大砲開講

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Debug\UserMode\8508D.dll (注入某些執行程序如檔案總管、IE 等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\haotian.bat
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\2007mmm[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\072[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\614[1].htm
C:\WINDOWS\Debug\UserMode\8508D.dll
C:\WINDOWS\Debug\UserMode\8508D.exe

[Added COM/BHO]
{D4206534-73D8-4490-ACA9-CCB28370ABF7}-C:\WINDOWS\debug\userMode\8508D.dll

到目前為止 (2007/5/15 @ 10:13)，下面的防毒軟體可以偵測到這些惡意檔案：

614[1].htm:
[ Trend ], "VBS_PSYME.ZY"
2007mmm[1].exe:
[ Trend ], "TSPY_LINEAGE.DXK"
8508D.dll:
[ Trend ], "Possible_Infostl"
8508D.exe:
[ Trend ], "TSPY_LINEAGE.DXK"
haotian.bat:
[ Trend ], "TSPY_LINEAGE.DXK"
072[1].htm:
[ Fortinet ], "VBS/Psyme.DN!tr.dldr"

惡意連結是放置在 swfobject.js (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

當執行此惡意程式之後，會產生應用程式錯誤：

執行之後，有下面的行為 (會造成網路中斷)：

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\mystat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\stat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\update[2].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\test[1].js
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\od2media.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

到目前為止 (2007/5/15 @ 10:05)，下面的防毒軟體可以偵測到這些惡意檔案：

od2media.dll:
[ Trend ], "TSPY_ONLINEG.BHX"
update[1].exe:
[ Trend ], "TROJ_NSANTI.CE"
update[1].htm:
[ Trend ], "HTML_AGENT.AACU"
avp.exe:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Beta_Gen ], "Possible_MLWR-1″
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "Virus:Win32/Detnat.F"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.kw"
[ McAfee ], "New Malware.w !!"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/Lineage.DJC"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSAnti.Gen"
[ Norman ], "Trojan W32/OnLineGames.EAT"
[ Ewido ], "Trojan.OnLineGames.kw"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Trend ], "TSPY_ONLINEG.ASH"

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

當執行此惡意程式之後，會產生應用程式錯誤：

執行之後，有下面的行為 (會造成網路中斷)：

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\mystat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\stat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\update[2].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\test[1].js
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\od2media.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

到目前為止 (2007/5/15 @ 10:05)，下面的防毒軟體可以偵測到這些惡意檔案：

od2media.dll:
[ Trend ], "TSPY_ONLINEG.BHX"
update[1].exe:
[ Trend ], "TROJ_NSANTI.CE"
update[1].htm:
[ Trend ], "HTML_AGENT.AACU"
avp.exe:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Beta_Gen ], "Possible_MLWR-1″
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "Virus:Win32/Detnat.F"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.kw"
[ McAfee ], "New Malware.w !!"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/Lineage.DJC"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSAnti.Gen"
[ Norman ], "Trojan W32/OnLineGames.EAT"
[ Ewido ], "Trojan.OnLineGames.kw"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Trend ], "TSPY_ONLINEG.ASH"

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\winvar.dll (注入到某些執行程序如檔案總管、IE等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\gfdgj45.com
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\real[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\a[1].exe
C:\WINDOWS\system32\winsp2.exe
C:\WINDOWS\winvar.dll

[Added COM/BHO]
{AB0219F9-4EB2-4997-A50A-1A42C3205261}-C:\WINDOWS\winvar.dll

到目前為止 (2007/5/15 @ 10:46)，下面的防毒軟體可以偵測到這些惡意檔案：

gfdgj45.com:
[ Trend ], "TSPY_LINEAGE.IYZ"
winsp2.exe:
[ Trend ], "TSPY_LINEAGE.IYZ"
winvar.dll:
[ Trend ], "Possible_Lineage"
a[1].exe:
[ Trend ], "TSPY_LINEAGE.IYZ"
real[1].htm:
[ McAfee ], "ObfuscatedHtml !!"

