那些遇到过的问题

如何在 Linux 中识别包含 Chrome 扩展程序的恶意软件？

ter*_*don 21 linux google-chrome malware

我好像被恶意软件感染了。具体来说，时不时（通常每隔几天）我会被重定向到一个页面，要求我下载一些东西，通常是“新版本的 Flash”。据推测，它不是那种类型，但实际上是某种病毒或木马。

我google-chrome在 Debian Linux 上使用版本 30.0.1599.114，我很确定这是由扩展引起的。我知道我可以简单地卸载我的扩展程序或删除我的~/.config/google-chrome文件夹，但我宁愿不这样做。我想确定导致此问题的扩展名并仅删除该扩展名。

在尝试调试这个（感谢@Braiam）时，我检查了事件记录器chrome://net-internals/#events并搜索了我被重定向到的 URL 之一：

Chrome 事件记录器的屏幕截图

内容如下chrome://net-internals/#events：

122667: URL_REQUEST
http://cdn.adnxs.com/p/d9/32/a3/72/d932a372371bd0a47ba7e2a73649a8d0.swf?clickTag=http%3A%2F%2Ffra1.ib.adnxs.com%2Fclick%3FSRPvAE9aoD_c-TxO6i6ZP-kmMQisHO4_3Pk8TuoumT9JE-8AT1qgP3vmRkLiiPF6ljpJTzhxcH-5rRRTAAAAABwgIwByBwAAPwEAAAIAAADRAMMAVqgFAAAAAQBVU0QAVVNEANgCWgDHsgAAFIsAAQUCAQIAAIwAeiTtsAAAAAA.%2Fcnd%3D%2521NgbzOgjzkMEBENGBjAYY1tAWIAA.%2Freferrer%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fif%253Fenc%253DgbdAguLHaD8eqb7zixJkP_LSTWIQWOk_Hqm-84sSZD-At0CC4sdoP2mCZbZYUNUFljpJTzhxcH-3rRRTAAAAAJL-IgB2AgAAUAMAAAIAAAA9ocQAN0sEAAAAAQBVU0QAVVNEANgCWgD8ogAA58sAAgUCAQIAAIwA9idtvAAAAAA.%2Fclickenc%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fclick%253FXkiHhzB-Wj-D_TJz3IRWP3E9CtejcNU_g_0yc9yEVj9eSIeHMH5aP_ygL0YyHDQoljpJTzhxcH-2rRRTAAAAAEJLIQBJAQAAVwMAAAIAAACL0cUA0WAFAAAAAQBVU0QAVVNEANgCWgDQMgAAUdQDAQUCAQIAAIwA3yN4YgAAAAA.%252Fcnd%253D%25218gXSNwiT18QBEIujlwYY0cEVIAA.%252Freferrer%253Dhttp%253A%252F%252Fwww.imgclck.com%252Fserve%252Fimgclck.php%252Fclickenc%253Dhttp%253A%252F%252Foptimized-by.rubiconproject.com%252Ft%252F9164%252F15602%252F101258-2.3581666.3755480%253Furl%253Dhttp%25253A%25252F%25252Fwww.downloadchop.com%25252Fgo%25252Flightspark%25253Fsource%25253Dybrant_lightspark-fr%252526adprovider%25253Dybrant%252526ce_cid%25253Dfra1CJb1pPqEp5y4fxACGPvMm5KknOL4eiINODIuMjI5LjIyLjE2NigBMLnb0pgF%252526subid%25253D2301980
Start Time: 2014-03-03 17:28:41.358

