ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev
Home / News & Blogs / Zero Day

New Facebook worm spreading

By | November 30, 2011, 9:59am PST

Summary: Researchers from the Danish security firm CSIS, have intercepted a currently spreading Facebook worm.

Researchers from the Danish security firm CSIS, have intercepted a currently spreading Facebook worm.

The worm spreads by sending direct messages using the privileges of the already logged in user. The message looks like an image file, whereas in reality it has an executable .scr screensaver extension.

Upon execution, the sample drops a ZeuS crimeware variant on the infected host. The malware is hosted on compromised web servers across the globe.

The sample — very limited detection rate — is currently detected as Win32.HLLW.Autoruner.52856 and Heure: Trojan.Win32.Generic.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Topics

Facebook, Researcher, Security Company, Worm, Home Office Security, Cyberthreats, Security, Viruses And Worms, Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Disclosure

Dancho Danchev

More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile.

Biography

Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, and cybercrime incident response. He's been an active security blogger since 2007, and maintains a popular security blog sharing real-time threats intelligence data with the rest of the community on a daily basis. More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile. You can also follow him on Twitter
20
Comments
Add Your Opinion

Join the conversation!

Just In

Christian Louboutin Leather Mens Shoes in Black CL08016 [CL08016] - $148.00 :
lguinanis 29th Dec
Louboutin Discount loboutin boots Discounted Louboutins Store Online christian louboutin shoes christian louboutin shoes


Christian Louboutin Leather Mens Shoes in Black CL08016 [CL08016] - $148.00 : Zen Cart!, The Art of E-commerce





























christianlouboutin
News
New Products
Featured Products
Specials
Register



























christianlouboutin

New Products

Specials

Featured Products

My Account

View Cart






Log In
or Register











Advanced Search









HEADER_SHOPPING_CART_EMPTY






























Categories

Christian Louboutin Boots
Christian Louboutin Bridal
Christian Louboutin d'Orsays
Christian Louboutin Discount
Christian Louboutin Evening
Christian Louboutin Mary Janes
Christian Louboutin Mens
Christian Louboutin Platform
Christian Louboutin Pumps
Christian Louboutin Sandals
Christian Louboutin Slingback
Christian Louboutin Sneakers
Christian Louboutin Wedges




Information


Shipping & Returns
Privacy Notice
Conditions of Use
Contact Us
Site Map
Gift Certificate FAQ
Discount Coupons
Newsletter Unsubscribe













christianlouboutin /a :: 
Christian Louboutin Mens  :: 
Christian Louboutin Leather Mens Shoes in Black CL08016
























Christian Louboutin Leather Mens Shoes in Black CL08016





























larger image










$148.00










Please Choose:



Size


US 5 UK 3.5 EU 36 CM 22
US 6 UK 4.5 EU 37 CM 23
US 7 UK 5.5 EU 38 CM 24
US 8 UK 6.5 EU 39 CM 25
US 9 UK 7.5 EU 40 CM 26
US 10 UK 8.5 EU 41 CM 27




































Add to Cart:













Product Name :Christian Louboutin Leather Mens Shoes in Black CL08016 Brand :Christian Louboutin Model :CL08016 Material : Leather Weight :1.4kg Size :EUR 39,40,41,42,43,44 Color :Black For People :Men In Stock :Yes Recommend Use :Outdoor Sole :Rubber Style :Casual span style="FONT-FAMILY: ?????







































































This product was added to our catalog on Wednesday 31 December, 1969.





































christianlouboutin


::

Conditions of Use


::

Shipping


::

Privacy


::

Site Map

::Blog






























Christian Louboutin official web site. You can buy Christian Louboutin Shoes, Christian Louboutin Boots, Christian Louboutin Pumps, Christian Louboutin Sandals,

Christian Louboutin Wedges, Christian Louboutin Slingback, Christian Louboutin Platform, Christian Louboutin Mary Janes, Christian Louboutin d'Orsays, Christian Louboutin Mens,

Cheap Christian Louboutin, Christian Louboutin Evening, Christian Louboutin Outlet, Christian Louboutin Discount, all products are Free Shipping! Buy Now!











































Christian Louboutin Bridal

Cheap Louboutin Bridal

Christian Louboutin d'Orsays

Cheap Louboutin d'Orsays

Christian Louboutin Discount

.No have any specific life likely qualities though just being infected which is often caused as a result of wearing an unacceptable kind in shoe.

