“7.7”昭化路凶案告破  ——犯罪嫌疑人陈军安徽郎溪落网       

    经过上海警方连续四天四夜的缜密侦查，“7.7”昭化路凶案顺利告破。7月11日早晨，在安徽省宣城市公安局大力协助下，犯罪嫌疑人陈军在宣城市郎溪县落网。
    7日凌晨5时30分许，市公安局110指挥中心接报警称：昭化路一居民楼里内有一女子被害。警方迅速前往处置。经调查，被害人戴安娜23岁，持加拿大护照，今年6月24日入境，暂住昭化路。
    案件引起市公安局领导高度重视，要求从速破案。上海警方立即抽调精兵强将，成立了由市公安局刑侦总队和长宁公安分局等单位组成的专案组，全力展开侦破工作。
    经现场勘查，专案组初步锁定：作案者为一名青年男性，中等身材，曾骑一辆自行车到现场附近。侦查工作随即有针对性地展开。
    7月10日，一叫陈军的男子进入警方视线。据查，陈军，1990年2月出生，案发后逃至浙江湖州，后又在安徽宣城地区出现。在掌握陈军的作案轨迹后，专案组即组织精干力量赶赴安徽宣城实施抓捕。
    7月11日 8时 15分许，在宣城警方大力协助下，犯罪嫌疑人陈军在宣城郎溪县束手就擒。随后，警方追缴了“7.7”案中被劫的便携式电脑等物品。
    经审讯，犯罪嫌疑人陈军交代了7月6日晚在昭化路尾随被害人入室后实施盗窃，遭被害人反抗后将其杀害并抢劫钱财的犯罪经过。

原文地址：http://gaj.sh.gov.cn/shga/gweb/xxnr_view.jsp?pa=58e282badd297ff32c39d6aa91d115dd002b8ca9817ab551b3e4c275140f52b48756d7d06f8129ba

网络公祭地址：http://512.china5000.org.cn

鲜花地址：http://www.china5000.org.cn/flower/default.aspx

    新华网、中央政府网站都已经发布消息了。

    一个代号为红心闪闪的行动昨天在国内互联网上被广泛宣传，在Google和百度上搜了一下相关的内容，那是相当的多。从Arbor Networks的报道来看，攻击确实出现了，不过没有贴出相关的数据，只有简短的几句话：

在Neeao的日志里看到了相关被黑的页面，不过我去看的时候，CNN似乎已经恢复了。

    在该篇报道中，提到了一个名为The Dark Visitor的网站，似乎是一个跟踪中国黑客活动的网站，我这里登不上，因此关于这个网站的具体内容也一无所知。不过从Arbornet works的监测情况来看，似乎大规模的攻击还未开始。

Destinations	www.cnn.com (one of the IPs for this DNS name)
Attacks in past 24 hours	36 attacks measured
Attacks by type	36 TCP SYN floods
Average and max attack duration	330 seconds average (5.5 minutes), 337 second maximum (slightly longer)

    除此之外，好像今天华人也准备举行游行示威。祝示威活动能达到预期的效果！

主　题： 汇款银行帐户
发件人： cfgh@qq.com.cn

您好！

麻烦（这２天）把款存入以下银行帐户：

中国平安银行--深圳分行

卡号：6222   9800  0012   6369

户名：岑燕萍

请尽快办理--多谢合作！

Google和Baidu了一下，似乎也有些朋友收到了这样的邮件。

瑞星还需努力啊！！！

好友狮子昨天发了一篇文章：解答：《实战揭露瑞星主动防御本质》，引起了安全爱好者的关注，评论数量很多（比我这里多多了^_^）。今天花了些时间，把所有的评论看了一下，总体感觉：很有趣。我又重温了一次一人舌战众人的感觉，哈哈，当然想要狮子说服所有的人，那是不可能的事，因为有些人生来就是喜欢与人争辩的，哪怕自己没有一点道理。评论中，有些网友的意见很诚恳，希望瑞星可以吸纳，因为想用户所想才是你们应该做的。

