|
|
A new variant of Koobface (a worm that spreads over Social Networking sites) was recently making the rounds on Facebook. Users reported receiving spam messages, such as:

When a user follows the link, they’re redirected to one of many different compromised hosts, which displays a fake error message that the version of Flash is out of date. Next the user is prompted to download/open flash_player.exe, a new Koobface variant.

If the user choose to install the executable, a fake error message is displayed.

Facebook is already aware of this threat and is purging the spammed links from their system. But with dozens of Koobface variants known to exist, the situation is likely to get worse before it gets better. It’s important to note that spammed links leading to Koobface are likely to come from infected friends, reminiscent of early mass-mailing worms. The safe-computing practice created more than 10 years ago still applies today, which is not to open any unexpected email attachments, even if they are from someone you know. Only in this context, it must be expanded to the following:
| Do not follow any unexpected hyperlinks you receive over the Web, Email, or IM, even if they are received from someone you know. It’s best to ask for confirmation from the sender; that they intentionally sent such a link. |
| Â |
| On the other end of hyperlinks, it’s best to install software and updates from the source (such as adobe.com in this case) rather than trusting the content from a third-party website. |
The upcoming DAT release contains detection for the new Koobface variant, while users of McAfee Artemis Technology are already protected in real-time against this threat.
As for the motivations behind this Koobface variant, analysis shows that during infection a proxy server is installed to %ProgramFiles%\tinyproxy\tinyproxy.exe and a service named Security Accounts Manager (SamSs) is created to load the server at startup.  This component listens on TCP port 9090 and proxies all HTTP traffic, in particular looking for traffic to Google, Yahoo, MSN, and Live.com for the purpose of hijacking search results. Search terms are directed to find-www.net. This enables ad hijacking and click fraud.
|
|
Does it help to have WOT? That’s what I have and it helps me to know what sites have a bad reputation. Should more people know about it ? Or does it matter ?
Thanks Craig… Dave
ok, so i think the big question is… how do we fix this?!
I use facebook but till I not get any message of this kind and if I will get any message of this kind I will ignore that.
Koobface affects Windows systems, not Linux.
You might be interested in this account
http://www.vancouversun.com/business/Poisoned+sites+lure+surfers/1339679/story.html
of an experience we had here with a poisoned Google hit. I passed the details
to the major newspaper here and after doing my own research passed that along
as well. This resulted in the account you see in the link above.
If for some reason the link is truncated, the Google search terms (in the news
section) “poisoned sites” will lead you to this story.
At the time I put the details together I was unaware of your own work.
So are Linux systems susceptible to this virus? Tnx, Dave
[…] 。ã•らã«è©³ã—ã„æƒ…� �ã¨ã‚¹ã‚¯ãƒªãƒ¼ãƒ³ã‚·ãƒ§ãƒƒãƒˆãŒã“ã“ã«ã€‚(画åƒã¯MaximumPCã®å¥½æ„ã«ã‚ˆã‚‹ï¼‰CrunchBase InformationFacebookInformation provided by […]
Wow – Just now I got sent to a similar link through Youtube.
It had the exact same comments below the video.
Thank goodness I didn’t “download” what it told me to.
[…] Craig Schmugar, threat researcher for McAfee Avert Labs, confirmed this in a call with CNET News and said that, in general, Koobface strikes only social-networking sites. […]
Will the EXE still install in XP Home even if the user is other than an admin (that is, a “limited”) user? Thank you in advance for your assistance!
well what do we do if we have already clicked on this unexpected virus? How can we specifically locate it and completely eliminate it?
Also, great cleanup instructions here:
http://tonysgeektips.wordpress.com/2008/12/04/update-on-koobface-virus/
[quote]
Nice article. I guess the same could be found on Flickr ?
[/quote]
This can be found on any social networking site! Such as flickr, bebo, tagged, myyearbook, youtube, imeem and many more.
Myspace already been hacked…
Hi U- No, the list of websites currently being wormed/attacked originally were published here. Flickr is not listed:
http://blog.threatfire.com/2008/12/koobface-on-loose-as-flashupdateexe.html
Thanks for the information. I will be careful if I find anything like that on FaceBook.
Thank you for this information.
I wondered how I had downloadd this bug and after reading this, I even remeber the day.
It is exactly as you described.
I hope others can take warning and not end up with the expense I have – and it’s still not really gone!
If you happened to click on that link on facebook, you need to go to Internet Explorer, Internet Options, Connections, and uncheck the LAN settings.
This virus changes that and starts routing you to other websites.
Hope that helps, it fixed the problem after I unchecked it, and ran Walwarebytes.
Thanks for the info!
Nice article. I guess the same could be found on Flickr ?
Submit your own comments / message for this post