ThreatFire Research Blog Home
 
 
« Spamvertizing Social Networks and Why Legitimate Money Will Help Clean Them Up
$4.5 million for Unencrypted Communications »

Koobface on Yuotube

The Koobface gang and their inability to spell is a giveaway for the latest of their trick pages. If you end up at a page that states “This content requires Adobe Flash Player 10.37. Would you want to install it now?”, and the title of the page is “YuoTube”, your spidey sense should start to tingle.

The latest Koobface trick includes thousands of accounts at Google Reader (many continue to be up). Here is a shot of what today’s Reader pages look like hosting phony YouTube videos:

GoogleReader

Of course, these Google Reader pages are not new, and are not particularly notable, as other groups have used the same scam in the past year to drive the same redirections to other sites that host the malware. Here is one that is up today, a giveaway is the Title of the page “YuoTube”, instead of “YouTube”:

YuoTube

At the same time, the older Koobface style of flash player update pages served by the same gang all over the web appear to be more attractive to users, and attract many more hits. They are up and fooling users as this post goes up, here is a representative page to look out for, which, if you read this blog, you’ve seen before:

OldStyle

The phony “setup.exe” codec installer (which is really the Koobface malware) and the scheme still tricks many users. Don’t get fooled.

This entry was posted on Thursday, November 12th, 2009 at 1:43 pm and is filed under Koobface, Social Engineering, Undetected malware. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

3 Responses to “Koobface on Yuotube”

  1. Kat says:
    December 25, 2009 at 8:08 pm

    how do you know if or when you do need to install a new version of your Adobe Flash player? My son is often on Youtube looking at his fav cartoon character and a few videos would not come up without installation. Can you please advise?

  2. ThreatFire Blogger says:
    December 29, 2009 at 1:58 pm

    Hi Kat- Thanks for reading the blog.

    This blog really isn’t the spot for Adobe support, but here are a few thoughts. Adobe provides the Flash Player client for web browsers. Normally, when you cannot view a flash object on another site, the web sites will tell you that you either have javascript disabled or an old version of Flash. If you see that prompt (or a video just isn’t working) and you haven’t disabled javascript, type http://www.adobe.com/software/flash/about/ and hit enter. The Adobe site will identify the version of Flash running in your browser and list the latest versions available from Adobe. The latest versions of Adobe products also include a “download manager”, which may help you keep on top of Flash and Reader updates, if you use them both. If your version of Flash is current, the problem is most likely not your browser or its add-ons.

    You can post questions like this one on the PC Tools community forums, where you’ll get advice from members, employees, and volunteer gurus:
    http://www.pctools.com/forum/

    Thanks!

  3. jane says:
    January 3, 2010 at 2:31 pm

    you know what i get it. i think i just figured it out. but an going to continue to read on. a person must be prety smart to know all this stuff.

Leave a Reply

Click here to cancel reply.

 
  • Blog Archive

    • March 2010
    • February 2010
    • January 2010
    • December 2009
    • November 2009
    • October 2009
    • September 2009
    • August 2009
    • July 2009
    • June 2009
    • May 2009
    • April 2009
    • March 2009
    • February 2009
    • January 2009
    • December 2008
    • November 2008
    • October 2008
    • September 2008
    • August 2008
    • July 2008
    • June 2008
    • May 2008
    • April 2008
    • March 2008
    • February 2008
    • January 2008
    • December 2007
    • November 2007
    • October 2007
    • September 2007
    • August 2007
  • Search This Blog

  • RSS Subscribe Now

    • FBI IC3 2009 Report
    • FakeAv Antivirus XP 2010
    • Troyak-AS De-peered for Good?
  • Categories

  • About ThreatFire

    ThreatFire™, features innovative real-time behavioral protection technology that provides powerful standalone protection or the perfect complement to traditional signature-based antivirus programs.

    ThreatFire's patent-pending ActiveDefense™ technology offers unsurpassed protection against both known and unknown zero-day viruses, worms, trojans, rootkits, buffer overflows, spyware, adware and other malware.

    Learn more...

  • Blogroll

    • A.M. Infosec
    • AV-Comparatives
    • iAntivirus
    • Mind Streams of Information Security Knowledge
    • Symantec Security Response
    • Tech Thoughts
    • ThreatExpert
  • Links

    • AMTSO
    • AV-Test
    • ICSA Labs
    • PC Tools
    • PC Tools is on Facebook
    • Reconstructer
    • ThreatExpert
    • ThreatFire
    • Uninformed
    • Virus Bulletin
 
Subscribe to:
Posts (Atom)
Entries (RSS) and Comments (RSS).