最后对狮子说：如果以后还有有关产品的文章，尽量别放在个人博客上；如果非要放在个人博客上，那记得关闭评论功能，这样就不会被一些“无赖”盯上。

这的确是个蛮吃惊的消息，网易等网站都已对雷军离职事件作出了专题报道：http://tech.163.com/special/00092GJD/ljlz.html

CISRT刚刚针对今年的MSN蠕虫发布了相关的总结报告，希望对MSN用户有帮助。

广大网友可以访问：http://www.cisrt.org/blog/read.php?383

叶伟伦的部分话语：

记者：据说为了让病毒列表显得很长，以显示公司的技术实力，有的厂商故意误杀？ 叶伟伦：的确有厂商利用误杀来制造卖点，因为用户通常以为杀出来的病毒越多，杀毒软件就越有效，这里面当然有误解，可是厂商们会利用这一点，比如把一些似是而非的程序也放进“黑名单”。 记者：据您了解，在中国有多少厂商在这样做？ 叶伟伦：前段时间的流氓软件大战是典型的例子，其实那些被称作“流氓”的程序该不该放进“黑名单”是值得商榷的，但仍然有厂商在这样做。不过，趋势科技在这个问题上会坚持原则，哪怕客户向我们抱怨列出来的病毒不够多。

这是说谁呢？不用我说，大家都该明白。仁者见仁，智者见智吧。

原文地址：http://netsecurity.51cto.com/art/200707/51097.htm

于是去一中院的网站查了一下，结果傻眼。

是我搞错了？还是案子的资料还没输入系统？

看来咱们政府这次终于发彪了，同志们还是不要做病毒啦，更不要传播病毒……

不知道今天啥时候可以恢复，来这里发发牢骚

海色说，这样天天down，我们可以每天晚上回家看看电视，10点准时睡觉……

海色说，这个周末我们可以彻底休息一下了，估计是恢复不了的

同志们，不容易啊……但愿别再被攻击了。

要知道作个站容易吗？黑客同学们也要为我们想想啊

我们开始准备建立daily backup制度，同时再找个空间作我们的副站点，以备不时之需。

准备启用CISRT在BAIDU的临时空间，凑活凑活用用

趋势科技成立中国地区病毒中心（China Lab），China Pattern迅猛出击 网络安全软件及服务领域的全球领导者——趋势科技（纳斯达克代码：TMIC，东京证券交易所代码：4704）今日宣布，趋势科技中国区病毒中心（China Lab）近日在上海成立，同时宣布推出针对中国地区的病毒代码库（China pattern）在2007年伊始即展开全面的“扫毒行动”。趋势科技通过“主动”收集中国地区大量病毒样本，快速分析病毒样本，发布针对中国地区的特殊解决方案，该解决方案在包括全球病毒码的基础上，增加中国地区的本土病毒码，结合趋势科技的“清毒”技术DCE 5.0，以提高趋势科技防病毒产品针对中国地区用户的病毒查杀率。