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

當執行此惡意程式之後，會產生應用程式錯誤：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\Tradue.com
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\popcjs[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\music[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\top[1].js

到目前為止 (2007/5/14 @ 11:02)，下面的防毒軟體可以偵測到這些惡意檔案：

Tradue.com:
[ Trend ], "TSPY_AGENT.QEX"

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

當執行此惡意程式之後，會產生應用程式錯誤：

執行之後，有下面的行為 (會造成網路中斷)：

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\mystat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\stat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\update[2].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\test[1].js
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\od2media.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

到目前為止 (2007/5/13 @ 23:28)，下面的防毒軟體可以偵測到這些惡意檔案：

od2media.dll:
[ Trend ], "TSPY_ONLINEG.BHX"
update[1].exe:
[ Trend ], "TROJ_NSANTI.CE"
update[1].htm:
[ Trend ], "HTML_AGENT.AACU"
avp.exe:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Beta_Gen ], "Possible_MLWR-1″
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "Virus:Win32/Detnat.F"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.kw"
[ McAfee ], "New Malware.w !!"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/Lineage.DJC"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSAnti.Gen"
[ Norman ], "Trojan W32/OnLineGames.EAT"
[ Ewido ], "Trojan.OnLineGames.kw"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Trend ], "TSPY_ONLINEG.ASH"

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

當執行此惡意程式之後，會產生應用程式錯誤：

執行之後，有下面的行為 (會造成網路中斷)：

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\mystat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\stat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\update[2].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\test[1].js
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\od2media.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

到目前為止 (2007/5/13 @ 23:28)，下面的防毒軟體可以偵測到這些惡意檔案：

od2media.dll:
[ Trend ], "TSPY_ONLINEG.BHX"
update[1].exe:
[ Trend ], "TROJ_NSANTI.CE"
update[1].htm:
[ Trend ], "HTML_AGENT.AACU"
avp.exe:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Beta_Gen ], "Possible_MLWR-1″
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "Virus:Win32/Detnat.F"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.kw"
[ McAfee ], "New Malware.w !!"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/Lineage.DJC"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSAnti.Gen"
[ Norman ], "Trojan W32/OnLineGames.EAT"
[ Ewido ], "Trojan.OnLineGames.kw"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Trend ], "TSPY_ONLINEG.ASH"

惡意連結是放置在 footer.js (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Help\69GH0BNS.dll

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\play[1].png
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\footer[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\play[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\top[1].js
C:\WINDOWS\Help\69GH0BNS.dll
C:\WINDOWS\Help\69GH0BNS.exe

[Added COM/BHO]
{79921D3F-7537-463E-9E38-CD503A8FA485}-C:\WINDOWS\help\69GH0BNS.dll

到目前為止 (2007/5/12 @ 10:35)，下面的防毒軟體可以偵測到這些惡意檔案：

69GH0BNS.dll:
[ Microsoft ], "PWS:Win32/Frethog.C"
[ Sophos ], "Mal/EncPk-F"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
69GH0BNS.exe:
[ Microsoft ], "PWS:Win32/Frethog.C"
[ Sophos ], "Mal/EncPk-F"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
play[1].png:
[ Microsoft ], "PWS:Win32/Frethog.C"
[ Sophos ], "Mal/EncPk-F"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Debug\UserMode\12994.dll (注入某些執行程序如檔案總管、IE等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\haotian.bat
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\614[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\index[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\20070418a[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\a2[1].htm
C:\WINDOWS\Debug\UserMode\12994.dll
C:\WINDOWS\Debug\UserMode\12994.exe

[Added COM/BHO]
{1A2B5BD6-5867-48C3-B826-807FC6AE8F3D}-C:\WINDOWS\debug\userMode\12994.dll

到目前為止 (2007/5/11 @ 11:14)，下面的防毒軟體可以偵測到這些惡意檔案 (除了 ANI 的檔案外)：

12994.dll:
[ Trend ], "Possible_Infostl"
12994.exe:
[ Trend ], "Possible_Infostl"
20070418a[1].exe:
[ Trend ], "Possible_Infostl"
haotian.bat:
[ Trend ], "Possible_Infostl"
614[1].htm:
[ Trend ], "VBS_PSYME.AAE"
a2[1].htm:
[ Fortinet ], "VBS/Psyme.DN!tr.dldr"

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為：

[DLL injection]
C:\WINDOWS\Debug\UserMode\3773.dll (注入某些執行程序如檔案總管、IE等)

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\haotian.bat
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\help[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\714[1].gif
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\laog[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\m[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\index614[1].htm
C:\WINDOWS\Debug\UserMode\3773.dll
C:\WINDOWS\Debug\UserMode\3773.exe

[Added COM/BHO]
{40A5246E-48D6-4FD0-B7C8-17130F0E2D82}-C:\WINDOWS\debug\userMode\3773.dll