t=1393864121358 [st=  0] +REQUEST_ALIVE  [dt=334]
t=1393864121359 [st=  1]   +URL_REQUEST_START_JOB  [dt=332]
                            --> load_flags = 134349184 (ENABLE_LOAD_TIMING | ENABLE_UPLOAD_PROGRESS | MAYBE_USER_GESTURE | VERIFY_EV_CERT)
                            --> method = "GET"
                            --> priority = 2
                            --> url = "http://cdn.adnxs.com/p/d9/32/a3/72/d932a372371bd0a47ba7e2a73649a8d0.swf?clickTag=http%3A%2F%2Ffra1.ib.adnxs.com%2Fclick%3FSRPvAE9aoD_c-TxO6i6ZP-kmMQisHO4_3Pk8TuoumT9JE-8AT1qgP3vmRkLiiPF6ljpJTzhxcH-5rRRTAAAAABwgIwByBwAAPwEAAAIAAADRAMMAVqgFAAAAAQBVU0QAVVNEANgCWgDHsgAAFIsAAQUCAQIAAIwAeiTtsAAAAAA.%2Fcnd%3D%2521NgbzOgjzkMEBENGBjAYY1tAWIAA.%2Freferrer%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fif%253Fenc%253DgbdAguLHaD8eqb7zixJkP_LSTWIQWOk_Hqm-84sSZD-At0CC4sdoP2mCZbZYUNUFljpJTzhxcH-3rRRTAAAAAJL-IgB2AgAAUAMAAAIAAAA9ocQAN0sEAAAAAQBVU0QAVVNEANgCWgD8ogAA58sAAgUCAQIAAIwA9idtvAAAAAA.%2Fclickenc%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fclick%253FXkiHhzB-Wj-D_TJz3IRWP3E9CtejcNU_g_0yc9yEVj9eSIeHMH5aP_ygL0YyHDQoljpJTzhxcH-2rRRTAAAAAEJLIQBJAQAAVwMAAAIAAACL0cUA0WAFAAAAAQBVU0QAVVNEANgCWgDQMgAAUdQDAQUCAQIAAIwA3yN4YgAAAAA.%252Fcnd%253D%25218gXSNwiT18QBEIujlwYY0cEVIAA.%252Freferrer%253Dhttp%253A%252F%252Fwww.imgclck.com%252Fserve%252Fimgclck.php%252Fclickenc%253Dhttp%253A%252F%252Foptimized-by.rubiconproject.com%252Ft%252F9164%252F15602%252F101258-2.3581666.3755480%253Furl%253Dhttp%25253A%25252F%25252Fwww.downloadchop.com%25252Fgo%25252Flightspark%25253Fsource%25253Dybrant_lightspark-fr%252526adprovider%25253Dybrant%252526ce_cid%25253Dfra1CJb1pPqEp5y4fxACGPvMm5KknOL4eiINODIuMjI5LjIyLjE2NigBMLnb0pgF%252526subid%25253D2301980"
t=1393864121359 [st=  1]      HTTP_CACHE_GET_BACKEND  [dt=0]
t=1393864121359 [st=  1]      HTTP_CACHE_OPEN_ENTRY  [dt=0]
                              --> net_error = -2 (ERR_FAILED)
t=1393864121359 [st=  1]      HTTP_CACHE_CREATE_ENTRY  [dt=0]
t=1393864121359 [st=  1]      HTTP_CACHE_ADD_TO_ENTRY  [dt=0]
t=1393864121359 [st=  1]     +HTTP_STREAM_REQUEST  [dt=1]
t=1393864121360 [st=  2]        HTTP_STREAM_REQUEST_BOUND_TO_JOB
                                --> source_dependency = 122670 (HTTP_STREAM_JOB)
t=1393864121360 [st=  2]     -HTTP_STREAM_REQUEST
t=1393864121360 [st=  2]     +HTTP_TRANSACTION_SEND_REQUEST  [dt=0]
t=1393864121360 [st=  2]        HTTP_TRANSACTION_SEND_REQUEST_HEADERS
                                --> GET /p/d9/32/a3/72/d932a372371bd0a47ba7e2a73649a8d0.swf?clickTag=http%3A%2F%2Ffra1.ib.adnxs.com%2Fclick%3FSRPvAE9aoD_c-TxO6i6ZP-kmMQisHO4_3Pk8TuoumT9JE-8AT1qgP3vmRkLiiPF6ljpJTzhxcH-5rRRTAAAAABwgIwByBwAAPwEAAAIAAADRAMMAVqgFAAAAAQBVU0QAVVNEANgCWgDHsgAAFIsAAQUCAQIAAIwAeiTtsAAAAAA.%2Fcnd%3D%2521NgbzOgjzkMEBENGBjAYY1tAWIAA.%2Freferrer%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fif%253Fenc%253DgbdAguLHaD8eqb7zixJkP_LSTWIQWOk_Hqm-84sSZD-At0CC4sdoP2mCZbZYUNUFljpJTzhxcH-3rRRTAAAAAJL-IgB2AgAAUAMAAAIAAAA9ocQAN0sEAAAAAQBVU0QAVVNEANgCWgD8ogAA58sAAgUCAQIAAIwA9idtvAAAAAA.