Password Reset Email is New Facebook Virus

Facebookers Alert! There is an email circulating with an attachment stating itself as the new password prompting you to open it, pls ignore the email and delete it.

Security firm MX Lab said in a blog post Tuesday it has detected a new Bredolab variant masking itself as the "Facebook Password Reset Confirmation." According to MX Lab, the From address in the email is shown as "The Facebook Team ", but this address is spoofed.

The attachment has the name Facebook_Password_4cf91.zip and includes the file Facebook_Password_4cf91.exe. The part between _ and .zip at the end is choosen randomly and contains letters and numbers.

The trojan is known as Trojan.Downloader.Bredolab.AZ (BitDefender), Bredolab.gen.a (McAfee) or W32/Obfuscated.D2!genr (Norman) and is only detected by 14 of the 41 AV engines at Virus Total, MX Lab researchers said.

The body of the email is as follows:

Hey [random user name] , Because of the measures taken to provide safety to our clients, your password has been changed.

You can find your new password in attached document.

Thanks,
The Facebook Team

According to MX Labs, Bredolab is a trojan horse that downloads and executes files from the Internet, such as rogue anti-spyware. To bypass firewalls, it injects its own code into legitimate processes svchost.exe and explorer.exe. Bredolab contains anti-sandbox code (the trojan might quit itself when an external program investigates its actions).

This email has also been documented to be a hoax here.

I would recommend that you read about other recent popular Facebook scams as well:

• Five Facebook, Twitter Scams to Avoid
• Five More Facebook, Twitter Scams to Avoid.

Click here to get a more technical rundown of this trojan.

Windows 7 - Improve your experience with these 77 tips

Windows 7 is set to debut on October 22, 2009.

These 77 tips will enhance security, performance, and functionality for this new operating system:

http://technet.microsoft.com/en-us/magazine/2009.10.77windows.aspx

QUOTE: Windows 7 may be Microsoft’s most anticipated product ever. It builds on Windows Vista’s positives, and eliminates many of that OS’s negatives. It adds new functionality, too—all in a package that is less resource-hungry than its predecessor.

At a Glance:
■ Make Windows 7 faster
■ Get more done with Windows 7
■ The best Windows 7 shortcuts
■ Securing Windows 7

The dangers of exposing information on social networking sites

Here's an interesting podcast by Dr. Herbert Thompson, the Chief Security Strategist at People Security, discussing on why we should practice regular identity hygiene checks on social networking channels to prevent leaking sensitive information that can be used in identity theft (e.g email account password reset).

Fake Facebook, Fake Video, Fake CAPTCHA

Watching videos on Facebook is a popular activity, so it's not surprising to find dozens of fake copycat sites being used to infect unsuspecting viewers with malware.

Here's one fake Facebook site with a malicious JavaScript that uses the old "Flash Player upgrade installation" trick — but with a slight twist.

Read on to see how this is accomplished.

Conficker Eye Chart (at a glance)

Conficker (aka Downadup, Kido) is known to block access to over 100 anti-virus and security websites. Need some refresh your memory? Read these previous posts.

Here is a cool website to test if your computer is infected with this malware.

However if you are using a proxy server, you will not be able to use this test to make an accurate determination, since Conficker will be unable to block you from viewing the AV/security sites.

Researcher: Hackers Hijack Some Facebook Apps

Full time Facebookers take note.

A number of games and other applications built to be used on Facebook.com have been hacked so that users are quietly sent to sites that try to install malicious programs, a security researcher has found.

A number of the applications Thompson named in his research -- including one called Pass-it-On, and another called City Fire Department -- are no longer available on Facebook.com.

Full report here.