大砲開講

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[DLL injection]
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe
C:\WINDOWS\Web\printers\images\jhgfd.dll

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\svchost.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\717001[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\2003[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\614001[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\laog[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\g[1].htm
C:\WINDOWS\Web\printers\images\jhgfd.dll
C:\WINDOWS\Web\printers\images\jhgfd.exe

[Added COM/BHO]
{C01A46D2-5397-4087-90DD-F44F207F7642}-C:\WINDOWS\Web\printers\images\jhgfd.dll

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\update[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\stat[1].htm
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\od2media.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (C:\WINDOWS\system32\od2media.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (C:\WINDOWS\system32\od2media.dll)

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\update[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\stat[1].htm
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\od2media.dll

[Added LSP]
ID: 1012
NAME: MSAFD Tcpip [RAW/IP] (C:\WINDOWS\system32\od2media.dll)

ID: 1013
NAME: MSAFD Tcpip [TCP/IP] (C:\WINDOWS\system32\od2media.dll)

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[Added service]
NAME: VGADown
DISPLAY: Audio Adapter
FILE: C:\WINDOWS\avp.exe

NAME: WS2IFSL
DISPLAY: Windows Socket 2.0 Non-IFS Service Provider Support Environment
FILE: \SystemRoot\System32\drivers\ws2ifsl.sys

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\stat[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\test[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\update[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\help[1].htm
C:\WINDOWS\avp.exe
C:\WINDOWS\system32\od2media.dll

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為 (滿慘的，請各位小心一點)：

[Added process]
C:\WINDOWS\sys220.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\1.exe

[DLL injection]
C:\Documents and Settings\Administrator\Local Settings\Temp\LYMANGR.DLL
C:\Documents and Settings\Administrator\Local Settings\Temp\mhso0.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\qjso0.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\rxso0.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\tlso0.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\wdso0.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\ztso0.dll
C:\Program Files\Common Files\System\ado\msado15.dll
C:\Program Files\Common Files\System\msadc\msadco.dll
C:\Program Files\Common Files\System\msadc\msadcor.dll

[Added files]
在系統中建立太多的惡意檔案

到目前為止 (2007/7/12 @ 09:55)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

[Logo1_.exe:
[ Trend ], "PE_LOOKED.ACX-O"
mppds.dll:
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "PWS:Win32/Frethog.D"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.es"
[ Fortinet ], "W32/Agent.BTI!tr.pws"
[ HBEDV ], "TR/PSW.Agent.20480″
[ Norman ], "Trojan OnlineGames.gen11″
[ Rising ], "Trojan.PSW.Win32.OnlineGames.ci"
[ Ewido ], "Trojan.OnLineGames.es"
LYMANGR.dll:
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "VirTool:Win32/Obfuscator.C"
[ Kaspersky ], "PAK:UPack"
[ McAfee ], "Generic PWS.j"
[ Fortinet ], "suspicious"
[ HBEDV ], "HEUR/Malware"
[ Norman ], "Security Risk W32/Suspicious_U.gen"
LYLOADER.exe:
[ Alpha_Gen ], "Possible_Virus"
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "[->(Upack)->[RSRCEmb]]:VirTool:Win32/Obfuscator.C"
[ Kaspersky ], "PAK:PE_Patch, PAK:UPack"
[ McAfee ], "New Malware.aj !!"
[ Panda ], "Suspicious file"
[ Nod32 ], "a variant of Win32/PSW.Agent.NEC trojan"
[ Fortinet ], "suspicious"
[ HBEDV ], "HEUR/Malware"
[ Norman ], "Security Risk W32/Suspicious_U.gen"
tlso0.dll:
[ Symantec ], "Infostealer.Gampass"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.bs"
[ Fortinet ], "W32/OnlineGames.AVG!tr.pws"
[ HBEDV ], "TR/Spy.Gen"
[ Norman ], "Trojan W32/OnLineGames.ICJ"
[ Rising ], "Trojan.PSW.Win32.Agent.pn"
[ Ewido ], "Trojan.OnLineGames.bs"
rxso0.dll:
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.lj"
[ Panda ], "Trj/Lineage.DTB"
[ Nod32 ], "Win32/PSW.OnLineGames.NBD trojan"
[ Fortinet ], "W32/LegMir.ARC!tr.pws"
[ HBEDV ], "TR/Spy.Gen"
[ Rising ], "Trojan.PSW.OnlineGames.bto"
[ Ewido ], "Trojan.OnLineGames.lj"
mppds.exe:
[ Microsoft ], "PWS:Win32/Lmir.gen!J"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.es"
[ HBEDV ], "TR/PSW.Agent.20480″
[ Rising ], "Trojan.PSW.Win32.OnlineGames.ci"
zxso0.dll:
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.qo"
[ Fortinet ], "W32/Gampass.A!tr.pws"
[ HBEDV ], "TR/Spy.Gen"
[ Rising ], "Trojan.PSW.Win32.WorldOnline.ja"
[ Ewido ], "Trojan.OnLineGames.qo"
ztso0.dll:
[ Symantec ], "Infostealer"
[ Kaspersky ], "Trojan-PSW.Win32.Nilage.bjp"
[ McAfee ], "PWS-LegMir.dll"
[ Nod32 ], "probably a variant of Win32/Genetik trojan"
[ Fortinet ], "W32/LegMir.BJP!tr.pws"
[ HBEDV ], "TR/Spy.Gen"
[ Rising ], "Trojan.PSW.Win32.OnlineGames.dfh"
wdso0.dll:
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.bs"
[ Fortinet ], "W32/OnLineGames.BS!tr.pws"
[ HBEDV ], "TR/Spy.Gen"
[ Rising ], "Trojan.PSW.OnlineGames.byp"
qjso0.dll:
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.bs"
[ Nod32 ], "a variant of Win32/PSW.OnLineGames.NAZ trojan"
[ Fortinet ], "W32/OnLineGames.BS!tr.pws"
[ HBEDV ], "TR/Spy.Gen"
[ Rising ], "Trojan.PSW.Win32.OnlineGames.del"
mhso0.dll:
[ Symantec ], "Infostealer.Gampass"
[ Microsoft ], "PWS:Win32/Legmir.E!dll"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.yy"
[ Nod32 ], "a variant of Win32/PSW.OnLineGames.NAT trojan"
[ Fortinet ], "W32/Agent.NDP!tr.pws"
[ HBEDV ], "TR/Spy.Gen"
[ Rising ], "Trojan.PSW.Win32.Agent.po"
2637921.bat:
[ Kaspersky ], "Trojan.BAT.KillAV.ez"
Ravasktao.dll:
[ Alpha_Gen ], "Possible_OLGM-8″
[ Microsoft ], "PWS:Win32/Skatayo.A!dll"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.ql"
[ McAfee ], "PWS-LegMir.dll"
[ Panda ], "Trj/Lineage.EGZ"
[ Fortinet ], "W32/LegMir.QL!tr.pws"
[ HBEDV ], "TR/Spy.Gen"
[ Rising ], "Trojan.PSW.Win32.AskTao.d"
[ Ewido ], "Trojan.OnLineGames.ql"
TIMHost.dll:
[ Symantec ], "Infostealer.Gampass"
[ Kaspersky ], "Trojan-PSW.Win32.OnLineGames.yn"
[ McAfee ], "PWS-LegMir.dll"
[ Fortinet ], "OnLine!tr"
[ HBEDV ], "TR/PSW.OnLineGames.YN.83″
[ Norman ], "Trojan W32/OnLineGames.ICK"
[ Rising ], "Trojan.PSW.Win32.RocOnline.t"
MSDEG32.dll:
[ Microsoft ], "VirTool:Win32/Obfuscator.C"
[ K
aspersky ], "PAK:UPack"
[ McAfee ], "Generic PWS.j"
[ Fortinet ], "suspicious"
[ HBEDV ], "HEUR/Malware"
[ Norman ], "Security Risk W32/Suspicious_U.gen""

• AnalyzeThis statistics: 會將記錄檔上傳至 TrendSecure 或是 HijackThis 相關論壇
• 支援 Windows Vista
• 改善 IE 7.0 的支援
• 改善非英文白名單之支援
• 支援清除 ActiveX Desktop Components

下圖是新舊版本之比較：

對此免費工具有興趣的網友，可以到這裡下載此工具。

下圖是美國主站的畫面：

問題出在「惡意程式也可能偽裝成txt、jpg、gif檔入侵，而這些在閘道端都無法阻擋」。現在大部分閘道端防毒軟體都可以針對檔案內容辨識檔案格式，並不會因為惡意程式偽裝成其他副檔名，而偵測不到那些惡意程式，除非防毒軟體本身的設定有問題，或是防毒軟體根本沒有那些惡意程式的特徵碼。

最後，請不要再把錯誤的觀念灌輸給大家。

不曉得各位對這則新聞有什麼看法呢？

至於詳細資訊，請參考這裡。

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\update[1].exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SEUIMLSE\index.html
C:\Program Files\Common Files\System\commond.pif

惡意連結是放置在首頁 (其他頁面可能要仔細檢查一下囉) 中的：

執行之後，有下面的行為：

[Added file]
C:\Documents and Settings\Administrator\Local Settings\Temp\svhost.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C13NVBMZ\help[1].htm
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\OXI7BCE5\common[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Q08VKCK4\help[1].exe

到目前為止 (2007/7/9 @ 10:11)，下面的防毒軟體可以偵測到這些惡意檔案 (僅提供參考)：

svhost.exe:
[ Kaspersky ], "PAK:UPX"
[ Fortinet ], "suspicious"
help[1].exe:
[ Kaspersky ], "PAK:UPX"
[ Fortinet ], "suspicious"