正版专辑中还有一首隐藏的歌曲叫《恋爱疯》，是紧接在《我要的世界》后的，大概在5'15''左右的样子，轩迷们可别忽略咯^_^

Backdooring Images：http://www.gnucitizen.org/blog/backdooring-images

在列表里加入了首播主打歌《表白》，再来张照片

流氓软件是就此被终结，还是道高一尺、魔高一丈，让我们拭目以待，广大受流氓软件困扰的朋友们到是可以选择适合自己的一款工具来保护自己的电脑。

相关链接：

1. 金山毒霸系统清理专家（KSC）下载

2. 金山毒霸系统清理专家（KSC）专题首页

相关新闻：

1. 瑞星卡卡3.0雷霆出击　用反病毒技术铲除流氓软件

2. [技术详解]瑞星“碎甲(Anti-Rootkits)”技术说明

3. 瑞星卡卡上网安全助手3.0（下载）

详情可以访问这里：自动播放是做什么的？是用来“播放”病毒的

解决方案：【CISRT2006053】木马 大富翁.exe 趣味游戏.exe bug.exe 解决方案

我找了一下关于这个东西的资料，来自SecureWorks的Joe Stewart做了一份详尽的分析报告：SpamThru Trojan Analysis

CISRT也已经发布了相关的新闻：

http://www.cisrt.org/blog/read.php?137

http://www.cisrt.org/blog/read.php?138

查看了Kaspersky的库记录，从昨天开始，Kaspersky收到了数个变种，分别为：

Email-Worm.Win32.Warezov.dc Email-Worm.Win32.Warezov.dd Email-Worm.Win32.Warezov.de Email-Worm.Win32.Warezov.df Email-Worm.Win32.Warezov.dg Email-Worm.Win32.Warezov.dh Email-Worm.Win32.Warezov.di Email-Worm.Win32.Warezov.dj Email-Worm.Win32.Warezov.dk Email-Worm.Win32.Warezov.dl Email-Worm.Win32.Warezov.dm Email-Worm.Win32.Warezov.dn Email-Worm.Win32.Warezov.do Email-Worm.Win32.Warezov.dp Email-Worm.Win32.Warezov.dq

期待elva年末的新专辑

由于我电脑上没装杀毒软件、没打补丁，一系列的木马都到我电脑上了。我看了一下，真是有不少木马。有盗qq的，有盗传奇的等等。希望这位黑客朋友不要再这样做了，这样来炫耀自己的技术没任何意思。

我记录了一些木马的下载地址：

http://kkpic.net/ggg/adc/123.txt
http://222.220.16.185/data6/jwm.exe
http://222.220.16.185/data6/zt2.exe
http://222.220.16.185/data6/wol.exe
http://222.220.16.185/data6/mir.exe
http://222.220.16.185/data6/qqq.exe
http://222.220.16.185/data6/mhh.exe

还有一些特征：

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<DLMon><C:\WINNT\system32\DLMain.dll> []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><KB351677M.LOG>

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<9><C:\WINNT\system32\Ravdm.exe>  [Microsoft Corporation]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<rx><C:\WINNT\system32\explore.exe> []

最近在忙着一些私人的事情，所以上网时间比较少，一个星期后，我就可以抽更多的时间来更新博客。希望那时的KV07会更完善！！

这下可好，三家一起公测，这情况还是比较少见的，准备一起上市瓜分市场？

喜欢测试的同学可以都装一下：

1.毒霸07版公测：http://www.duba.net/zt/2007gc/index.shtml

2.瑞星07版公测：http://www.ikaka.com/2007/index.htm

3.江民07版公测：http://forum.jiangmin.com/kv2007/kv2007.htm

想想也该差不多是时候推出自己的新品了，否则今年两家的员工没奖金发了（纯属玩笑）。两家的新产品我都还没装，所以不能给予评价。但感觉自己现在已经失去对新软件的测试兴趣了，还是等正式版出来后，装正式版吧……

再问一句，装杀毒软件有用吗？不装杀毒软件一定会中毒吗？

总体感觉，新版Blog有向个人门户发展的趋势，吸取了各家Blog的风格，比先前老版本的花样更多了，噱头更足了，应该会吸收一些新的用户。

不管怎么说，我也搬到新系统上来了，呵呵，也算乔迁了一把，希望能够尽快适应新系统。

我也决定改变Blog原来的名称，从新开始Blog生活

有关这个东西的介绍可以看这：services.exe is virus?

原因有二：（1）因为和几个朋友一起搞了个CISRT的Blog，主要时间都在那边了 （2）因为要准备一场对本人来说非常重要的考试

基于以上两个原因，所以以后这里的反病毒资讯都会移往CISRT那边，而这边将会是记载一些我个人的东西。

另外还看到瑞星的一篇文章：众多新病毒向杀毒软件开战 抢夺网络游戏、QQ密码，瑞星的危险级别也提升为“危险 ”，大家小心！

吼吼，各位同学可千万别学他哦

原文地址：全国首例计算机病毒敲诈案告破 疑犯已被刑事拘留

被放木马的网址是http://www.vnetedu.com/down/count.js

This is Frequently Asked Questions document about new zero-day vulnerability in Microsoft PowerPoint. The document describes related malwares and e-mail attacks as well.