到目前為止 (2007/5/11 @ 10:07)，下面的防毒軟體可以偵測到這些惡意檔案 (除了 ANI 的檔案外)：

3773.dll:
[ Trend ], "TSPY_LINEAGE.EJE"
3773.exe:
[ Trend ], "TSPY_LINEAGE.EJE"
haotian.bat:
[ Trend ], "TSPY_LINEAGE.EJE"
index614[1].htm:
[ Trend ], "VBS_PSYME.ZZ"
m[1].exe:
[ Trend ], "TSPY_LINEAGE.EJE"
help[1].htm:
[ Fortinet ], "VBS/Psyme.DN!tr.dldr"
laog[1].htm:
[ Alpha_Gen ], "Heur_Infrm-1″
[ Fortinet ], "VBS/Psyme.DN!tr.dldr"

惡意連結是放置 1024×768 的首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為：

[Hidden process]
C:\Program Files\Internet Explorer\iexplore.exe (鎖住 C:\WINDOWS\Hacker.com.cn.exe)

[Added process]
C:\WINDOWS\avp.exe

[DLL injection]
C:\WINDOWS\system32\tf2sound.dll (注入某些執行程序如檔案總管、IE等)

[Added service]
NAME: GrayPigeon_Hacker.com.cn
DISPLAY: GrayPigeon_Hacker.com.cn
FILE: C:\WINDOWS\Hacker.com.cn.exe

NAME: SVKP
DISPLAY: SVKP
FILE: \??\C:\WINDOWS\system32\SVKP.sys

NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL (這是正常的服務)
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\12[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\hker[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\hker[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\hker[2]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\server1[1].exe
C:\WINDOWS\avp.exe
C:\WINDOWS\Hacker.com.cn.exe
C:\WINDOWS\system32\SVKP.sys
C:\WINDOWS\system32\tf2sound.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (連結至C:\WINDOWS\system32\tf2sound.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (連結至C:\WINDOWS\system32\tf2sound.dll)

到目前為止 (2007/5/11 @ 10:12)，下面的防毒軟體可以偵測到這些惡意檔案 (除了 ANI 檔案外)：

12[1].exe:
[ Microsoft ], "[->(Upack)]:TrojanSpy:Win32/Maran.gen!A"
[ Kaspersky ], "PAK:PE_Patch, PAK:UPack"
[ McAfee ], "New Malware.aj !!"
[ Sophos ], "Troj/Maran-Gen"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Drop.Maran.C.2″
[ Norman ], "Security Risk W32/Suspicious_U.gen"
[ Ewido ], "Trojan.Pakes"
[ Trend ], "TROJ_MARAN.IY"
Hacker.com.cn.exe:
[ Microsoft ], "TrojanDropper:Win32/Hupigon.gen!A"
[ Kaspersky ], "PAK:SVKP, Backdoor.Win32.Hupigon.eko"
[ McAfee ], "BackDoor-ARR"
[ Sophos ], "Mal/GrayBird"
[ Fortinet ], "suspicious"
[ HBEDV ], "BDS/Hupigon.Gen"
[ Norman ], "Backdoor W32/Smalldoor.ANNN"
[ Trend ], "BKDR_HUPIGON.DTP"
server1[1].exe:
[ Microsoft ], "TrojanDropper:Win32/Hupigon.gen!A"
[ Kaspersky ], "PAK:SVKP, Backdoor.Win32.Hupigon.eko"
[ McAfee ], "BackDoor-ARR"
[ Sophos ], "Mal/GrayBird"
[ Fortinet ], "suspicious"
[ HBEDV ], "BDS/Hupigon.Gen"
[ Norman ], "Backdoor W32/Smalldoor.ANNN"
[ Trend ], "BKDR_HUPIGON.DTP"
SVKP.sys:
[ Fortinet ], "SPY/Joiner"
avp.exe:
[ Symantec ], "Infostealer.Gampass"
[ Alwil ], "Win32:Lineage-320 [Trj]"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ HBEDV ], "TR/Drop.Maran.C.2″
[ Ewido ], "Trojan.Lineage.ajf"
[ Trend ], "TSPY_MARAN.HC"
tf2sound.dll:
[ Symantec ], "Infostealer.Lineage"
[ Alwil ], "Win32:Maran-D [Trj]"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ HBEDV ], "TR/Drop.Maran.C.3″
[ Trend ], "TSPY_MARAN.LE"