%2Fclickenc%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fclick%253FXkiHhzB-Wj-D_TJz3IRWP3E9CtejcNU_g_0yc9yEVj9eSIeHMH5aP_ygL0YyHDQoljpJTzhxcH-2rRRTAAAAAEJLIQBJAQAAVwMAAAIAAACL0cUA0WAFAAAAAQBVU0QAVVNEANgCWgDQMgAAUdQDAQUCAQIAAIwA3yN4YgAAAAA.%252Fcnd%253D%25218gXSNwiT18QBEIujlwYY0cEVIAA.%252Freferrer%253Dhttp%253A%252F%252Fwww.imgclck.com%252Fserve%252Fimgclck.php%252Fclickenc%253Dhttp%253A%252F%252Foptimized-by.rubiconproject.com%252Ft%252F9164%252F15602%252F101258-2.3581666.3755480%253Furl%253Dhttp%25253A%25252F%25252Fwww.downloadchop.com%25252Fgo%25252Flightspark%25253Fsource%25253Dybrant_lightspark-fr%252526adprovider%25253Dybrant%252526ce_cid%25253Dfra1CJb1pPqEp5y4fxACGPvMm5KknOL4eiINODIuMjI5LjIyLjE2NigBMLnb0pgF%252526subid%25253D2301980 HTTP/1.1
                                    Host: cdn.adnxs.com
                                    Connection: keep-alive
                                    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.114 Safari/537.36
                                    Accept: */*
                                    DNT: 1
                                    Referer: http://ib.adnxs.com/tt?id=2301980&cb=1393864120&referrer=http://fra1.ib.adnxs.com/if?enc=gbdAguLHaD8eqb7zixJkP_LSTWIQWOk_Hqm-84sSZD-At0CC4sdoP2mCZbZYUNUFljpJTzhxcH-3rRRTAAAAAJL-IgB2AgAAUAMAAAIAAAA9ocQAN0sEAAAAAQBVU0QAVVNEANgCWgD8ogAA58sAAgUCAQIAAIwA9idtvAAAAAA.&pubclick=http://fra1.ib.adnxs.com/click?XkiHhzB-Wj-D_TJz3IRWP3E9CtejcNU_g_0yc9yEVj9eSIeHMH5aP_ygL0YyHDQoljpJTzhxcH-2rRRTAAAAAEJLIQBJAQAAVwMAAAIAAACL0cUA0WAFAAAAAQBVU0QAVVNEANgCWgDQMgAAUdQDAQUCAQIAAIwA3yN4YgAAAAA./cnd%3D!8gXSNwiT18QBEIujlwYY0cEVIAA./referrer%3Dhttp://www.imgclck.com/serve/imgclck.php/clickenc%3Dhttp://optimized-by.rubiconproject.com/t/9164/15602/101258-2.3581666.3755480?url%3D&cnd=%218yV7-QiCtsABEL3CkgYYACC3lhEwADj8xRpAAEjQBlCS_YsBWABgngZoAHAMeIABgAEMiAGAAZABAZgBAaABAagBA7ABALkBGWjVpdTIaD_BARlo1aXUyGg_yQFwmqHGvyLwP9kBAAAAAAAA8D_gAQA.&ccd=%21vwV6NgiCtsABEL3CkgYYt5YRIAA.&udj=uf%28%27a%27%2C+279660%2C+1393864119%29%3Buf%28%27c%27%2C+3152642%2C+1393864119%29%3Buf%28%27r%27%2C+12886333%2C+1393864119%29%3B&vpid=77&apid=189016&referrer=http%3A%2F%2Fwww.imgclck.com%2Fserve%2Fimgclck.php&media_subtypes=1&ct=0&dlo=1&pubclick=http://fra1.ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAALTIdr6fGus_AAAAAAAAAAAAAAAAAAAAAA-Oj4oIzbJcljpJTzhxcH-4rRRTAAAAANYjIwB6AgAAEAkAAAIAAAAfKcUAD5wFAAAAAQBVU0QAVVNEANgCWgCqqwAAtdQAAQUCAQIAAIwA6xZV3wAAAAA./cnd=%21GgafOwjH0sYBEJ_SlAYYj7gWIAE./referrer=http%3A%2F%2Ffra1.ib.adnxs.com%2Fif%3Fenc%3DgbdAguLHaD8eqb7zixJkP_LSTWIQWOk_Hqm-84sSZD-At0CC4sdoP2mCZbZYUNUFljpJTzhxcH-3rRRTAAAAAJL-IgB2AgAAUAMAAAIAAAA9ocQAN0sEAAAAAQBVU0QAVVNEANgCWgD8ogAA58sAAgUCAQIAAIwA9idtvAAAAAA.%26pubclick%3Dhttp%3A%2F%2Ffra1.ib.adnxs.com%2Fclick%3FXkiHhzB-Wj-D_TJz3IRWP3E9CtejcNU_g_0yc9yEVj9eSIeHMH5aP_ygL0YyHDQoljpJTzhxcH-2rRRTAAAAAEJLIQBJAQAAVwMAAAIAAACL0cUA0WAFAAAAAQBVU0QAVVNEANgCWgDQMgAAUdQDAQUCAQIAAIwA3yN4YgAAAAA.%2Fcnd%253D%218gXSNwiT18QBEIujlwYY0cEVIAA.%2Freferrer%253Dhttp%3A%2F%2Fwww.imgclck.com%2Fserve%2Fimgclck.php%2Fclickenc%253Dhttp%3A%2F%2Foptimized-by.rubiconproject.com%2Ft%2F9164%2F15602%2F101258-2.3581666.3755480%3Furl%253D%26cnd%3D%25218yV7-QiCtsABEL3CkgYYACC3lhEwADj8xRpAAEjQBlCS_YsBWABgngZoAHAMeIABgAEMiAGAAZABAZgBAaABAagBA7ABALkBGWjVpdTIaD_BARlo1aXUyGg_yQFwmqHGvyLwP9kBAAAAAAAA8D_gAQA.%26ccd%3D%2521vwV6NgiCtsABEL3CkgYYt5YRIAA.%26udj%3Duf%2528%2527a%2527%252C%2B279660%252C%2B1393864119%2529%253Buf%2528%2527c%2527%252C%2B3152642%252C%2B1393864119%2529%253Buf%2528%2527r%2527%252C%2B12886333%252C%2B1393864119%2529%253B%26vpid%3D77%26apid%3D189016%26referrer%3Dhttp%253A%252F%252Fwww.imgclck.com%252Fserve%252Fimgclck.php%26media_subtypes%3D1%26ct%3D0%26dlo%3D1/clickenc=
                                    Accept-Encoding: gzip,deflate,sdch
                                    Accept-Language: en-US,en;q=0.8,fr;q=0.6
                                    Cookie: __gads=ID=386c1f6bc0285adb:T=1390666421:S=ALNI_MZXJdGrAsWELFKRsS7QcqnPTkuaMw; uuid2=9182964126870747798; sess=1; icu=ChIIr54TEAYYASAAKAEwu8_EmAUKEgiCyRUQBhgDIAAoAzDGkb-XBQoSCKraFRAGGAEgACgBMIyKv5cFChII5I8WEAYYASAAKAEw0szplwUKEgjXlhYQBhgCIAAoAjDFvM2YBQoSCP7-CBAKGAUgBSgFMMjU0pgFChIIpogJEAoYByAHKAcwqtXSmAUKEgiDtwoQChgdIB0oHTCx29KYBQoSCNuECxAKGAUgBSgFMPbX0pgFChII0aELEAoYASABKAEwuc3SmAUKEgjLzwsQChgBIAEoATDrzNKYBQoSCK7fCxAKGAEgASgBMJfH0pgFChII0eQLEAoYASABKAEw5czSmAUKEgi78AsQChgHIAcoBzDwyNKYBQoSCL_yCxAKGAEgASgBMKzV0pgFChIIkoAMEAoYAiACKAIwrdvSmAUKEgi3hQ0QChgBIAEoATCv1dKYBQoSCMWnDhAKGAcgBygHMOzY0pgFChII_KcOEAoYBSAFKAUwisHSmAUKEgiIqA4QChgEIAQoBDCr1dKYBQoSCJ7pDhAKGAUgBSgFMMnK0pgFChII3ukOEAoYICAgKCAwuNvSmAUKEgi0hw8QChgBIAEoATC2ydKYBQoSCOeVDxAKGAUgBSgFMMnK0pgFChII_J4PEAoYASABKAEwrtvSmAUKEgi_lxAQChgDIAMoAzC8zdKYBQoSCNCkEBAKGAIgAigCML3N0pgFChII6acQEAoYBiAGKAYw5dfSmAUKEgjpsRAQChgGIAYoBjCv1dKYBQoSCMy5EBAKGAEgASgBMO3U0pgFChII1uoQEAoYASABKAEwstXSmAUKEgipghEQChgIIAgoCDCJy9KYBQoSCIaeERAKGAQgBCgEMOzY0pgFChIIh54REAoYAyADKAMw79jSmAUKEgjJpREQChgBIAEoATCbytKYBQoSCI-yERAKGAEgASgBMInL0pgFChIIqbcREAoYAiACKAIwisvSmAUKEgievhEQChgBIAEoATCtw9KYBQoSCP7GERAKGAYgBigGMNzT0pgFChIIofMREAoYAyADKAMwttHSmAUKEgjK-xEQChgCIAIoAjCx1dKYBQoSCJ6BEhAKGBsgGygbMNvX0pgFChII9ogSEAoYBiAGKAYw18rSmAUKEgjvmRIQChgDIAMoAzDP2dKYBQoSCI2qEhAKGAQgBCgEMLXJ0pgFChIInLASEAoYAiACKAIw0srSmAUKEgjXsRIQChgCIAIoAjDYytKYBQoSCKO0EhAKGAMgAygDMKjV0pgFChIIvrQSEAoYByAHKAcw19jSmAUKEgjFthIQChgCIAIoAjD0zNKYBQoSCLHAEhAKGAEgASgBMKDE0pgFChIIqswSEAoYASABKAEwzsrSmAUKEgiv0hIQChgDIAMoAzCPwdKYBQoSCOTYEhAKGAEgASgBMLTV0pgFChIIrNkSEAoYByAHKAcw7MLSmAUKEgj-2xIQChgDIAMoAzCx1dKYBQoSCInfEhAKGAIgAigCMMDN0pgFChIIxuASEAoYByAHKAcw3dnSmAUKFQj14BIQChjIASDIASjIATC429KYBQoSCPfgEhAKGAEgASgBMMDN0pgFChII9-ISEAoYBCAEKAQw5djSmAUKEgjw5BIQChgDIAMoAzD4wdKYBQoSCJXqEhAKGAMgAygDMI3F0pgFChII6uwSEAoYAiACKAIwpNLSmAUKEgjB8BIQChgGIAYoBjC_zdKYBQoSCOTyEhAKGAIgAigCMPXM0pgFChII5fISEAoYAyADKAMw-czSmAUKEgiG8xIQChgHIAcoBzDQ2dKYBQoSCIuJExAKGBMgEygTMMTW0pgFChIIoIwTEAoYBSAFKAUw7dTSmAUKEgjDohMQChgBIAEoATC21dKYBQoSCI-wExAKGAUgBSgFMLrN0pgFChIIxLATEAoYBiAGKAYwqtXSmAUKEgjIsBMQChgDIAMoAzDzzNKYBQoSCLyyExAKGAQgBCgEMOnL0pgFChIIvrITEAoYASABKAEw2cnSmAUKEgj6shMQChgBIAEoATDbx9KYBQoSCMi2ExAKGAEgASgBMNnG0pgFChII5bgTEAoYAiACKAIwhNfSmAUKEgiXuRMQChgEIAQoBDDU2NKYBQoSCIq-ExAKGAYgBigGMMfC0pgFChIInsITEAoYASABKAEw2cbSmAUKEgibxRMQChgGIAYoBjCE0dKYBQoSCP_FExAKGAIgAigCMOjM0pgFChIIkcYTEAoYBCAEKAQwz8fSmAUKEgi3xhMQChgBIAEoATCfydKYBQoSCOvGExAKGAEgASgBMLjb0pgFChIIx8gTEAoYBCAEKAQw6NTSmAUKEgiFyhMQChgBIAEoATDTzNKYBQoSCI_KExAKGAIgAigCMMbU0pgFChIIu9ETEAoYAyADKAMw2sfSmAUKEgjr2BMQChgCIAIoAjC21dKYBQoSCIbbExAKGAIgAigCMLnb0pgFChIIzuUTEAoYASABKAEw8MzSmAUKEgj76RMQChgCIAIoAjCqydKYBQoSCIHrExAKGAEgASgBMKrJ0pgFELnb0pgFGNYE; anj=dTM7k!M4.g1IKw2hK`RZ[+9f#Abz#5Z8>#V-^@!KG9XLO4442ch)Pc]jvxZ!#GhOwx*meAdp/D)elWNRR%-I!MOpSn=J+VCrW%0=hj]Bz32M!LSOQ5gll*LP_br1!?zqWv$YT0!S8!Ssqbx<[gw>6wFG2.OXE$1'cEc8BdiTCWLi:P+XwDKQDr`LmI$bR^3u%?co]YbrY[FD44<J(CU/Gn<5H=tP`n<jx[Cz6px:fcFXbqHccp2?vY*$/m>4GqE.2:v`'pIRgJ@wKuwpOTY'2wRpvC`e.1o[gHdch:d8Ly_dx!x3SeM0^!qrZIi%XQ$0pC/UUYEnNS-^j>32us+UP1VB_*ML]?KovH`x8g7%)dRu@#?pr+Lx<$9w@Af%inZIpkFAP#Y`t[+c'OBbc?!FUlhh4fF<-9S<1`W1<W3_z!``x7Jhjeh
t=1393864121360 [st=  2]     -HTTP_TRANSACTION_SEND_REQUEST
t=1393864121360 [st=  2]     +HTTP_TRANSACTION_READ_HEADERS  [dt=330]
t=1393864121360 [st=  2]        HTTP_STREAM_PARSER_READ_HEADERS  [dt=330]
t=1393864121690 [st=332]        HTTP_TRANSACTION_READ_RESPONSE_HEADERS
                                --> HTTP/1.1 200 OK
                                    Server: Apache
                                    ETag: "d932a372371bd0a47ba7e2a73649a8d0:1393776550"
                                    Last-Modified: Sun, 02 Mar 2014 16:09:10 GMT
                                    Accept-Ranges: bytes
                                    Content-Length: 5255
                                    Content-Type: application/x-shockwave-flash
                                    Date: Mon, 03 Mar 2014 16:28:41 GMT
                                    Connection: keep-alive
t=1393864121690 [st=332]     -HTTP_TRANSACTION_READ_HEADERS
t=1393864121690 [st=332]      HTTP_CACHE_WRITE_INFO  [dt=0]
t=1393864121690 [st=332]      HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121690 [st=332]      HTTP_CACHE_WRITE_INFO  [dt=0]
t=1393864121691 [st=333]   -URL_REQUEST_START_JOB
t=1393864121691 [st=333]    HTTP_TRANSACTION_READ_BODY  [dt=0]
t=1393864121691 [st=333]    HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121691 [st=333]    HTTP_TRANSACTION_READ_BODY  [dt=1]
t=1393864121692 [st=334]    HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121692 [st=334]    HTTP_TRANSACTION_READ_BODY  [dt=0]
t=1393864121692 [st=334]    HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121692 [st=334]    HTTP_TRANSACTION_READ_BODY  [dt=0]
t=1393864121692 [st=334]    HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121692 [st=334] -REQUEST_ALIVE
Run Code Online (Sandbox Code Playgroud)

其中URL_REQUEST：

122669: DISK_CACHE_ENTRY
http://cdn.adnxs.com/p/d9/32/a3/72/d932a372371bd0a47ba7e2a73649a8d0.swf?clickTag=http%3A%2F%2Ffra1.ib.adnxs.com%2Fclick%3FSRPvAE9aoD_c-TxO6i6ZP-kmMQisHO4_3Pk8TuoumT9JE-8AT1qgP3vmRkLiiPF6ljpJTzhxcH-5rRRTAAAAABwgIwByBwAAPwEAAAIAAADRAMMAVqgFAAAAAQBVU0QAVVNEANgCWgDHsgAAFIsAAQUCAQIAAIwAeiTtsAAAAAA.%2Fcnd%3D%2521NgbzOgjzkMEBENGBjAYY1tAWIAA.%2Freferrer%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fif%253Fenc%253DgbdAguLHaD8eqb7zixJkP_LSTWIQWOk_Hqm-84sSZD-At0CC4sdoP2mCZbZYUNUFljpJTzhxcH-3rRRTAAAAAJL-IgB2AgAAUAMAAAIAAAA9ocQAN0sEAAAAAQBVU0QAVVNEANgCWgD8ogAA58sAAgUCAQIAAIwA9idtvAAAAAA.%2Fclickenc%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fclick%253FXkiHhzB-Wj-D_TJz3IRWP3E9CtejcNU_g_0yc9yEVj9eSIeHMH5aP_ygL0YyHDQoljpJTzhxcH-2rRRTAAAAAEJLIQBJAQAAVwMAAAIAAACL0cUA0WAFAAAAAQBVU0QAVVNEANgCWgDQMgAAUdQDAQUCAQIAAIwA3yN4YgAAAAA.%252Fcnd%253D%25218gXSNwiT18QBEIujlwYY0cEVIAA.%252Freferrer%253Dhttp%253A%252F%252Fwww.imgclck.com%252Fserve%252Fimgclck.php%252Fclickenc%253Dhttp%253A%252F%252Foptimized-by.rubiconproject.com%252Ft%252F9164%252F15602%252F101258-2.3581666.3755480%253Furl%253Dhttp%25253A%25252F%25252Fwww.downloadchop.com%25252Fgo%25252Flightspark%25253Fsource%25253Dybrant_lightspark-fr%252526adprovider%25253Dybrant%252526ce_cid%25253Dfra1CJb1pPqEp5y4fxACGPvMm5KknOL4eiINODIuMjI5LjIyLjE2NigBMLnb0pgF%252526subid%25253D2301980
Start Time: 2014-03-03 17:28:41.359

t=1393864121359 [st=  0] +DISK_CACHE_ENTRY_IMPL  [dt=350]
                          --> created = true
                          --> key = "http://cdn.adnxs.com/p/d9/32/a3/72/d932a372371bd0a47ba7e2a73649a8d0.swf?clickTag=http%3A%2F%2Ffra1.ib.adnxs.com%2Fclick%3FSRPvAE9aoD_c-TxO6i6ZP-kmMQisHO4_3Pk8TuoumT9JE-8AT1qgP3vmRkLiiPF6ljpJTzhxcH-5rRRTAAAAABwgIwByBwAAPwEAAAIAAADRAMMAVqgFAAAAAQBVU0QAVVNEANgCWgDHsgAAFIsAAQUCAQIAAIwAeiTtsAAAAAA.%2Fcnd%3D%2521NgbzOgjzkMEBENGBjAYY1tAWIAA.%2Freferrer%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fif%253Fenc%253DgbdAguLHaD8eqb7zixJkP_LSTWIQWOk_Hqm-84sSZD-At0CC4sdoP2mCZbZYUNUFljpJTzhxcH-3rRRTAAAAAJL-IgB2AgAAUAMAAAIAAAA9ocQAN0sEAAAAAQBVU0QAVVNEANgCWgD8ogAA58sAAgUCAQIAAIwA9idtvAAAAAA.%2Fclickenc%3Dhttp%253A%252F%252Ffra1.ib.adnxs.com%252Fclick%253FXkiHhzB-Wj-D_TJz3IRWP3E9CtejcNU_g_0yc9yEVj9eSIeHMH5aP_ygL0YyHDQoljpJTzhxcH-2rRRTAAAAAEJLIQBJAQAAVwMAAAIAAACL0cUA0WAFAAAAAQBVU0QAVVNEANgCWgDQMgAAUdQDAQUCAQIAAIwA3yN4YgAAAAA.%252Fcnd%253D%25218gXSNwiT18QBEIujlwYY0cEVIAA.%252Freferrer%253Dhttp%253A%252F%252Fwww.imgclck.com%252Fserve%252Fimgclck.php%252Fclickenc%253Dhttp%253A%252F%252Foptimized-by.rubiconproject.com%252Ft%252F9164%252F15602%252F101258-2.3581666.3755480%253Furl%253Dhttp%25253A%25252F%25252Fwww.downloadchop.com%25252Fgo%25252Flightspark%25253Fsource%25253Dybrant_lightspark-fr%252526adprovider%25253Dybrant%252526ce_cid%25253Dfra1CJb1pPqEp5y4fxACGPvMm5KknOL4eiINODIuMjI5LjIyLjE2NigBMLnb0pgF%252526subid%25253D2301980"
t=1393864121690 [st=331]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 304
                            --> index = 0
                            --> offset = 0
                            --> truncate = true
t=1393864121690 [st=331]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 304
t=1393864121690 [st=331]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 0
                            --> index = 1
                            --> offset = 0
                            --> truncate = true
t=1393864121690 [st=331]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 0
t=1393864121690 [st=331]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 0
                            --> index = 2
                            --> offset = 0
                            --> truncate = true
t=1393864121690 [st=331]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 0
t=1393864121691 [st=332]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 2612
                            --> index = 1
                            --> offset = 0
                            --> truncate = true
t=1393864121691 [st=332]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 2612
t=1393864121692 [st=333]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 1448
                            --> index = 1
                            --> offset = 2612
                            --> truncate = true
t=1393864121692 [st=333]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 1448
t=1393864121692 [st=333]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 1195
                            --> index = 1
                            --> offset = 4060
                            --> truncate = true
t=1393864121692 [st=333]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 1195
t=1393864121693 [st=334]    ENTRY_CLOSE
t=1393864121709 [st=350] -DISK_CACHE_ENTRY_IMPL
Run Code Online (Sandbox Code Playgroud)

