot ], "CVE-2007-1765″
[ McAfee ], "Exploit-ANIfile.c"
[ NOD32v2 ], "a variant of Win32/TrojanDownloader.Ani.Gen"
[ Panda ], "Exploit/LoadImage"
[ Sophos ], "Exp/Animoo-A"
[ Sunbelt ], "Trojan-Exploit.Anicmoo.ax (v)"
[ Symantec ], "Trojan.Anicmoo"
[ VBA32 ], "suspected of Exploit.Signature"
[ VirusBuster ], "Exploit.ANIFile.L"
[ Webwasher-Gateway ], "Exploit.Win32.MS05-002.gen"

惡意連結是放置在首頁中的：

惡意程式碼的一部份為 (使用 malformed ascii bypassing 的技術，看起來像是毫無意義，實際上，它是可以被執行的)：

ANI 零時差攻擊的部份為：

當執行此惡意程式時，會產生一個應用程式錯誤訊息：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\qing.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\7888p[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\9197p[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\test[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\update[2].htm

到目前為止 (2007/4/13 @ 13:29)，下面的防毒軟體可以偵測到這些惡意檔案：

qing.exe:
[ Trend ], “TROJ_NSANTI.CV”
[ Alpha_Gen ], “NSPM_Protected”
[ Beta_Gen ], “Possible_MLWR-1〃
[ Microsoft ], “Virus:Win32/Detnat.F”
[ McAfee ], “New Malware.bc !!”
[ Sophos ], “Mal/Packer”
[ Fortinet ], “suspicious”
[ HBEDV ], “TR/Crypt.NSAnti.Gen”
[ Norman ], “Trojan Suspicious_N.gen”
[ Ahnlab ], “infected by Win32/NSAnti.suspicious”
update[1].exe:
[ Trend ], “TROJ_NSANTI.CV”
[ Alpha_Gen ], “NSPM_Protected”
[ Beta_Gen ], “Possible_MLWR-1〃
[ Microsoft ], “Virus:Win32/Detnat.F”
[ McAfee ], “New Malware.bc !!”
[ Sophos ], “Mal/Packer”
[ Fortinet ], “suspicious”
[ HBEDV ], “TR/Crypt.NSAnti.Gen”
[ Norman ], “Trojan Suspicious_N.gen”
[ Ahnlab ], “infected by Win32/NSAnti.suspicious”
update[2].htm:
[ Kaspersky ], “Exploit.HTML.Ascii.f”

惡意連結是放置在 major.asp 和 top.asp 檔案中的：

惡意程式碼的一部份為 (使用 malformed ascii bypassing 的技術，看起來像是毫無意義，實際上，它是可以被執行的)：

ANI 零時差攻擊的部份為：

當執行此惡意程式時，會產生一個應用程式錯誤訊息：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\qing.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\7888p[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\9197p[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\test[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\update[2].htm

到目前為止 (2007/4/13 @ 13:29)，下面的防毒軟體可以偵測到這些惡意檔案：

qing.exe:
[ Trend ], “TROJ_NSANTI.CV”
[ Alpha_Gen ], “NSPM_Protected”
[ Beta_Gen ], “Possible_MLWR-1〃
[ Microsoft ], “Virus:Win32/Detnat.F”
[ McAfee ], “New Malware.bc !!”
[ Sophos ], “Mal/Packer”
[ Fortinet ], “suspicious”
[ HBEDV ], “TR/Crypt.NSAnti.Gen”
[ Norman ], “Trojan Suspicious_N.gen”
[ Ahnlab ], “infected by Win32/NSAnti.suspicious”
update[1].exe:
[ Trend ], “TROJ_NSANTI.CV”
[ Alpha_Gen ], “NSPM_Protected”
[ Beta_Gen ], “Possible_MLWR-1〃
[ Microsoft ], “Virus:Win32/Detnat.F”
[ McAfee ], “New Malware.bc !!”
[ Sophos ], “Mal/Packer”
[ Fortinet ], “suspicious”
[ HBEDV ], “TR/Crypt.NSAnti.Gen”
[ Norman ], “Trojan Suspicious_N.gen”
[ Ahnlab ], “infected by Win32/NSAnti.suspicious”
update[2].htm:
[ Kaspersky ], "Exploit.HTML.Ascii.f"

惡意連結是放置在首頁中的：

惡意程式碼的一部分為：

ANI 零時差攻擊的部份為：

執行之後，有下面的行為：

[Added process]
C:\WINDOWS\avp.exe

[Deleted process]

