SmallBizResource Blog -- Security

Koobface Virus Still Stalking Facebook

Posted by Gayle Kesten Tuesday, Dec 9, 2008, 03:07 PM ET

A slimy worm is leaving its gooey trail across Facebook, posing as members' friends to ultimately hijack their machines via bogus e-mail that's delivered via the social network's messaging system.

The Koobface virus, which first surfaced in the summer and then reappeared at the end of last week, affects only Windows-based computers, but could impact businesses that have tie-ins with Facebook, said Dave Marcus, security research and communications director for McAfee Avert Labs, in an interview with InternetNews.com.

Here's the method behind the malware's madness: A Facebook member (let's say you) receives a message that appears to come from a friend and tells you how amazing you look in a new video. To see that video, you're told to click on a link, which sneakily whisks you away to a compromised site that tricks you into updating your Flash software. Your attempt at an honest update enables an executable file that installs the Koobface worm, which installs a proxy server that redirects Web searches and enables ad hijacking and click fraud.

"Unfortunately, users are very trusting of messages left by 'friends' on social networking sites. So the likelihood of a user clicking on a link like this is very high," says Alexander Gostev, senior virus analyst at Kaspersky Lab, which detected the worm.

Facebook has listed Koobface on its security page ; it's working on purging the spammed links from its system, "but with dozens of Koobface variants known to exist, the situation is likely to get worse before it gets better," McAfee said.

Facebook suggests members run an antivirus scan and reset their passwords.

Internet | Marketing | Security | SmallBizResource