Fake Facebook e-mail contains Trojan
A new variant of the Bredolab Trojan horse is attached to a fake "Facebook Password Reset Confirmation" e-mail, security firm MX Labs is reporting.
Some users are receiving the e-mail from "The Facebook Team," according to the security firm. The sender's e-mail address displays "service@facebook.com." In reality, the address and sender were spoofed.
MX Labs found that the e-mail was accompanied by an attachment named, "Facebook_Password_4cf91.zip and includes the file Facebook_Password_4cf91.exe" that, the e-mail claims, contains the user's new Facebook password. The security firm said that the element between the underscore and .zip are randomly chosen letters and numbers for each recipient.
When a user downloads the file, it could wreak havoc on their computer. MX Labs said in a blog post that the Trojan horse Bredolab "executes files from the Internet, such as rogue anti-spyware. To bypass firewalls, it injects its own code into legitimate processes svchost.exe and explorer.exe. Bredolab contains anti-sandbox code (the trojan might quit itself when an external program investigates its actions)." In other words, it's nasty.
Once it makes its way to the user's PC, Bredolab creates "%AppData%\wiaservg.log" and "%Programs%\Startup\isqsys32.exe" in the user's system files. MX Labs said that it also creates two new processes, called "isqsys32.exe" and "svchost.exe."
Another security watchdog, M86 Security, wrote that there's more to the outbreak than Bredolab. After it sneaks its way onto the user's computer, M86 said, Bredolab downloads a bot called Pushdo. The company found that Pushdo immediately starts "spamming out more of these Facebook password reset e-mails."
For its part, Facebook was quick to point out that the e-mail containing the virus wasn't coming from the social network.
"This virus is being distributed through email, not on Facebook," a Facebook spokesperson wrote. "The email is disguised as a Facebook password reset e-mail with an attachment that purportedly contains the new password, but is actually the virus. We're educating users on how to detect this through the Facebook Security Page."
Facebook said that users should be "suspicious of unexpected emails claiming to be from Facebook." The company also said that it will never send users a new password as an attachment.
Those users that have downloaded the file should use anti-malware software to remove it. Click here for a list of security software available from CNET's Download database.
Updated at 1:03 p.m. PDT to include new details from M86 Security.
Don Reisinger is a technology columnist who has written about everything from HDTVs to computers to Flowbee Haircut Systems. Don is a member of the CNET Blog Network, and posts at The Digital Home. He is not an employee of CNET. Disclosure.
WinNoMo is one of our resident Apple fans who is trying to openly mock and ridicule people who use Windows. In the end, they only end up making a mockery of themselves with such attempts.
clicking on that attachment and as you said , nothing happend means you've got the viruse .
the best way i see for you to get rid of this is to start up your computer in safe mode.. and scan your system .
but this could take sometime, i'd just reformat my pc .
http://blog.threatfire.com/2009/10/facebook-password-reset-confirmation.html
Not really. In most cases their PC remains mostly functional (just merely inconveniencing the infected user), while spewing out spam, viruses and DoS attacks, causing trouble for everyone else on the internet; also causing annoyance for anyone ultimately in charge of fixing that PC for the idiot that opened the attachment. At no point does the PC just drop off the internet or cease to function, that's not profitable for the peddlers of malware.
It is time to go to licensing to get an internet connection.
Back in the day when the Mac platform was languishing, and Apple was in danger of going out of business, I could understand why cnet felt it was appropriate to ignore it. But now with 25 million users and Apple raking in profits that astound the entire industry, you'd think cnet might show some journalistic integrity and drop a line about this non-threat to Macs.
You'd be mistaken. At the very least when cnet hires a freelance journalist they should run the article by an editor. Just sayin'.
Gee, if they paid attention to MacOSX, they'd have to pay attention to every two cent OS out there.
It's been said before that it's pretty darned hard to make a virus to work on Windows and Mac.
Fanboys fail to realise that there ARE OSX viruses out there. It's just that it's not worth the time to target a small group.
Heck, there is a Linux virus out there. I just don't know where. If you told me where it was, I'd gladly try it. Because I can re-image the drive.
This points out that no OS is perfect, and that OS X has its share of critical issues as well.
writing a viruse prog. takes a lot of time and as you know MAC got no more than 6% of the market share.. in all its history only 6% :S thats somthing i'd personally be asshamed of . the point if who is the **** that w'd write a viruse to infect 10 millions MAC when he could write the same prog for windows and infect 100 millions .
To all the M$ apologists who cry market share (again and again without thought), explain why OS 9 had hundreds of viruses (actual viruses that didn't require user interaction) and yet even after 8 years and 6 iterations there is yet to be one for OS X (trojans don't count as viruses). I guess Apple is in real trouble, since by your argument OS 9 had an infinitely larger market share than OS X currently has.
To Danny boy here, please tell us what OS you couldn't hack with physical access to the machine and what that has to do with the topic we're discussing. Or did you just want to show off your strawman construction capabilities?
.
"If you'd like the old newsfeed back, send us your pw!"
-timber2005 (who is greatly annoyed at all of the "give us the old newsfeed back" groups.
i think i'm going to switch AVG, after this.
As Atom mentioned, it's common to have multiple "svchost.exe" processes running in winblows. It's a legitimate process, which is what makes this trojan so nasty - code injection. But again, if you didn't install it ...
If you're really paranoid (maybe your kid also uses the computer ...), look for the other signs mentioned. Stolen from the article itself:
"Once it makes its way to the user's PC, Bredolab creates "%AppData%\wiaservg.log" and "%Programs%\Startup\isqsys32.exe" in the user's system files."
Lastly, remember the nature of AV programs like Avast or AVG - the malware in question has to be known by the AV community first. How do they know about malware, do you think the black hat guys have meetings with the AV guys or something? No, first the malware has to hit one of their "honey pot" machines, PC's set up specifically to be easy to infect so they can analyze the malware in question and write the AV signature needed to identify it. What this means is it's impossible to perfectly protect you against all malware because the malware has to be written and released into the wild first, the protection comes later. It's erroneous to think that just because Avast hasn't caught it yet, AVG would.
- by don4preeda March 17, 2010 12:22 PM PDT
- Do not be fooled if it appears that nothing has happened. The virus will autosend to all your contacts and anyone that opens it will continue the trend.
- Like this Reply to this comment
-
(40 Comments)