[----- DLL -----]
C:\Program Files\Internet Explorer\PLUGINS\BinNice.dll (注入某個執行程序如檔案總管、IE 等)
C:\WINDOWS\system32\ldmedia5.dll (注入某個執行程序如 IE 等)

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL (這是正常的服務)
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\autorun.bat
C:\Documents and Settings\Administrator\Local Settings\Temp\css.vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\2[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\456J8TAJ\ani[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\css[1].vbs
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6DEV01Y7\flash[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GDI3K1MF\svchost[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\getflashplayer[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OD2ZGLMN\xskj[1].jpg
C:\Program Files\Internet Explorer\PLUGINS\BinNice.bak
C:\Program Files\Internet Explorer\PLUGINS\BinNice.bkk
C:\Program Files\Internet Explorer\PLUGINS\BinNice.dll
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\ldmedia5.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (連結至 C:\WINDOWS\system32\ldmedia5.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (連結至 C:\WINDOWS\system32\ldmedia5.dll)

[Added COM/BHO]
{03E636B9-AE6C-5E23-638E-B633E22F6338}-C:\Program Files\Internet Explorer\PLUGINS\BinNice.dll

到目前為止 (2007/4/12 @ 03:07)，下面的防毒軟體可以偵測到這些惡意檔案：

ldmedia5.dll:
[ Trend ], "TROJ_MARAN.EN"
avp.exe:
[ Trend ], "TROJ_DELF.DZE"
BinNice.bak:
[ Microsoft ], "[->(FSG-v2.0)]:TrojanDropper:Win32/Dowque.A"
[ Kaspersky ], "PAK:FSG"
[ Sophos ], "Mal/Packer"
[ Panda ], "Suspicious file"
[ Fortinet ], "suspicious"
[ HBEDV ], "DR/Delphi.Gen"
[ Norman ], "Security Risk Suspicious_F.gen"
BinNice.bkk:
[ Microsoft ], "[->(UPX)]:TrojanDropper:Win32/Dowque.A"
[ Kaspersky ], "PAK:UPX"
[ HBEDV ], "HEUR/Crypted"
BinNice.dll:
[ Microsoft ], "[->(UPX)]:TrojanDropper:Win32/Dowque.A"
[ Kaspersky ], "PAK:UPX"
[ HBEDV ], "HEUR/Crypted"
getflashplayer[1].htm:
[ Alpha_Gen ], "Heur_Infrm-1″
[ Kaspersky ], "Trojan-Downloader.VBS.Psyme.fx"
autorun.bat:
[ Microsoft ], "[->(FSG-v2.0)]:TrojanDropper:Win32/Dowque.A"
[ Kaspersky ], "PAK:FSG"
[ Sophos ], "Mal/Packer"
[ Panda ], "Suspicious file"
[ Fortinet ], "suspicious"
[ HBEDV ], "DR/Delphi.Gen"
[ Norman ], "Security Risk Suspicious_F.gen"
xskj[1].jpg:
[ AhnLab-V3 ], “Win-Trojan/Exploit-ANI.B”
[ AntiVir ], “EXP/MS05-002.Ani.A”
[ BitDefender ], “Exploit.Win32.MS05-002.Gen”
[ CAT-QuickHeal ], “Exploit.MS05-002〃
[ ClamAV ], “Exploit.W32.MS05-002〃
[ eTrust-Vet ], “Win32/MSA-935423!exploit”
[ Ewido ], “Not-A-Virus.Exploit.Win32.IMGANI.h”
[ F-Secure ], “Exploit.Win32.IMG-ANI.h”
[ Kaspersky ], “Exploit.Win32.IMG-ANI.h”
[ McAfee ], “Exploit-ANIfile.c”
[ Microsoft ], “TrojanDownloader:Win32/Anicmoo.gen!D”
[ NOD32v2 ], “a variant of Win32/TrojanDownloader.Ani.Gen”
[ Norman ], “RIFF/Ani_exploit.gen”
[ Sophos ], “Troj/Animoo-U”
[ Symantec ], “Trojan.Anicmoo”
[ Trend ], “EXPL_ANICMOO.GEN”
[ VirusBuster ], “Exploit.ANIFile.G”
[ Webwasher-Gateway ], “Exploit.MS05-002.Ani.A”

下圖是金管會含有此連結的網頁：

下圖是金管會修正此連結後的網頁：

下圖是台灣金融研訓院含有此連結的網頁：

下圖是台灣金融研訓院修正此連結後的網頁：

此色情網站的註冊資訊 (也許是網站被黑，也說不一定) ：