- Several updates done on 15th Jul and 17th Jul, 2006.
NOTE: Several Riler category Trojan descriptions included

Q: What is Microsoft PowerPoint 0-day vulnerability?
A: This previously unknown vulnerability is caused by an unknown error when processing malformed PowerPoint documents. The detailed characteristics is not publicly known, but the component being exploited is mso.dll (a shared Office library). Vulnerability was disclosed via malware descriptions informing new Trojan exploiting undocumented vulnerability in PowerPoint. This flaw has been used in several e-mail attacks against unknown organizations. Microsoft has confirmed these “very targeted” attacks.

Q: How does the vulnerability work?
A: The vulnerability is code execution type vulnerability. Attacker successfully exploiting this vulnerability can run code of his or hers choice in the affected machine. Executing arbitrary code is done with the recent privileges of logged user. It is known that keylogger and backdoor features are included to malwares exploiting this vulnerability. Additionally, vulnerability is caused due to memory corruption triggered by a specially drafted string in PowerPoint file.

Q: When this vulnerability was found?
A: The first malware description was published on Wednesday 12th July. Microsoft confirmed the existence of vulnerability on 13th July and officially in MSRC Blog on 14th July. There is information about samples received by one AV vendor on 11th July already.

Q: Is this one of the critical vulnerabilities reported on 11th July with MS July Security Bulletins?
A: No. This is new, unpatched vulnerability. Vulnerabilities fixed in MS06-038 etc. are different issues.

Q: Which Windows versions are affected?
A: Microsoft PowerPoint installations used in Windows 95, Windows 98, Windows Me, Windows NT, Windows 2000, Windows XP and Windows 2003 Server systems are reportedly affected.

Q: What PowerPoint versions are affected?
A: According to Microsoft Security Advisory #922970 PowerPoint versions 2003, 2002 and 2000 are affected. Several vendors list Office 2000, Office XP (2002) and Office 2003 as affected too.
Three PoCs posted to public mailing list have been tested against PowerPoint version 2003.

Q: Is PowerPoint Viewer utility affected too?
A: UPDATE: No. Microsoft lists PowerPoint Viewer 2003 as immune on its Security Advisory #922970

Q: Is Microsoft Works Suite affected too?
A: At time of writing there is no official information about this yet.

Q: Is Microsoft PowerPoint for Mac affected in this vulnerability?
A: There is no official information about this. US-CERT lists Mac versions affected too.

Q: I am using non-English version of PowerPoint 2003. Am I affected?
A: As of 17th July it is impossible to say. Exact information about affected language versions is not available yet.

Q: Where are the official Microsoft documents related to this case located?
A: Documents published by Microsoft are located at Microsoft Security Response Center (MSRC) Blog site. The address of this site is blogs.technet.com/msrc/default.aspx. UPDATE: Security advisory was published at Microsoft Security Advisories section of Microsoft TechNet Security site, www.microsoft.com/technet/security/advisory/default.mspx.

Q: How can I protect from this vulnerability?
A: The best advice is to use anti-virus software protecting from this specific malware and check that virus signature files are up-to-date.

Q: Is the exploit code of this vulnerability publicly released?
A: UPDATE: Yes. Three separate Proof-of-Concept has been posted to public, non-moderated and moderated security mailing lists on 15th July. These PoCs has been tested against PowerPoint version 2003. However, it is reported that these PoCs demonstrate new, different vulnerabilities.

Q: Does this mean that there are several, unpatched vulnerabilities in PowerPoint?
A: According to the newest information answer is yes.
PoCs introduce the following three vulnerabilities:
#1 memory corruption - CVE-2006-3656
#2 mso.dll - CVE-2006-3655
#3 powerpnt.exe CVE-2006-3660

PoC exploits mentioned reportedly affect a Denial of Service state or enable code execution, but code execution is not confirmed yet. It is worth of mentioning that exploitation in CVE-2006-3656 triggers when a PowerPoint document is closed.
UPDATE: Separate CVE names assigned to these vulnerabilities are the following:
CVE-2006-3656
CVE-2006-3655
CVE-2006-3660

Q: Is these separate malwares related to these three new disclosures yet?
A: No. This is the situation on 18th July, 2006.

Q: Is there PoC-type sample file of this vulnerability publicly available?
A: No.

Q: Is it safe to open any .PPT files any more?
A: It is very important not to open PowerPoint files from unknown sources. However, files from familiar sources can cause an infection too if a spoofed e-mail is being used.

Q: Are there any visual effects informing about the infection?
A: Yes. The title page (dia) shows Chinese characters when a malicious PowerPoint document is opened. Screenshot of the first page is included to Sophos document related to this vulnerability (see related item later). The background colour in PowerPoint presentation used is black and the text colour is white, in turn.

Q: Are there any changes to file system made by related Trojan malware?
A: Yes. Files rtfmsv.exe and regvrt.exe are being copied to the Windows System folder when the malicious .PPT attachment is opened.

Q: What are the Registry keys used?
A: Modifications are done under HKCU\Software\SKavx\ and HKEY_LOCAL_MACHINE\Software\SKavx.

Q: Are there any special features included to the way how this new Trojan works?
A: Yes. It can inject itself to Explorer process.

Q: What are the names of malwares exploiting this vulnerability?
A: Reportedly there is one Trojan and one dropper component for this malware. The following names are used:

Backdoor.Bifrose.F [Trojan]
Trojan.PPDropper.B [dropper]

BKDR_BIFROSE.DS [Trojan]
TROJ_MDROPPER.AS [dropper]

BackDoor-CEP [Trojan]
Exploit-PPT.b [exploit]

Troj/Edepol-C [Trojan]

Bifrose.UZ [Trojan]

Backdoor.Win32.Bifrose.uz [Trojan]

Backdoor:Win32/Bifrose!E029 [Trojan]

W32/Bifrose.UZ [Trojan]

The list is very coverage. There are some W32/Bifrose based names in use too.

——-
NOTE: The following names assigned on 17th July or later:

Trojan.Riler.F [Trojan]
Trojan.PPDropper.C. [dropper]

TROJ_RILER.B [Trojan]
TROJ_MDROPPER.AK [dropper]

Win32.Fantador.E [Trojan]

Win32/Fantador.E!Backdoor [Trojan]

This new category uses different techniques, e.g. Layered Service Provider (LSP), see
en.wikipedia.org/wiki/Layered_Service_Provider
and
www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_RILER.B

Q: My AV vendor doesn’t list these names at their Web pages. How do I know my AV software protects me?
A: It’s possible that anti-virus software has protection to this threat, but malware database at their Web page doesn’t include specific write-up yet because of beginning weekend, holiday season etc. The best way is to check the situation from your AV vendor.

Q: Is there Internet Storm Center documents available about the issue?
A: Yes. Internet Storm Center (ISC) has been released the following Diary entry: isc.sans.org/diary.php?storyid=1484

Q: Is there CME name to this related malware available?
A: No. The Common Malware Enumeration (CME) project has not assigned an identifier to this malware.

Q: Does Windows Live Safety Center detect this malware?
A: UPDATE: Yes. According to new MSRC Blog posting there is detection added to Windows Live Safety Center (in Beta phase) now.

Q: What is the file attachment name used in attacks mentioned?
A: Name including Chinese characters was used. The attackers can use other names in the future too, because the information about the format of the name used is publicly known.

Q: Is there information about file size used?
A: UPDATE: Yes. The size of the PowerPoint file is 220,160 bytes. Additionally, the .PPT file includes 18 slides.

Q: What is the sender address in use?
A: Reportedly gmail.com addresses has been used.

Q: Are the names of the recipients shown in message including malicious PowerPoint attachment?
A: No. Only name ‘Undisclosed-Recipient:;’ used widely in phishing e-mails etc. was used.

Q: What is the Subject line of e-mails sent in attacks mentioned?
A: Chinese characters has been used.

Q: What is the contents of the PowerPoint presentation?
A: Sophos has a short translation of two first pages located at
www.sophos.com/pressoffice/news/articles/2006/07/chinesewords.html

Q: Is any user interaction needed when opening malicious PowerPoint file?
A: No. Opening a malformed PowerPoint file triggers a vulnerability.

Q: Is it safe to open PowerPoint presentations coming from trusted, known sender during next days?
A: The answer is yes and no. If your anti-virus software is updated it will protect you. If you want protection of one hundred percent you can save presentations first and scan them with your AV software.
These days you can’t trust that the sender information included to message PowerPoint file attached is truthful. If You are not sure, You can always call to the sender if e-mail including .PPT attachments arrives unexpectedly.
Additionally, it is possible to include malicious Microsoft Power Point files as embedded files to Microsoft Word files, or Microsoft Excel files.

Q: Is it possible that malicious PowerPoint files (.PPT file extension etc.) are located at Web pages too?
A: Yes. It is possible that attacker can locate malformed PowerPoint files to Web pages too.

Q: Does the filtering PowerPoint documents at network perimeter protect me?
A: No. Normally Windows will open files with file header information, i.e. filtering by extension is not the way you can trust.

Q: When the fix to this vulnerability is expected?
A: It is impossible to say. Normally Microsoft security advisory includes information about the fixing timeline of unpatched vulnerabilities. The next monthly security updates are scheduled to 8th August, 2006.

Q: Is there CVE name available to this vulnerability?
A: Yes, CVE name CVE-2006-3590 was assigned on 14th July. Link to the CVE document is cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3590.

Q: Is there rootkit techniques included to malwares exploiting this vulnerability?
A: At time of writing there is no information about rootkit functionality included.

Q: Is there other payload than backdoor and keylogging functionality included to Trojan malware?
A: Yes. Reportedly this Trojan horse may attempt to disable AV (anti-virus) software. Additionally, it sends system information to the remote Web site. This can help attacker in future attacks.

Q: Is there information about the origin of related malware authors?
A: No. It is known that some of the target Web sites used in attacks mentioned are located in China, in Hong Kong and Jiangsu area. Additionally, some target sites are located in the USA.

Q: What is the TCP/IP port used in related attacks?
A: There are several, random TCP/IP ports in use.

(c) Juha-Matti Laurio, Finland (UTC +3hrs)

-UPDATE-: MSRC Blog posting states Microsoft has activated their security response process and they have added detection to the Windows Live Safety Center.

Revision History:
1.0 14-07-2006 Initial release
1.1 14-07-2006 Added information about Registry keys used
1.2 14-07-2006 Added Trojan descriptions and information about translation of PPT file contents
1.3 14-07-2006 Added CVE name. Some minor updates.
1.4 15-07-2006 Added information about Windows Live Safety Center protection and PoCs posted to public mailing list
1.5 15-07-2006 Several updates and fixes, added new items
1.6 16-07-2006 Added new item to clarify the existence of multiple vulnerabilities, minor updates
1.7 17-07-2006 Added information about TCP/IP ports used in attacks and more technical information about Trojan. Added CVE names of three separate issues reported by ‘naveed’. Added new item about affected language versions, minor updates and fixes
1.8 18-07-2006 Added information from published Microsoft Security Advisory, added new type of Trojans and droppers. Added new item related to malwares exploiting three separate 0-day vulnerabilties, so-called ‘naveed issues’.
1.9 20-07-2006 Added new Riler category Trojan description, added more Fantador based Trojan names

呵呵，又到了“七夕”，而且今年有两个“七夕”，利用第一个“七夕”的木马已经出现了，看看到第二个“七夕”会有什么新的变化。

木马的样子

这支木马通过俄罗斯总统普京已死消息的垃圾邮件进行传播，邮件为html形式，夹杂了ADODB.Stream漏洞， 当用户浏览此邮件时，就会自动下载这个木马下载器。同时邮件里的链接地址也假冒BBC的链接地址，其实是指向一个俄罗斯的网站。

引用一下Sophos关于这封垃圾邮件的图片：

木马通过邮件进行传播，以扩展名为.ppt的附件到达用户邮箱。当用户打开这支含有漏洞的ppt文档后，会释放%System%\regvrt.exe，这是Backdoor.Bifrose.E变种。然后注入EXPLORER.EXE进程，释放一个没有漏洞的ppt文档来覆盖有漏洞的文档。

同时会显示一段话：“什么叫浪漫？明知那个女孩儿不爱他，还送给她999朵玫瑰；什么叫浪费？明知那个女孩儿爱他，还送给她999朵玫瑰”，如图：（图片来自Symantec）

这次发布的补丁包括：

MS06-033：ASP.NET 中的漏洞可能允许信息泄露 (917283)

MS06-034：使用 Active Server Pages 的 Microsoft Internet 信息服务中的漏洞可能允许远程执行代码 (917537)

MS06-035：Server 服务中的漏洞可能允许远程执行代码 (917159)

MS06-036：DHCP Client 服务中的漏洞可能允许远程执行代码 (914388)

MS06-037：Microsoft Excel 中的漏洞可能允许远程执行代码 (917285)

MS06-038：Microsoft Office 中的漏洞可能允许远程执行代码 (915384)

MS06-039：Microsoft Office 中的漏洞可能允许远程执行代码 (915384) 

被放木马的网页是一个叫“雪花啤酒一号通缉令”的网页，如图：

在打开图中红框所指的网页后，会打开另外个恶意网址，如下图：

这个恶意网址会打开一个脚本h**p://bcwr1.3322.org/css/1/sp2.asp

该脚本会下载h**p://bcwr1.3322.org/css/1/wsxedc.jpg，这个文件其实是一个exe的文件，大小66,381 字节，NSPack加壳，AVP检测为Trojan-PSW.Win32.QQPass.fq，Trojan.PSW.Liumazi.fd（瑞星）。

同时下载h**p://bcwr1.3322.org/css/1/edcx.gif，是个脚本文件，大小2,588 字节，是用来运行wsxedc.jpg的。

还会打开h**p://bcwr1.3322.org/css/1/index.htm，下载：h**p://bcwr1.3322.org/css/1/upx.gif，这是个chm文档，大小39,280 字节，释放schove.exe，UPX加壳，大小31,232 字节，是个盗游戏帐号的木马，目前Kaspersky、瑞星等都不能查杀。

2006.7.11 11:55更新：

AVP最新的库已经可以查杀，命名为Trojan-Spy.Win32.Agent.nf

瑞星18.35.10版本可以查杀Trojan.PSW.Agent.adw

据CISRT监测，雪花啤酒的网站和多家大型网站均有合作，新浪的主页上也存在该网站的链接，详情可访问CISRT论坛：搜狐上之网页含有盗号木马，浏览时务必小心

Jalabed.B，大小77312字节，病毒邮件形式如下：

主题:
Im the winner of 2 FIFA tickets

正文:
You wont believe it but im the winner of 2 tickets for FIFA 2006 in Germany,if you want a ticket read attackment ;)

附件:
FIFA 2006 Ticket.doc.exe

当用户运行病毒后，会生成

%Windows%\kh4l3d.txt
%Windows%\arabic.exe
%Windows%\usefull.txt.exe
%Windows%\FIFA 2006 Ticket.doc.exe
%Windows%\mail.vbs

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run
"4r4bic h4x0r" = "%Windir%\arabic.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
"4r4bic h4x0r" = "%Windir%\arabic.exe"

蠕虫还能通过IRC传播，向IRC频道里的用户发送名为usefull.txt.exe；同时还会通过Kazaa进行传播

Datarescue IDA PRO是全球广大反病毒工程师在分析病毒时所用到的一款常用工具，这次出现的Gattman-A病毒将目标指向了IDA，似乎是想通过反病毒工程师来进行传播。

Gattman-A感染.IDC脚本文件，而.IDC脚本文件可以被IDA打开。

以下是反病毒公司的一些报道：

1. Sophos: W32/Gattman-A

2. Trend Micro: PE_GATTMAN.A-O

在“淘宝百万格子”网站的尾部被人植入了一个恶意网址，如图：

同时在其主页代码里也发现了大量的色情词语。sms.htm会同时打开
h**p://www.ads173.com/shipin/index.htm
h**p://www.ads173.com/shipin/count.asp

index.htm网页会根据系统的版本分别打开
h**p://www.ads173.com/shipin/w98.htm
h**p://www.ads173.com/shipin/winnt.htm
这两个网址分别会下载h**p://www.ads173.com/shipin/haha.ico和h**p://www.ads173.com/shipin/logo.gif。haha.ico，大小30,839 字节，FSG2.0加壳，是个比较新的盗号木马。

count.asp会下载h**p://www.ads173.com/shipin/ray.exe，30,839 字节，FSG2.0加壳，同haha.ico，同时修改注册表
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools","REG_DWORD" = "0"
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200","REG_DWORD" = "0"
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1004","REG_DWORD" = "0"