It could be found together with the paws and fingers including on the palms which unfortunately becomes highly thick.These types of problems may be caused because of the shoes you wears.If that shoes are actually uncomfortable the skin in the requirement to protect itself gathers corns and also calluses and that is hardened as well as thick stratum of face.

In case you are already facing health issues then a lot of these corns can cause problems to your account.A diabetes persistent would deal with some trouble if corns surfaces on their hand or perhaps feet.The circulation of blood is less that causes more trouble

Other About Discount blog

Discount

About discountchristianlouboutinoutlet.com blog
View in thread
0 Votes
+ -
RE: New Facebook worm spreading
SFBAGS Updated - 30th Nov
How do you recommend we protect ourselves? (Thanks.)
0 Votes
+ -
RE: New Facebook worm spreading
Norton_is_Useless 1st Dec
@SFBAGS

1) Power off the computer
2) Dislodge the mouse from your palm
3) Push yourself away from the keyboard

or

Patient: "Doctor, it hurts when I do this...Doctor: "Don't do that"

Stop using KoobFace, er FaceBook. ;-)'
0 Votes
+ -
RE: New Facebook worm spreading
KerrieG 1st Dec
@Norton_is_Useless

That was about as useful as Norton.
0 Votes
+ -
RE: New Facebook worm spreading
lordshipmayhem 1st Dec
@Norton_is_Useless , or use Linux, or BSD, or some OS other than Windows.
0 Votes
+ -
RE: New Facebook worm spreading
Norton_is_Useless 1st Dec
@KerrieG I resemble that remark! BWAAHAHAAA...
0 Votes
+ -
RE: New Facebook worm spreading
Norton_is_Useless Updated - 1st Dec
Never mind...
0 Votes
+ -
RE: New Facebook worm spreading
vezycash 3rd Dec
@SFBAGS don't worry, this kind of stuff is inevitable once you have over 500 million subscribers. Brace yourself for something worse on Ipad, Iphone apple aint seen nothing.
cheers
0 Votes
+ -
RE: New Facebook worm spreading
Rob S. 30th Nov
I'm glad you posted the solution, I will sleep better, oh wait, I don't recall seeing a solution...
0 Votes
+ -
RE: New Facebook worm spreading
lelandhendrix@... 1st Dec
@Rob S. How about don't click on the image received as a message? Sending a message to the sender asking what they are sending you and why?
0 Votes
+ -
RE: New Facebook worm spreading
generatedname@... 30th Nov
solution is to stop executing images
0 Votes
+ -
Executing Images
Tsingi 2nd Dec
@generatedname@...

I don't use windows, but I have to believe that if you click on an image, and it's actually an executable, that Windows will ask you before running it?

If not, it's a more brain dead OS than I had previously thought.
0 Votes
+ -
RE: New Facebook worm spreading
rome01 30th Nov
Security software any help with this?
0 Votes
+ -
RE: New Facebook worm spreading
hardrocker22 30th Nov
Great just what I need I spend a lot of time on Facebook, mostly on the games to pass the time away, the odd time chatting with friends, now I have to worry about a stupid worm.. just lovely.
0 Votes
+ -
RE: New Facebook worm spreading
ait10101 1st Dec
Nasty bookworms!
0 Votes
+ -
RE: New Facebook worm spreading
omb00900@... 1st Dec
As I understand it, someone you know could send you a picture (actually, their infected computer without their knowledge), and you would become infected just by clicking on the picture.

The best way to avoid infection therefore would be to check the properties of the file before you open it, whenever someone sends you a picture, and if it's a .SCR file (or really anything other than a jpg, gif or png), don't open it!
0 Votes
+ -
RE: New Facebook worm spreading
clyman6232@... 1st Dec
does going back using system restore to a prior date help? It does in a lot of cases.
0 Votes
+ -
love the notron remarks.
Free Webapps 5th Dec
So true and yet comcast went back to them. Suckers! About how to tell its its a real or fake pic, one should have the option to display/unhide known file type extensions. Then when u mouse over/highlight the link, you will see: filename.jpg.scr. If you ever see something like that and u didn't do it or wasn't informed it will be sent like that, delete it.

