http://www.zdnet.com/blog/security/new-facebook-worm-spreading/9825

New Facebook worm spreading

By Dancho Danchev | November 30, 2011, 9:59am PST

Summary: Researchers from the Danish security firm CSIS, have intercepted a currently spreading Facebook worm.

Researchers from the Danish security firm CSIS, have intercepted a currently spreading Facebook worm.

The worm spreads by sending direct messages using the privileges of the already logged in user. The message looks like an image file, whereas in reality it has an executable .scr screensaver extension.

Upon execution, the sample drops a ZeuS crimeware variant on the infected host. The malware is hosted on compromised web servers across the globe.

The sample — very limited detection rate — is currently detected as Win32.HLLW.Autoruner.52856 and Heure: Trojan.Win32.Generic.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

 

--
Thanks for being part of "PoliticalForum" at Google Groups.
For options & help see http://groups.google.com/group/PoliticalForum
 
* Visit our other community at http://www.PoliticalForum.com/
* It's active and moderated. Register and vote in our polls.
* Read the latest breaking news, and more.