Tuesday, December 27, 2005

Fake 'MSN Messenger 8' Trojan

Mikko writes over on the F-Secure "News from the Lab" Blog:

There is no MSN Messenger 8 yet. Not in public beta anyway.

However, there's a new virus going around pretending to be "MSN Messenger 8 Working BETA".

There's two ways to catch it. First, by downloading it from a fake site where it has been supposedly "leaked":





If you download and run BETA8WEBINSTALL.EXE from that site, you won't get a new chat client. Instead, your existing MSN Messenger will start to send download links to everyone in your contact list. It also connects your machine to a botnet server.

The download link always contains the recipients' email address. For example, if you'd have a friend with email address huuhaa@foobar.com, he would get a download link like msgrbeta8.com/im.php?msn=huuhaa@foobar.com:





We've just added detection for this one as Virkel.F.

0 Comments:

Post a Comment

<< Home