扫描DISK_CACHE_ENTRY显示它是干净的：

$ sudo clamscan -r .config/google-chrome/
[...]
Known viruses: 3138491
Engine version: 0.97.8
Scanned directories: 543
Scanned files: 1511
Infected files: 0
Data scanned: 70.93 MB
Data read: 135.29 MB (ratio 0.52:1)
Time: 22.528 sec (0 m 22 s)
Run Code Online (Sandbox Code Playgroud)

提供的页面通常（可能总是，不确定）在xxx.adnx.com域上（xxx部分不同）。在google-chrome目录中搜索该字符串返回：

$ grep -lR adnx .config/google-chrome/
.config/google-chrome/Default/Preferences
.config/google-chrome/Default/History Provider Cache
.config/google-chrome/Default/Cookies
.config/google-chrome/Default/Current Tabs
.config/google-chrome/Default/History
.config/google-chrome/Default/Archived History
.config/google-chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/#SharedObjects/Y255TG9H/macromedia.com/support/flashplayer/sys/#cdn.adnxs.com/settings.sol
.config/google-chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/#SharedObjects/Y255TG9H/macromedia.com/support/flashplayer/sys/settings.sol
.config/google-chrome/Default/Favicons-journal
.config/google-chrome/Default/Pref

slm*_*slm 10

我不确定您的特定问题是否属于这种情况，但在某些情况下，已知好的扩展已出售给 3rd 方，然后第三方出于恶意目的而选择扩展。有一个这样的故事讨论了这个问题：Google Chrome 扩展程序被出售给恶意广告软件公司。

摘抄

Ars Technica 的 Ron Amadeo 最近写了一篇关于广告软件供应商购买 Chrome 扩展程序以放置恶意的、注入广告的更新的文章。

谷歌浏览器具有自动更新功能，以确保用户始终运行最新的更新。显然，谷歌浏览器是由谷歌直接更新的。但是，此更新过程因此包括 Chrome 的扩展程序。Chrome 扩展程序由扩展程序所有者更新，由用户决定扩展程序所有者是否值得信赖。

当用户下载扩展程序时，他们授予扩展程序所有者随时将新代码推送到他们的浏览器的权限。

不可避免地发生的是，广告软件供应商正在从扩展作者那里购买扩展，因此也购买了用户。这些供应商正在向扩展程序的每个用户推出广告软件，这可能会带来危险的浏览体验。

一位 Google 扩展程序作者在其题为“我出售了 Chrome 扩展程序，但这是一个错误的决定”的博客文章中对此进行了个人描述。

我的建议是非常认真地对待这种情况并禁用您不确定的扩展。然后我会监控情况，看看它是否消退或继续。

如果它继续下去，那么我会深入挖掘并开始仔细检查您正在使用的 DNS 服务器。我通常出于这个确切原因使用OpenDNS，因为该服务（免费）试图通过将 DNS 查找重定向到替代 OpenDNS 页面来阻止攻击向量。

为什么要关心 DNS？

如果已知主机名与垃圾邮件/黑客攻击/网络钓鱼相关活动有关联，OpenDNS DNS 服务器会在您进行查找时有意增加它们返回的结果。他们处于独特的位置，因为他们对客户访问的每个站点执行查找，因此他们可以检测异常，请参见此处：OPENDNS PHISHING PROTECTION以及此处。

还有什么？

我还会确保您的/etc/hosts文件没有受到损害，并继续使用类似的东西来监视情况nethog，这将显示哪些进程正在访问您的网络。

Amit Agarwal 在不到一个小时的时间内为 Chrome 创建了一个 Feedly 扩展，并在不知不觉中以 4 位数的价格将其卖给了一家广告软件供应商。该扩展程序在销售时在 Chrome 上拥有 30,000 多名用户。新所有者向 Chrome 商店推送更新，将广告软件和附属链接注入用户的浏览体验。虽然由于 Agarwal 的忏悔所做出的公开宣传，此扩展程序已被删除，但这是 Chrome 扩展程序中非常常见的事件。

