Microsoft puts the kibosh on Facebook worm Koobface

[ronjor]

-{ Quote: "By Gregg Keizer

March 11, 2009 (Computerworld) Microsoft Corp. is trying to stamp out the Koobface worm, which has spread aggressively on social networking sites such as Facebook and MySpace, the company said yesterday.

In a post to the company's malware protection center blog, researcher Scott Molenkamp said that definitions for Koobface have been added to the Malicious Software Removal Tool (MSRT), the free anti-malware utility that Microsoft automatically delivers every month to users on Patch Tuesday.

The MRST can be downloaded manually from Microsoft's site, or retrieved via the Windows Update service." }-Article (http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9129428)

[jmonge]

-{ Quote: "Article (http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9129428)" }-
thanks alot for this value info:thumb:

[ronjor]

You're welcome. :)

[jmonge]

i downloaded the updates from microsoft and also i was told that prevx edge stop it cold:) thanks again and please when you find similar info let us know:)

[Sully]

@Ronjor

I love it. You used the word kibosh. lol. But, is that really how you spell it ;D

Sul.

[Rmus]

Isn't this the exploit where the victim gets infected after clicking a link to watch a video and then agreeing to update the flash player when a pop up appears?

----
rich

[Triple Helix]

Yes it is!

TH

[ronjor]

That's the one. -{ Quote: "Koobface spreads by sending notes to friends of someone whose PC has been infected. The messages, with subject headers like, "You look just awesome in this new movie," direct recipients to a website where they are asked to download what it claims is an update of Adobe Systems Inc's Flash player." }--{ Quote: ""People tend to let their guard down. They think you've got to log in with an account, so there is no way that worms and other viruses could infect them," Boyd said." }-Reuters (http://www.reuters.com/article/newsOne/idUSTRE4B37LV20081204)

[Rmus]

Ah, yes - I remember now. This is a rather old exploit isn't it? I snagged a screenshot of the ploy back in December:

207031

A year or so ago several of us gave some thought to the exploits making the rounds of the social network sites and wrote a few guidelines for users we know. They included,

1) Always verify the receipt of an image or link from the person who sent it. This is just an extension of good email procedures.

2) Always update plugins directly from the vendor's site using a bookmark, rather than respond to a message while on a web site.

Later, we added this great advice from Brian Krebs: Never install something you didn't go looking for.

Happily, no one we know has ever fallen for these tricks.

Social network sites can be navigated and used safely with basic security procedures in mind.

----
rich

[ronjor]

-{ Quote: "Social network sites can be navigated and used safely with basic security procedures in mind." }-While that is true, it is only true for those with a knowledge of secure computing. Judging by the number of infected computers out there, the message is not getting through.

[Rmus]

-{ Quote: "While that is true, it is only true for those with a knowledge of secure computing. Judging by the number of infected computers out there, the message is not getting through." }-I certainly agree, which is why I and a few others last year decided to do something about it and make sure that at least those we know who use these sites get the message. This is especially important in families where children use these sites. In these cases, parents can control what gets downloaded/installed.

----
rich