Contained inside the ZIP file is a Trojan horse, detected by Sophos products proactively as Mal/Bredo-Q.

Here's a sample of the USPS fake:


...and a sample of the Royal Mail fake:

...do you really believe that you are going to be sent a smiley hat?

"And who is this un-named company that is planning to ask 750,000 people for their name and postal address?

"Is it possible they are planning to do anything else with that information if you hand it over to them?

And what - seriously - are the chances that they are going to spend the money shipping that many hats to people who don't even know what brand it is that they are promoting.

What should I do

Given the size of the Facebook network, it should be no surprise to any of us that the scammers are trying to target their next victims here, too.

The fine folks at antivirus software company Sophos have been keeping tabs on the latest Facebook scam, "Baby Born Amazing effect". This particular scam is being tracked by Sophos security researcher Graham Cluley who says,

Messages are spreading rapidly across Facebook, as users get tricked into clicking on links claiming to show an amazing video of a big baby being born.

"The messages are spreading with the assistance of a clickjacking scam (sometimes known as likejacking) which means that users do not realize that they are invisibly pressing a "Like" button to pass the message onto their online friends.

Now the real questions:

1. What danger does this pose?
2. How do I get rid of it?

What danger does this pose>

The actual danger to a Facebook user is pretty negligible.

The scam is that by tricking people into "Liking" their video, they're able to artificially inflate their Facebook "Like" count. Real "Like" counts tend to grow pretty slowly, so for someone looking to make a mint in Facebook, garnering a lot of "Likes" can bring in real money fairly quickly.

How do I get rid of it

Here's how:

[See: Image 1]
1. Find the offending message on your Facebook page.
2. Select Remove post and unlike.
[See: Image 2]
3. Go into your profile (top right corner)
4. Select "Activities and Interests"
5. Remove the "Born Baby Amazing Effect" (and anything else you don't like)

[Image 1]


[Image 2]


[N.B. We have to give full credit to Graham Cluley and Sophos for snagging these screenshots from within Facebook so we can help people get rid of this crap.]

Just to reiterate, this particular scam doesn't carry any typical virus payload and doesn't pose any threat to your PC. The only threat is in tricking other friends of yours to do the same thing and ultimately in helping a scammer inflate his or her bank account.

The one caveat here is that if you've made your Facebook personal profile information public, you have shared this information with the scammer, so who know what they're up to.

Put another way: you might want to reconsider what information you're sharing publicly within Facebook.

September is proving to be a busy month for the bad guys. Aside from the latest email worm, dubbed W32/VBMania@MM by McAfee, Adobe is also being exploited by the cyber criminals.

This latest bug (CVE-2010-2883), being called, "Critical," Adobe's highest rating, affects Adobe Reader / Acrobat versions 9.3.4 and earlier on the following platforms:

• Microsoft Windows
• Apple Macintosh
• Unix

According to Adobe, there are mitigation techniques available for Windows users, though an upgrade is definitely a better choice. Their official announcement warns,

Current exploits in the wild target the Windows platform. Customers using Adobe Reader or Acrobat 9.3.4 or earlier on Windows can utilize Microsoft's Enhanced Mitigation Evaluation Toolkit (EMET) to help prevent this vulnerability from being exploited.

"For more information on EMET and implementing this mitigation, please refer to the Microsoft Security Research and Defense blog. Note that due to the time-sensitive nature of this issue, testing of the functional compatibility of this mitigation has been limited.

"Therefore, we recommend that you also test the mitigation in your environment to minimize any impact on your workflows.

Possible effects of the exploit?

Adobe says, This vulnerability (CVE-2010-2883) could cause a crash and potentially allow an attacker to take control of the affected system, so, unless you have some very good reason not to upgrade your Adobe Acrobat/Reader immediately, you should.

For more details, here's a post from Sophos on Adobe Acrobat/Reader exploit and the official Adobe Reader/Acrobat security announcement.

Earlier this month, security researchers at Matousec released details of research they've done that, they claim, bypasses 100% of antivirus software.

As you might imagine, there's quite a bit of concern about this, particularly among business users, particularly because mainstream media has started discussing the so-called, KHOBE attack.

Let's dig into this a bit and see what's behind the hype.