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為 (會造成網路中斷)：

[Added process]
C:\WINDOWS\avp.exe

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL (這是正常的服務)
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\stat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\update[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\9197p[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\test[1].js
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\od2media.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

到目前為止 (2007/5/10 @ 09:29)，下面的防毒軟體可以偵測到這些惡意檔案：

od2media.dll:
[ Trend ], "TSPY_ONLINEG.BHX"
update[1].exe:
[ Trend ], "TROJ_NSANTI.CE"
update[1].htm:
[ Trend ], "HTML_AGENT.AACU"
avp.exe:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Beta_Gen ], "Possible_MLWR-1″
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "Virus:Win32/Detnat.F"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.kw"
[ McAfee ], "New Malware.w !!"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/Lineage.DJC"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSAnti.Gen"
[ Norman ], "Trojan W32/OnLineGames.EAT"
[ Ewido ], "Trojan.OnLineGames.kw"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Trend ], "TSPY_ONLINEG.ASH"

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為 (會造成網路中斷)：

[Added process]
C:\WINDOWS\avp.exe

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL (這是正常的服務)
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\stat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\update[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\9197p[1].jpg
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\test[1].js
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\od2media.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (連結至 C:\WINDOWS\system32\od2media.dll)

到目前為止 (2007/5/10 @ 09:29)，下面的防毒軟體可以偵測到這些惡意檔案：

od2media.dll:
[ Trend ], "TSPY_ONLINEG.BHX"
update[1].exe:
[ Trend ], "TROJ_NSANTI.CE"
update[1].htm:
[ Trend ], "HTML_AGENT.AACU"
avp.exe:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Beta_Gen ], "Possible_MLWR-1″
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "Virus:Win32/Detnat.F"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.kw"
[ McAfee ], "New Malware.w !!"
[ Sophos ], "Mal/Packer"
[ Panda ], "Trj/Lineage.DJC"
[ Nod32 ], "a variant of Win32/PSW.Maran trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSAnti.Gen"
[ Norman ], "Trojan W32/OnLineGames.EAT"
[ Ewido ], "Trojan.OnLineGames.kw"
[ Ahnlab ], "infected by Win32/NSAnti.suspicious"
[ Trend ], "TSPY_ONLINEG.ASH"

惡意連結是放置在 English_Hot.asp (很多頁面都有，可能要仔細檢查一下或重新安裝) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為 (值入很多東西，情況滿慘的)：

[Added file]
C:\1.htm
C:\Documents and Settings\Administrator\Local Settings\Temp\SVCH0ST.EXE
C:\Documents and Settings\Administrator\Local Settings\Temp\SVCHOST.VBS
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\7tzi[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\hardup[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\link[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\pop[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\pop[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\xh[1].bmp
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\7tzi[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\7tzi[2].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\record[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\stat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\loves[2].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\sysqq[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\xiaoq[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\06[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\ad[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\mmss[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\WebUICheck[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\xiaoqci[1].exe
C:\ie.exe
C:\Program Files\Common Files\Microsoft Shared\MSInfo\MS0tmw3.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\MSyxcts.dll
C:\WINDOWS\system32\hideme.dll
C:\WINDOWS\system32\wmshijie.dll

[Added COM/BHO]
{2775F001-CBD2-46bb-A198-08F03F04C98C}-C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSyxcts.dll

惡意連結是放置在首頁 (可能要仔細檢查一下囉) 中的：

惡意程式碼的一部份為：

執行之後，有下面的行為 (會造成網路中斷，無法連上網)：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\top[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\1[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\play[1].png
C:\WINDOWS\Help\69GH0BNS.dll
C:\WINDOWS\Help\69GH0BNS.exe

[ Added COM/BHO ]
{79921D3F-7537-463E-9E38-CD503A8FA485}-C:\WINDOWS\help\69GH0BNS.dll

到目前為止 (2007/5/9 @ 10:16)，下面的防毒軟體可以偵測到這些惡意檔案：

1[1].htm:
[ Trend ], "HTML_DLOADER.NCE"
69GH0BNS.dll:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Sophos ], "Mal/EncPk-F"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
69GH0BNS.exe:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Sophos ], "Mal/EncPk-F"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"
play[1].png:
[ Alpha_Gen ], "Possible_MLWR-5″
[ Sophos ], "Mal/EncPk-F"
[ Fortinet ], "suspicious"
[ HBEDV ], "TR/Crypt.NSPM.Gen"