DNS hacked/hijacked by the "Delude.B" trojan

From: Jonathan de Boyne Pollard (J.deBoynePollard_at_Tesco.NET)
Date: 10/03/03 

Date: Fri, 03 Oct 2003 11:46:03 +0100

c> I'm having a strange problem [...]
c> [...] I looked my tcp/ip config and my dns servers were
c> set to something they shouldn't be! Usually it is on
c> automatically obtain. [...] The DNS addresses were:
c> 69.57.146.14 [and] 69.57.147.175
c> I did ipconfig /displaydns and wow, I had tons of entries!
c> It filled a .txt file with 66kb worth of entries [...]
c> Now the weird part, they are all search engines! [...]
c> My dns cache won't get rid of those addresses. [...]
c> The first time I rebooted it Windows complained about command.com [...]

You've been hit by the "Delude.B" trojan. This trojan uses a bug
in Microsoft's Internet Explorer (which, according to CERT Incident
Note IN-2003-04, has not been properly fixed) that allows web page
authors to write web pages that will cause Internet Explorer to
automatically download and execute whatever programs the web page
author desires. So at some point you've displayed a web page that
caused this trojan to be downloaded and run.

The trojan changes the proxy DNS servers that your DNS Client is
configured to use, to the addresses of two machines assigned to
Everyone's Internet which were discovered to have been compromised
and which have since been taken out of service. The intent of the
attacker was clearly to run a proxy DNS service providing
name->address mappings of his/her choosing, in order to impersonate
services without your being any the wiser.

The trojan also populates your "HOSTS" file with a large number
of entries, mapping the names of several widely used web sites to
an IP address whose content HTTP service the attacker intended to
control. The intent of the attacker was clearly, again, to
impersonate services without your being any the wiser. The fact that
these are search engines is not weird, therefore.

The reason that flushing the DNS Client cache does not cause these
mappings to go away is that Microsoft's DNS Client automatically
initially populates its cache from the content of the "HOSTS" file.
You must edit the "HOSTS" file itself for these mappings to go away.

The trojan does not stick around. It performs its task and then
deletes itself from the machine. Since running executables in Win32
cannot delete themselves, it does this by spawning a command
interpreter, passing it a command script containing commands to
delete both the executable and the script. My educated guess is
that the NTVDM process running COMMAND was caused by a witless novice
coding error on the part of the author of the trojan: hard-wiring
"COMMAND" as the name of the command interpreter that it invokes
instead of looking at the value of the %COMSPEC% environment
variable to find what command interpreter to use, as one should.

<URL:http://www.cert.org./incident_notes/IN-2003-04.html>
<URL:http://f-secure.com./v-descs/delude.shtml>

Relevant Pages

  • DNS hacked/hijacked by the "Delude.B" trojan
    ... The DNS addresses were: ... You've been hit by the "Delude.B" trojan. ... name->address mappings of his/her choosing, ... passing it a command script containing commands to ...
    (comp.os.ms-windows.nt.admin.security)
  • RE: Broken reverse DNS lookup which I cant fix
    ... Change the DNS settings to Standard Primary Zone. ... Change the zone to accept nonsecure and secure dynamic updates. ... On each domain controller, at a command prompt, type the following ... Open Active Directory Users and Computers, click View, Advanced ...
    (microsoft.public.windows.server.sbs)
  • Re: unable to load ONE web site - unknown zone
    ... If you like try setting prompts and see if you at least get a prompt. ... Let's check the DNS because it is the next easiest thing to do ... Open a command window (e.g. Run... ... enter just nslookup ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • RE: Dhcp errors, warnings listed in Event Viewer
    ... There click on your LAN connection and Select Properties, ... Automatically and the DNS. ... CMD.exe click and on the Prompt command type: ... I notice that the alerts show up only then; ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: DNS hacked/hijacked by the "Delude.B" trojan
    ... The DNS addresses were: ... This trojan uses a bug> in Microsoft's Internet Explorer that allows web page> authors to write web pages that will cause Internet Explorer to ... The intent of the> attacker was clearly to run a proxy DNS service providing> name->address mappings of his/her choosing, in order to impersonate> services without your being any the wiser. ... Since running executables in Win32> cannot delete themselves, it does this by spawning a command> interpreter, passing it a command script containing commands to> delete both the executable and the script. ...
    (microsoft.public.win2000.security)