Webware

This message could lead you to the Koobface virus, say security experts.

(Credit: McAfee Avert Labs)

A worm responsible for sending Facebook users malicious code appears to be limited in nature, although the social engineering attack may be used again, say experts.

Facebook representative Barry Schnitt said the worm isn't new; it dates back to August, although the variant that first appeared on Wednesday targets only Facebook users.

Craig Schmugar, threat researcher for McAfee Avert Labs, confirmed this in a call with CNET News and said that, in general, Koobface strikes only social-networking sites.

After receiving a message in their Facebook in-box announcing, "You look funny in this new video" or something similar, recipients are then invited to click on a provided link. Once on the video site, a message says an update of Flash is needed before the video can be displayed. The viewer is prompted to open a file called flash_player.exe.

A new mass-mailing virus targeting Facebook users directs victims to a site asking to download a Trojan masked as an Adobe Flash update.

(Credit: McAfee Avert Labs)

Schmugar said the prompt for a new player should be a warning. "The messages you tend to get from these sites don't look quite right." For instance, IE will tell you where the update is coming from, and usually it's not an Adobe site.

If the viewer approves the Flash installation, Koobface attempts to download a program called tinyproxy.exe. This loads a proxy server called Security Accounts Manager (SamSs) the next time the computer boots up. Koobface then listens to traffic on TCP port 9090 and proxies all outgoing HTTP traffic. For example, a search performed on Google, Yahoo, MSN, or Live.com may be hijacked to other, lesser-known search sites.

Schmugar said this version of Koobface includes a bot-like component that could install other malicious apps at a later time.

Facebook's Schnitt said, "Only a very small percentage of Facebook users have been affected and we're working quickly to update our security systems to minimize any further impact, including resetting passwords on infected accounts, removing the spam messages, and coordinating with third parties to remove redirects to malicious content elsewhere on the Web."

Facebook has posted instructions on how to remove the infection.

McAfee's Schmugar said this attack is similar to e-mail attacks 10 years ago in that Koobface is using infected friends lists, reminiscent of early mass-mailing worms. As was the recommendation then, he advises users not to open any unexpected e-mail attachments, even if they are from someone you know.

PCLive.com, a service offered by SecurityCoverage Inc., is attempting to upstage security giants Symantec and McAfee by offering a complete suite of security tools for your desktop--for free. Included within the basic PCLive Security package is a firewall, the open source ClamAV antivirus product, antispyware, a pop-up blocker, plus system cleaner (removes old temp files). PCLive will also check for the latest Microsoft Windows updates that haven't yet been applied to your PC. For a mere $4.95 a month, PCLive Premium Security includes all the basic PCLive Security along with Web content filtering, parental controls, disk maintenance and 24-7 live technical support. SecurityCoverage also offers users of their free PCLive service instant 24-7 technical support for a flat fee of $49.95 per session.

How does it work? OK. The ClamAV product is designed for UNIX and Linux systems. It hasn't been independently tested by Windows-based antivirus testing labs. Also we found that PCLive runs three active processes on your desktop. A couple of times, for no apparent reason, the PCLMonitorService process consumed up to 53 percent of our system resources, considerably slowing our test PC.

Our biggest complaint is a lack of detail on what's going on under the hood, such as a listing of what temp files, viruses, and spyware were removed. Upon installation, PCLive scanned and removed viruses and spyware from our test PC--without telling us what it removed. While there is an e-mail report of what the product has done on your PC, we'd like a little input on what's done on our computer. Same thing happened with an announcement that several hundred temp files had been removed. Not that we want to see every temp file, but we'd like to know in advance and approve any actions.

There are five tabs: Status, Security Scans, Settings, Forum support, and Upgrade. Opening the PCLive settings page is frustrating. There is no contextual Help, no Help file at all, meaning, it's hard to figure out what the setting options you have. Under firewall settings we checked "stealth mode." Other than getting a pop-up explaining that we might not be able to visit certain sites, there was no additional information on what "stealth mode" might or might not do. If you do tweak any of the PCLive settings, you can either save and you can close the app, but you can't intuitively get back to the main interface page.

Back on the Status tab, after choosing to update all the components, PCLive continued to show that we weren't fully updated. A second update proved successful, but that was a lucky guess on our part.

Should you decide to remove PCLive, there is an uninstall option on the All Programs menu. After a reboot, we found no traces of PCLive remaining on our test system.

There's a new zero-day attack in progress against Yahoo Messenger users. The instant messaging solicitation invites users to open their Webcam. However, the code used in this China-based exploit causes a heap overflow to be triggered when the target accepts a Webcam invitation. That means a remote attacker could execute malicious code on a compromised machine.

The McAfee security blog recommends the following: do not accept Webcam invites from untrusted sources until a patch is released, and block outgoing traffic on TCP port 5100 on your firewall until a patch is released.

Yahoo has been informed and says it is working on a patch.

>> MTV online strategy to help Viacom take on YouTube? Viacom wants you to watch clips of its popular TV shows on the Internet, but it doesn't want you to do so on YouTube. At the beginning of this month, Viacom had YouTube take down more than 100,000 clips of Viacom-owned content. Now it's spreading them out among its sites, including ComedyCentral.com and MTV.com.

>> Belgian court rules against Google over copyrights. Belgian newspapers apparently don't like Google, as they've barred the company from caching its stories for news clippings. The argument is that the stories remain accessible even when they're no longer available for free viewing on the original news sites. A legitimate argument, but why scare away potential readers?

>> Cisco's new security target: consumers. Cisco Systems makes products for large companies and businesses, but its marked 2007 as the year to move into the consumer arena for products for your home. Security is the name of the game, and Cisco steps into the ring with Symantec, McAfee, and others to vie for your home's Internet security needs.