What is KHOBE

It's an acronym for:

Put another way, it's a way for attackers to trick antivirus software. ZDNet's writer, Adrian Kingsley-Hughes, does a great job describing how this works here,

The attack is a clever 'bait-and-switch' style move.

"Harmless code is passed to the security software for scanning, but as soon as it's given the green light, it's swapped for the malicious code.

"The attack works even more reliably on multi-core systems because one thread doesn't keep an eye on other threads that are running simultaneously, making the switch easier.

Kingsley-Hughes goes on to say, Oh, and don't think that just because you are running as a standard user that you're safe, you're not. This attack doesn't need admin rights.

OK, now this is starting to sound like a pretty big deal.

Mitigating Factors with KHOBE

Here's where things *do* start to become more positive though:

Antivirus Vendor Responses

Sophos and Sunbelt aren't the only antivirus companies refuting the claims, security company F-Secure says,

We believe our multi-layer approach will provide sufficient protection level even if malicious code were to attempt use of Matousec's technique.

"And if we would see such an attack, we would simply add signature detection for it, stopping it in its tracks. We haven't seen any attacks using this technique in the wild.

Our Take on KHOBE

This is true not just for F-Secure, but for all Internet security software vendors.

If there were real-world exploits using this attack that they'd encountered, adding signatures for those attacks should be able to defeat the attack pretty easily.

Regardless of the outcome of the debate about this particular exploit, there are still a couple of take-away points as far as we're concerned,

1. Run the best antivirus software you can afford.
2. Keep it updated--frequently.
3. Even if you're updated and protected against known threats, it's critical to regularly backup your system so that if something does get by your defenses, at least you can restore your system to a point before the infection.

Police in Manchester, England, arrested two people in connection with the Zbot Trojans.

If you're unfamiliar with the ZBot Trojan, also called "Zeus," it's a nasty bugger that was responsible for over $415,000 being stolen from a Kentucky county's bank account earlier in 2009.

But that's not all it's known for.

Zbot/Zeus is, according to mention in a Sophos security blog is,

"...one of the most notorious pieces of malware of recent times.

"It's a data-stealing Trojan horse, designed to grab information from Internet users which would help hackers break into online bank accounts and social networking sites such as Facebook and MySpace."

That's just the start of it. Zbot also gets/got spammed to average people using the Internet using a variety of social engineering tricks to try to trick the unwary into opening an attachment or clicking on a link to a website hosting malware.

So, assuming the right folks were arrested, this could be rather good news. Let's hope that they did get the right folks, and let's hope also that even though they're out on bail already, they soon face the appropriate amount of justice--especially given how many people, companies, governments, and other organizations were harmed by their Trojan malware.

And, to the cops responsible for the arrest, again assuming they caught the right folks, "Well done."

There's a lot of hoopla about how much better Windows 7 is than prior versions at keeping viruses and other malware at bay and keeping people safe online.

What's the reality though?

Are the default settings in the Windows 7 User Account Control (UAC) all that's needed to protect your PC?

A lot of people want to know, and here's what we found out from antivirus vendor Sophos.

"We grabbed the next 10 unique samples that arrived in the SophosLabs feed to see how well the newer, more secure version of Windows and UAC held up.

"Unfortunately, despite Microsoft's claims, Windows 7 disappointed just like earlier versions of Windows.

"The good news is that, of the freshest 10 samples that arrived, 2 would not operate correctly under Windows 7."

Hrm... well, that doesn't sound good. Does the UAC work at all?

As it turns out, yes. In the Sophos' tests they saw that the UAC blocked 1 of the malware samples. At least that's a start.

Chester Wisniewski, the writer of the piece, goes on to say,

"User Account Control did block one sample; however, its failure to block anything else just reinforces my warning [Editor's note: registration required] prior to the Windows 7 launch that UAC's default configuration is not effective at protecting a PC from modern malware.

"Lesson learned? You still need to run anti-virus on Windows 7.

"Microsoft, in the Microsoft Security Intelligence Report released yesterday, stated that 'The infection rate of Windows Vista SP1 was 61.9 percent less than that of Windows XP SP3.'"

We'll go a step further. It isn't just antivirus software these days that's needed. It's firewall software, too.

