<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<title>FW: ALERT: Virus attacking Myspace and Facebook RE: Weekly Top News Spam</title>
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Jim,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'> I have noticed the viruses as well. We are using
Smoothwall 3 with the email filter add-on. We have been very lucky as the Clam
AV engine is catching these viruses. This works only for POP 3 though. I would
be interested in what others are doing to combat the Facebook & MySpace
viruses.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Dan Will<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Technology Supervisor<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Meigs County District Public Library<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>willda@oplin.org<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>740.992.5813<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>740.992.6140 (fax)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>The difference between fiction and reality?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Fiction has to make sense.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;
color:#1F497D'>Tom Clancy<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> oplintech-bounces@oplin.org
[mailto:oplintech-bounces@oplin.org] <b>On Behalf Of </b>JKENZIG<br>
<b>Sent:</b> Tuesday, August 19, 2008 10:21 PM<br>
<b>To:</b> OPLINTECH<br>
<b>Subject:</b> [OPLINTECH] FW: ALERT: Virus attacking Myspace and Facebook RE:
Weekly Top News Spam<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>Admins...
note I have just sent the following out to my staff. You may edit and
pass along if you would like.</span> <o:p></o:p></p>
<p><b><span style='font-family:"Arial","sans-serif"'>Jim Kenzig</span></b> <br>
<b><span style='font-family:"Arial","sans-serif"'>Network Manager</span></b> <br>
<b><span style='font-family:"Arial","sans-serif"'>Cuyahoga County Public
Library</span></b> <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'>______________________________________________
</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p><span style='font-size:13.5pt'>We have received hundreds of notifications
from Trend today blocking viruses. I have determined that apparently it
is the same type of attack the Weekly top news emails use and it is coming
mostly from Myspace and Facebook pages. This is a tough one to block because
those two sites are probably the highest used ones in the library. (Below
is a description of how the Virus works.) </span> <o:p></o:p></p>
<p><b><u><span style='font-size:13.5pt'>Staff should use caution when going on
Facebook or Myspace from staff systems and continue to delete the Weekly top
news emails. Also avoid the temptation to follow links in unsolicited emails</span></u></b><span
style='font-size:13.5pt'>. <span style='color:blue'>Web pages suggesting
you download an update to flash or any other plugin for that matter should not
be clicked on and avoided. Remember ITD installs updates automatically
when necessary and only after they are tested in our environment. </span></span><o:p></o:p></p>
<p><b> </b><b><span style='font-size:13.5pt;color:red'>If patrons are
getting virus notification popups while on Myspace or Facebook and notify you
then this is most likely why and the Dell public computer with the problem
should be immediately rebooted if possible</span></b><span style='font-size:
13.5pt;color:red'>.</span> <o:p></o:p></p>
<p><span style='font-size:13.5pt'>There is also a very realistic popup going
around from many sites that states you have a virus and need to install
Antivirus 2009(aka Antivirus2009), they look like Microsoft prompts. There is
no such program with just that name and it will install spyware on your system!
Avoid clicking on these links. (note don't confuse this with Kaspersky
Antivirus 2009 which IS a valid real program)</span><o:p></o:p></p>
<p><span style='font-size:13.5pt'>Sorry this is so long, thanks for reading.</span>
<br>
<span style='font-size:13.5pt'>Thanks,<br>
Jim Kenzig<br>
Network Manager</span> <br>
<b><span style='font-size:13.5pt'>New worms target both MySpace and Facebook
users</span></b> <br>
<a href="http://www.kaspersky.com/news?id=207575670"><b><span style='font-size:
13.5pt'>http://www.kaspersky.com/news?id=207575670</span></b></a> <br>
Kaspersky Lab, a leading developer of secure content management systems, has
detected two variants of a new worm, Net-Worm.Win32.Koobface.a. and
Net-Worm.Win32.Koobface.b, which attack MySpace and Facebook respectively. As
part of their malicious payload, the worms transform victim machines into
zombie computers to form botnets.<o:p></o:p></p>
<p>Even though the worms are currently only infecting MySpace and Facebook
users, Kaspersky Lab analysts are warning users that the worms are designed to
upload additional malicious modules with other functionality via the Internet.
It is highly probable that victim machines will not only be used for spreading
links via these social networking sites, but the botnets will also be used for
other malicious purposes.<o:p></o:p></p>
<p>Net-Worm.Win32.Koobface.a spreads when a user accesses his/her MySpace
account. The worm creates a range of commentaries to friends' accounts.
Net-Worm.Win32.Koobface.b, which targets Facebook users, creates spam messages
and sends them to the infected users' friends via the Facebook site. The
messages and comments include texts such as<i> Paris Hilton Tosses Dwarf On The
Street; Examiners Caught Downloading Grades From The Internet; Hello; You must
see it!!! LOL. My friend catched you on hidden cam; Is it really celebrity?
Funny Moments</i> and many others.<o:p></o:p></p>
<p>Messages and comments on MySpace and Facebook include links to <a
href="http://youtube.[skip].pl">http://youtube.[skip].pl</a>. If the user
clicks on this link, s/he is redirected to <a href="http://youtube.[skip].ru">http://youtube.[skip].ru</a>,
a site which purportedly contains a video clip. If the user tries to watch it,
a message appears saying that s/he needs the latest version of Flash Player in
order to watch the clip. However, instead of the latest version of Flash
Player, a file called codecsetup.exe is downloaded to the victim machine; this
file is also a network worm. The result is that users who have come to the site
via Facebook will have the MySpace worm downloaded to their machines, and vice
versa.<o:p></o:p></p>
<p>“Unfortunately, users are very trusting of messages left by 'friends'
on social networking sites. So the likelihood of a user clicking on a link like
this is very high”, says Alexander Gostev, Senior Virus Analyst at
Kaspersky Lab. “At the beginning of 2008 <a
href="http://www.viruslist.com/en/analysis?pubid=204791987">we predicted that
we'd see an increase in cybercriminals exploiting MySpace, Facebook and similar
sites</a>, and we're now seeing evidence of this. I'm sure that this is simply
the first step, and that virus writers will continue to target these resources
with increased intensity”.<o:p></o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p>
<p><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'>_____________________________________________
</span><br>
<b><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'>From: </span></b>
<br>
<b><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'>Sent: </span></b>
<span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'>Monday, August
18, 2008 9:27 AM</span> <br>
<b><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'>To: </span></b>
<span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'>All-Mailer</span>
<br>
<b><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'>Subject: </span></b>
<span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'>Weekly Top News
Spam</span> <o:p></o:p></p>
<p><span style='font-family:"Calibri","sans-serif"'>There has been a lot of
spam coming with the Subject line Weekly Top News and a line it about some
crazy type of news story. If you click the link it will try and install
spyware on your computer. Please just mark these messages as spam and
delete these messages and do not follow the link. </span><o:p></o:p></p>
<p><span style='font-family:"Calibri","sans-serif"'>Thanks,</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Jim Kenzig</span><br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Network Manager</span><br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Cuyahoga County
Public Library</span><br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>jkenzig@cuyahogalibrary.org</span><br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>216-749-9389</span><span
style='font-family:"Arial","sans-serif"'> </span><o:p></o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p>
</div>
</body>
</html>