2006.7.7 21:40更新：

AVP最新的库可以查了Trojan-PSW.Win32.QQPass.io

被放木马的网址，如图：

ad.htm会打开以下三个网页：

h**p://mm.47555.com/count.html
h**p://mm.47555.com/winnt.htm
h**p://mm.47555.com/w98.htm

count.html是个chm文档，大小19,062 字节，释放QQ.EXE。QQ.EXE，大小11,208 字节，NSPack加壳，MD5值为f04973fb8267827f347594b373732290，AVP报为Trojan-Downloader.Win32.Agent.ue

winnt.htm会下载并运行
h**p://mm.47555.com/logo.gif
h**p://mm.47555.com/logo.ico（同QQ.EXE）

w98.htm打开h**p://mm.47555.com/count.html

同“比特论坛”被放木马上的木马

根据目前小陌收集到的信息来看，由于其是通过AOL即时聊天软件进行传播，因此主要的感染对象还是国外用户，已经收到一些国外用户感染这支蠕虫的报告，相信对国内用户的影响还是比较小的。下面简单介绍一下关于这支蠕虫的信息：

Backdoor.Win32.IRCBot.st，大小在7K左右，通过AOL向列表中的好友发送名为“wgavn.exe”的文件，当用户打开这个文件后，会在系统中生成

\%system32%\wgavn.exe
\%Windows%\Debug\dcpromo.log

在服务中添加

服务名称: wgavn
显示名称: Windows Genuine Advantage Validation Notification
可执行文件的路径: \%system32%\wgavn.exe
启动类型: 自动

添加、修改注册表：

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wgavn
DisplayName = "Windows Genuine Advantage Validation Notification

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify = "dword:00000001"
AntiVirusDisableNotify = "dword:00000001"
FirewallDisableNotify = "dword:00000001"
AntiVirusOverride = "dword:00000001"
FirewallOverride = "dword:00000001"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall = "dword:00000000"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall = "dword:00000000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
AutoShareWks = "dword:00000000"
AutoShareServer = "dword:00000000"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
EnableDCOM = "N"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous = "dword:00000001"

反病毒厂商的命名：

1. Trend Micro: BKDR_IRCBOT.DB

2. Sophos: W32/Cuebot-K

3. Nod32: Win32/IRCBot.OO

4. Symantec: W32.Esbot.E

文件名为Portugal.vbs，大小1,937字节，是个脚本，AVP命名为IRC-Worm.VBS.Generic，瑞星命名为VBS.I-Worm.Lee-Based

具有以下行为特征：

1. 通过MAPI自动发送邮件，邮件形式：

主题： "葡萄牙赢啦！！"
正文： "葡萄牙赢啦！！葡萄牙赢啦！！"
附件：Portugal.vbs

2. 添加注册表：
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page,"h**p://www.mumayi.net"
HKCU\Software\Microsoft\Internet Explorer\Main\Window Title, ""
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Portugal,"C:\WINDOWS\Portugal.vbs"
HKCU\software\Worm\Mirqued", "1"

还会通过mirc，发送Portugal.vbs

AVP和瑞星都是广谱的命名，呵呵，我个人也做了个命名，就叫IRC-Worm.VBS.Mirqued.a吧

该网站上被人植入了一个恶意网址，如图：

sina.htm会根据系统版本来打开不同网页

98版本的会打开h**p://sina109.3322.org/sina/w98.htm，该网页上含有两个文件

h**p://sina109.3322.org/sina/young.css
h**p://sina109.3322.org/sina/young.gif

young.css其实是个exe文件，大小512 字节，PE_Patch加壳，是个木马下载器，AVP报为Trojan-Downloader.Win32.Tiny.cj，会从远程下载灰鸽子：h**p://sina109.3322.org/sina/sina.exe，大小303,104字节，AVP命名为Backdoor.Win32.GrayBird.jj，瑞星命名为Backdoor.Gpigeon.xiy

nt版本的会打开h**p://sina109.3322.org/sina/winnt.htm，该网页上含有两个文件

h**p://sina109.3322.org/sina/young.css
h**p://sina109.3322.org/sina/young.gif（同上）