Putting the two together (along with solid antispyware), as the Internet security suites do, along with using the Windows 7 UACs offers the best, most complete combination of software to protect your PC.

That said, is the upgrade to Windows 7 worth it from a security standpoint?

We think so.

Regardless of the failure of it to block 9 in 10 sample malware, that's what it's doing today. Give the engineers at Microsoft some time with their next service packs for Windows 7, and they'll no doube improve it even more.

Another thing to consider is that the sample size of 10 viruses isn't terribly big. With a greater number of threats, more representative of those you might actually encounter online, the UACs may help thwart some of the viruses.

But, as we see here, there's still no substitute for antivirus software.

One of the growing concerns for many security and antivirus professionals is the dramatic growth of fake antivirus software.

The idea behind fake A/V software is to trick unsuspecting consumers into downloading and installing their fake software in an effort to get trojans, viruses, spyware, and other malware installed onto PCs in the process.

There's nothing real about the fake software, except the threat it poses.

The process works like this:

1. Trick consumer with a real looking, real sounding ad on an (often unsuspecting) legitimate website
2. Get consumer to install the phony (but very real looking) antivirus application
3. Stuff any number of trojans, keyloggers, spyware, and other evil applications into the fake antivirus program
4. Use the newly infected computer to do their bidding, including (among other things):
   1. identity theft
   2. credit card fraud
   3. bank theft
   4. infecting other computers
   5. spamming

Solution to the Fake Antivirus Software Problem

Word is filtering out today about a way to tell fake antivirus software from legitimate ones.

A new site from security and SSL vendor Comodo of a project they're backing called, "Common Computing Security Standards Forum," aims to help consumers figure out what's real and what's not.

In their list of all known legitimate antivirus software vendors, they hope to help put an end to the dummy antivirus programs out there and to help consumers stay clear of the crap.

In addition to thanking them for their efforts, here is a complete list of current antivirus vendors known to Comodo to be the real deal:

You'll note, every one of the programs (reviews linked above) are included in our antivirus reviews since day one of our site are included on the list.

If you know of other legitimate A/V software not on the list, please contact us so that we can share your insight with the folks at Comodo.

It didn't take long for the spammers, scammers, and scumware makers to try to take advantage of Michael Jackson's sad passing.

SophosLabs brings news that,

"Just after about 8 hours of his demise, SophosLabs witnessed the first wave of spam messages employing the sad news in the subject line and body part to harvest victims’ email addresses."

A Computerworld.com article, which also mentions the SophosLabs blog, quotes Sophos security researcher Graham Cluely as saying,

"I wouldn't be surprised to see hackers claiming that they have top-secret footage from the hospital, perhaps [allegedly] taken by the ambulance people, that then asks you to install a video codec"

Then once you click on the supposed codec update link you're instantly infected with a virus / trojan. Blech.

Sad as it is to see criminals capitalizing on such events, we're not surprised. There's no depth too low for virus writers to stoop when it comes to trying to infect and take over your computer.

If you're unsure when the last time your A/V software was updated, you might want to take a look and see; if you're not yet running antivirus / Internet security software, there's no time like the present. I guarantee the people responsible for attacks like these aren't going to be easing up anytime soon--if ever.

Contrary to some reports that some Samsung 8-inch digital photo frames had worms, the frames themselves don't have worms but the installer discs do. (How's that for an unwanted Christmas present?)

As far as consumers are concerned, there's no difference.

A virus is a virus, and this is an unfortunate black eye for Samsung with their vast electronics / computer empire.

Trend Micro discusses this digital picture frame virus at their blog, and what we've learned now is that the Samsung's SPF-85H 8-Inch digital photo frame disc was infected with the W32.Sality.AE / Sality worm straight from the factory.

The bad news isn't that it's just infected with the worm, but that it's infected with a particularly nasty variant that includes a keylogger according to the folks at Sophos antivirus.

From what we've learned so far, this looks like, while definitely a nasty virus, it's one that all the best antivirus software already detects, so just make sure your definitions are up-to-date and that your software is running, and that should keep your computer safe.

Samsung has posted a clean version here: Samsung SPF-85H drivers.

If you purchased this frame (or got it as a gift), you can find more details here: Amazon Samsung picture frame advisory.