Dangerous Malware Detected on MySpace, Bebo, Photobucket and More

SiNXation 09-11-2007

A Trojan has been detected within advertisements that are being displayed on sites including Bebo, MySpace and Photobucket.

Ads from Right Media online ad exchange where reportedly unknowingly infected with the Downloader.VBS.Agent.n Trojan. What’s more, is the malwware doesn’t require any user interaction in order to infect one’s computer. One of the advertisements uses a Flash file to create an invisible iFrame, which is linked to an IP address containing obfuscated visual basic script and uses the MDAC exploit to download the malware.

The distributive nature of an ad network had made this Trojan particularly difficult to track down, and was even more so as a result of Right Media’s referrer check, meaning the advertisement isn’t activated until it’s delivered by a particular ad server. Less imposing malware has recently been detected on Skype and Blogger. The dangerous nature of this particular malware could be a setback for ad distribution networks.

SamiJo

okay so how would we find out if our computer was infected and if it was what could we do to get rid of it?

GIR

my Antivirus just wanted to do a update and same with my Windows for Malware. so update your anti-virus and scan and check.

SiNXation

Right now there not much much infomation on it. Since it doesn't you could already be infected it may not be active yet. A server has to activated it. I will try to post more infomation about if I can. Right now its on alot of sites including tomshardware, the sun. Basically almost any site can infect your computer right now and it works on all updated browsers. Although it doesn't work on my old K-Browser.

Hsoolien

With the number of permissions required for things to execute via my broswer I'm curious as to whether I even have a vulnerability.

Raven

Firefox is vulnerable even with all add-ons to stop, since i will still download it to the computer and be activated later it gets through. But not sure if it can be activated on it. I know alot of those sites I don't like but I don't want tons of people's computers infected.

Jessica

Atleast they did it smart on this one, put it on sites you know people are going to go to very often. Also say you got infected, can you get infect with this virus more then once, like say I could have 2,3,4,5,6 of these on my computer?

SiNXation

IE users can get infexcted only once becuase of cache methods.
FF users can get infected twice becuase of caching methods.
Opera no idea.
K-browser is immune, who would of guess.

This is a flash installed software so if you have one of the newer versions of flash you are at risk. This is why K-browser is immune since it uses a special version of flash. The virus is on mostly big name sites so small sites shouldn't be a risk high area. Any big name site that has flash driving ads are high risk areas.

This is major downside for sites like Youtube which is flash driven and can inject ads in videos.

Remove virus from FF:

• Uninstall
• Re-Install

Removed from IE:
Update virus scanner repeatedly til the end of the week. Mcacfee and Trend Micro have full protection from the virus. Norton can not detect the cirus when activate but can detect and remove if not activated.

SamiJo

I ran a virus scan it found one thing that said it could not be cleaned, Generic PUP.a - does anyone know what that is?

Passion

PUP = Potentially Unwanted Program

Basically it could be something you may need or want to keep on your computer. You need to know exactly what file it is and what uses that file before deleting it.

SamiJo

thanks - have a little research to do now