[情報] BZ官方警告有新的木馬程式

[deathson (小米)]

原始連結: http://us.battle.net/wow/en/forum/topic/11041384892

這次比較棘手的是這連用了驗證器的帳號也會中招
這個木馬似乎會及時攔截帳號資訊及驗證碼並且回傳

推文裡面有提到如何找到木馬.

BZ官方現在還不知道哪些防毒程式有能力處理這東西.

如果有中的話, 請將下列資訊傳給BZ
MSInfo
所使用的Addon(UI)
最近所安裝的程式以及其取得來源
任何防護程式跑出來的結果

-=-=

Hello,

We've been receiving reports regarding a dangerous Trojan that is being used
to compromise player's accounts even if they are using an authenticator for
protection. The Trojan acts in real time to do this by stealing both your
account information and the authenticator password at the time you enter them.

If your account has been compromised recently, I'd recommend looking for the
Trojan. It can be identified by creating an MSInfo file and then looking in
the Startup Program section of that file for either "Disker" or "Disker64".
It will usually appear like this:

Disker rundll32.exe c:\users\name\appdata\local\temp\w_win.dll,dw
Name-PC\Name Startup
Disker64 rundll32.exe c:\users\name\appdata\local\temp\w_64.dll,dw
Name-PC\Name Startup

We are currently looking for more information on the Trojan. We have not been
able to locate any anti-virus programs that will remove it besides just
reformatting your system. If you have been recently compromised and find it
on your system please reply with the following pieces of information.

Your MSInfo.
A list of any addons you recently installed along with where you got them.
A list of any programs you recently installed along with where you got them.
Any security programs you have run and their results.

-=-=

追加資訊

While this is not conclusive, every occurence I've examined has been a new or
recently reformatted system that was hit shortly after downloading addons.
There have been no other hardware or software commonalities that can be seen
in an MSInfo. Due to these observations, something related to addons or the
aquiring of addons leads our suspect list. Again though, not conclusive.

Also, I just received a report that an updated Malwarebytes might have
removed the infection, but this is unconfirmed. We're trying to get removal
logs from the player to examine.

--
再追加資訊

哪些防毒可以掃到
http://us.battle.net/wow/en/forum/topic/11041384892?page=6

You can see all the antiviruses which detect it already here:

https://www.virustotal.com/en/file/850dc3ebb2437edaf3352eee79ee704cdb881779684c2128f1f07d8dd79c0344/analysis/1388723212/

This includes Ad-aware, BitDefender, F-Secure, Ikarus, Mcafee, Panda,
Symantec/Norton, TrendMicro-HouseCall & VIPRE.

These don't pick it up yet, but I've submitted the trojan to them:
AVG, Avast, ClamAV, Comodo, DrWeb, ESET/NOD32, F-Pro, Kaspersky,
Malwarebytes, MSE, Norman, SuperAntiSpyware, Sophos, TrendMicro, nProtect.
--
這次的資訊比較嚴肅所以不塞簽名檔了...
--
※ 發信站: 批踢踢實業坊(ptt.cc)
◆ From: 71.131.178.96
※ deathson:轉錄至看板 C_Chat                                      01/03 12:11
※ 編輯: deathson        來自: 71.131.178.96        (01/03 12:34)
推 Fron:萌米
推 raistlin1424:我以經被盜到afk了....
推 smsd:他不是叫你去找這兩個檔案
→ smsd:應該是說你要先創造一個MSInfo文字檔
→ smsd:建立方式是去開始功能表那邊搜尋一個MSinfo32的程式
→ smsd:打開以後去檔案->匯出然後存在隨便一個地方
→ smsd:這樣會創造一個文字檔, 把它打開以後
→ smsd:在裡面有個[啟動程式]那個欄位裡面找看看有沒有上面那兩排
→ smsd:有的話就是中了木馬
已修正 多謝
※ 編輯: deathson        來自: 71.131.178.96        (01/03 13:20)
推 zooxalju:Avira完全被無視了????
推 maple0935:那兩排是disker那兩排嗎?
推 eDrifter:推一個; 還好沒中
推 lcilear:開始那邊搜尋不到MSinfo32怎麼辦?  求解!!
→ asalfex:開始->執行
推 aabbabcd:其實不用另外匯出檔案來看.直接執行MSINFO32這個程式
→ aabbabcd:然後再裡面搜尋列出來的那兩個執行檔就OK了
推 quadra:mac玩家無感
推 KELTHUZAD:請問MAC玩家怎麼用RC？
推 dogee:開個模擬的WINDOWS  有XP跟WIN7的樣子...
推 berryc:以後輸入驗證碼要等他快跑完最後1秒KEY進去才是最安全= =
推 omolando:就算消失 驗算上似乎有些延遲 即使換了下一組 上一組幾
推 wildbloodcat:我的是 comodo 阿阿阿阿
→ omolando:秒內輸入正確的話 也可以通過認證 (自身實驗過)
推 Galm:只有這時候會覺得有通訊鎖真好