The last extension is the actual file type. Notify sender that their system is infected and to change password from a clean system (mobile device works well). trendmicro's webprotect with win sec ess, caught it in my public user (guest) system at house. Having one of those has greatly kept my personal system safe from attacks and viruses. Having a vlan or two physical networks config helps as well.
0 Votes
+ -
RE: New Facebook worm spreading
ccfman2004 5th Dec
Thank god I use a Mac.
0 Votes
+ -
RE: New Facebook worm spreading
rathersailawa@... Updated - 6th Dec
There are privacy controls in FB, for those who take the time to inform themselves. Trouble is, most users haven't a clue! No wonder "stuff" spreads!

- And if you think using a MAC will make a difference, lots of luck with that...MACS are NOT virus/worm proof! Plenty of proof waiting on the net, for those so mis-informed!
0 Votes
+ -
Christian Louboutin Leather Mens Shoes in Black CL08016 [CL08016] - $148.00 :
lguinanis 29th Dec
Louboutin Discount loboutin boots Discounted Louboutins Store Online christian louboutin shoes christian louboutin shoes


Christian Louboutin Leather Mens Shoes in Black CL08016 [CL08016] - $148.00 : Zen Cart!, The Art of E-commerce





























christianlouboutin
News
New Products
Featured Products
Specials
Register



























christianlouboutin

New Products

Specials

Featured Products

My Account

View Cart






Log In
or Register











Advanced Search









HEADER_SHOPPING_CART_EMPTY






























Categories

Christian Louboutin Boots
Christian Louboutin Bridal
Christian Louboutin d'Orsays
Christian Louboutin Discount
Christian Louboutin Evening
Christian Louboutin Mary Janes
Christian Louboutin Mens
Christian Louboutin Platform
Christian Louboutin Pumps
Christian Louboutin Sandals
Christian Louboutin Slingback
Christian Louboutin Sneakers
Christian Louboutin Wedges




Information


Shipping & Returns
Privacy Notice
Conditions of Use
Contact Us
Site Map
Gift Certificate FAQ
Discount Coupons
Newsletter Unsubscribe













christianlouboutin /a :: 
Christian Louboutin Mens  :: 
Christian Louboutin Leather Mens Shoes in Black CL08016
























Christian Louboutin Leather Mens Shoes in Black CL08016





























larger image










$148.00










Please Choose:



Size


US 5 UK 3.5 EU 36 CM 22
US 6 UK 4.5 EU 37 CM 23
US 7 UK 5.5 EU 38 CM 24
US 8 UK 6.5 EU 39 CM 25
US 9 UK 7.5 EU 40 CM 26
US 10 UK 8.5 EU 41 CM 27




































Add to Cart:













Product Name :Christian Louboutin Leather Mens Shoes in Black CL08016 Brand :Christian Louboutin Model :CL08016 Material : Leather Weight :1.4kg Size :EUR 39,40,41,42,43,44 Color :Black For People :Men In Stock :Yes Recommend Use :Outdoor Sole :Rubber Style :Casual span style="FONT-FAMILY: ?????







































































This product was added to our catalog on Wednesday 31 December, 1969.





































christianlouboutin


::

Conditions of Use


::

Shipping


::

Privacy


::

Site Map

::Blog






























Christian Louboutin official web site. You can buy Christian Louboutin Shoes, Christian Louboutin Boots, Christian Louboutin Pumps, Christian Louboutin Sandals,

Christian Louboutin Wedges, Christian Louboutin Slingback, Christian Louboutin Platform, Christian Louboutin Mary Janes, Christian Louboutin d'Orsays, Christian Louboutin Mens,

Cheap Christian Louboutin, Christian Louboutin Evening, Christian Louboutin Outlet, Christian Louboutin Discount, all products are Free Shipping! Buy Now!











































Christian Louboutin Bridal

Cheap Louboutin Bridal

Christian Louboutin d'Orsays

Cheap Louboutin d'Orsays

Christian Louboutin Discount

.No have any specific life likely qualities though just being infected which is often caused as a result of wearing an unacceptable kind in shoe.

It could be found together with the paws and fingers including on the palms which unfortunately becomes highly thick.These types of problems may be caused because of the shoes you wears.If that shoes are actually uncomfortable the skin in the requirement to protect itself gathers corns and also calluses and that is hardened as well as thick stratum of face.

In case you are already facing health issues then a lot of these corns can cause problems to your account.A diabetes persistent would deal with some trouble if corns surfaces on their hand or perhaps feet.The circulation of blood is less that causes more trouble

Other About Discount blog

Discount

About discountchristianlouboutinoutlet.com blog

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix