※ [本文转录自 Browsers 看板] 作者: raphael0612 (翔) 看板: Browsers 标题: Re: [-Fx-] 二个套件被发现有木马程式 时间: Sat Feb 6 23:57:47 2010 其中一个是硕思的产品 Sothink Web Video Downloader，目前在它公司网页上 还有这产品，Latest Version:5.7，File Size:2.68 MB Release Date:Jan 27th, 2010。 http://www.sothinkmedia.com/web-video-downloader-firefox/index.htm 台湾有很多学校学生不管是买的或是私下来源，采用这公司的另一个产品 Sothink SWF Decompiler 硕思闪客精灵，许多网站有在卖，但这次出问题的产品 在公司网页显示是Free且是GNU License http://www.softking.com.tw/soft/clickcount.asp?fid3=25314 http://www.softking.com.tw/soft/clickcount.asp?fid3=14683 先前采用硕思闪客精灵来解析Swf 档，就常常会发生防毒软体警告有木马，特别 有经过对岸加工过的中文化版本最常有木马警报，且一直以来就有传闻会偷装後 门。 虽然在Mozilla 显示版本大於4.0可能未含木马，但是无法完全确保没问题， 有人就批判怎会让有问题的Experimental add-on上传到Mozilla 网站？且 硕思自家在同一时间就已经更新到5.7版次，是否明知有木马而没告知并从 Mozilla 网站移除？ 就公告内容来看，显示有人知道Mozilla对於Add-on扫瞄防范措施细节从而 能特制能闪躲侦测的木马。 目前公告能扫出木马的有Antiy-AVL、Avast、SVG、GData、Ikarus、 K7AntiVirus、McAfee、Norman、VBA32 等几家防毒软体。其中McAfee有提 供免费线上扫毒服务，有装过木马Add-on 的就自己清清毒吧﹙最好是用别 种Browser 来执行﹚，手中有防毒软体公司特制的Rescue CD就更好拿来光 碟开机扫毒 。 http://home.mcafee.com/Downloads/FreeScan.aspxAntiy-AVL 其他额外的免费线上扫毒服务 http://www.avast.com/eng/down_cleaner.html http://www.eset.com/onlinescan/ http://support.f-secure.com/enu/home/ols.shtml http://www.kaspersky.com/virusscanner http://kaspersky.kl.edu.tw/webscan/kavwebscan.html http://tw.trendmicro.com/tw/products/personal/house-call/ http://onecare.live.com/site/zh-tw/default.htm http://www.bitdefender.com/scanner/online/free.html Issue Two experimental add-ons, Version 4.0 of Sothink Web Video Downloader and all versions of Master Filer were found to contain Trojan code aimed at Windows users. Version 4.0 of Sothink Web Video Downloader contained Win32.LdPinch.gen, and Master Filer contained Win32.Bifrose.32.Bifrose Trojan. Both add-ons have been disabled on AMO. Impact to users If a user installs one of these infected add-ons, the trojan would be executed when Firefox starts and the host computer would be infected by the trojan. Uninstalling these add-ons does not remove the trojan from a user’s system. Users with either of these add-ons should uninstall them immediately. Since uninstalling these extensions does not remove the trojan from a user’s system, an antivirus program should be used to scan and remove any infections. Status This vulnerability is known to affect Firefox on Windows only, if either Master Filer or Version 4.0 of Sothink Web Video Downloader are installed. Versions of Sothink Web Video Downloader greater than 4.0 are not infected. Master Filer was downloaded approximately 600 times between September 2009 and January 2010. Version 4.0 of Sothink Web Video Downloader was downloaded approximately 4,000 times between February 2008 and May 2008. Master Filer was removed from AMO on January 25, 2010 and Version 4.0 of Sothink Web Video Downloader was removed from AMO on February 2, 2010. AMO performs a malware check on all add-ons uploaded to the site, and blocks add-ons that are detected as such. This scanning tool failed to detect the Trojan in Master Filer. Two additional malware detection tools have been added to the validation chain and all add-ons were rescanned, which revealed the additional Trojan in Version 4.0 of Sothink Web Video Downloader. No other instances of malware have been discovered. ※ 引述《geniusgia ()》之铭言： : Mozilla blog公告发现以下两个套件被发现有木马程式,并说明uninstall不会 : 移除木马,还要用防毒软体来扫 : 1. Sothink Web Video Downloader[Version 4.0] : 2. Master Filer[All version] : 详情请看: : http://blog.mozilla.com/addons/2010/02/04/please-read-security-issue-on-amo/ --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 123.204.131.97 -- The Sword of Truth series written- by Terry GoodKind --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 124.11.143.246