Den*_*nis 5

查看扩展Smooth Gestures（直接链接）的评论。

如果您按日期对评论进行排序（通过单击“最近”），您会看到几乎所有新评论都有一星评级，并且会抱怨不正当广告：

凯文·李1 天前

出售给添加广告和付费移除广告功能的第三方公司。

苏雷什·纳格斯瓦兰3 天前

讨厌广告。运行良好，直到它开始将广告注入我的浏览体验。我会花钱继续使用它，但我对偷偷摸摸的感觉很强烈。间谍软件的边界。

约翰·史密斯6 天前

不要使用这个。它正在注入 JS 来点击劫持事物并导致 https 的 XSS 安全问题。

托马斯 Hlavacek 2014 年 2 月 23 日

绝对的废话...还记得未经授权的 URL 偷窃事件吗？然后他们开始强迫用户“捐赠”或接受广告。它甚至开始在某些页面上滞后（在所有这些“改进”之前情况并非如此）。所以我已经切换到 CrxMouse，我很好。

凯尔·巴尔2014 年 2 月 19 日

这是一个可靠的鼠标手势扩展，但新广告是一个可怕的补充。首先，因为扩展程序会更新并默默添加广告，所以您不知道它们来自哪里。在这里，我使用多个恶意软件扫描程序扫描我的计算机，因为我收到了随机广告，直到我意识到是平滑手势插入它们。

没有充分的理由再使用这个扩展了，我个人想知道谁开发了这个扩展，所以我可以确保将来不安装任何来自他们的东西。

看来这就是罪魁祸首。

ter*_*don 5

除了这里的答案之外，我还找到了一些更有用的资源。

  1. 这篇 howtogeek文章推荐了一个名为Fiddler的程序，它充当 Web 调试代理，允许您检查网络请求（有 alpha linux 版本）。@slm 向我指出了这个关于 SO 的答案，它也有各种类似的程序。

  2. chromechrome://extensions页面中的开发者模式允许您检查后台运行的进程的每个扩展：

    在此处输入图片说明

    单击background.html打开 chrome 的开发人员工具窗口，您可以通过该窗口轻松查看扩展程序包含的各种脚本的来源。在这种情况下，我注意到support在Sexy Undo Close Tab 的源代码树中调用了一个文件夹，其中包含一个background.js看起来可疑的脚本（它生成了符合我症状的随机时间间隔）。

  3. 另一篇howtogeek文章列出了要避免的已知扩展，但更好的是http://www.extensiondefender.com，它似乎是用户生成的恶意扩展数据库。但是，他们没有具体说明如何或为什么将特定扩展程序标记为恶意软件或附加软件，因此也许应该谨慎对待。

  4. extensiondefender.com 背后的人（无论他们是谁）还开发了一个非常酷的小扩展，称为 (drumroll) Extension Defender。这既可以让您扫描现有的扩展程序以查找已知的“坏”扩展程序，还可以阻止安装列入黑名单的扩展程序。

因此，在我的 OP 中的扩展中，Smooth Gestures（感谢 @Dennis）和Sexy Undo Close Tab都是附加软件。根据support/background.js后者文件的源代码，我很确定一个是随机劫持我当前页面的那个，但我会给它几天时间来确定。

另一个有用的扩展是扩展更新通知程序（感谢@Dennis），它显然让您知道每当扩展 haqs 更新时，这可以帮助识别在更新添加此类行为的情况下的罪魁祸首。

归档时间：

查看次数：

5278 次

最近记录：

7 年，3 月 前
相关归档
为什么要为 /tmp 创建一个单独的分区？ 23
Google 日历通知：警报与桌面通知，以及使警报起作用 11
如何确定正在运行的进程正在使用 java？ 9
从 RPM 安装 systemd 服务？ 8
键入时在谷歌浏览器中建议地址后的“/” 6
.# 文件名在 Linux 中是什么意思？ 5
如何在最小的网络设置上更改 DNS 5
使用 Xming 在 Windows 10 Linux 子系统上使用加速图形？ 5
dnsmasq 用于在不支持 mDNS 的客户端上查找“.local”域 5
如何使用 Linux 客户端通过 HTTPS 运行 RDP？ 3
难疑归档
Mac OS X 等效于 Ubuntu“tree”命令 369
使用FFmpeg组合一张图像+一个音频文件制作一个视频 246
如何快速将当前窗口移动到 Windows 10 中的另一个任务视图/桌面？ 230
为什么存在 1366x768 分辨率？ 156
相当于powershell中cmd的“where” 140
为什么 Zip 能够压缩比具有相同内容的多个文件更小的单个文件？ 130
MAC地址的确切用途是什么？ 129
在 OS X 上解锁“锁定”文件的命令 124
Windows 中的多选项卡命令提示符？ 115
使用快捷方式在隐藏密码提示 (Linux) 中删除输入的密码 105