Facebook: “ATTENTION EVERY FARMVILLE NEIGHBOR - THERE IS A WHITE GIFT BOX” Virus Hoax is Spreading Wild

By Cesar Ortiz
Facebook Farmville users are hereby warned not to waste their time clicking or forwarding this message post. It is a hoax. There is no virus anywhere. Users will receive this message:

Beginning of quote

“ATTENTION EVERY FARMVILLE NEIGHBOR - THERE IS A WHITE GIFT BOX ...surrounded by a blue lace. It says "someone has sent you a gift" ... IT ISN'T BEING SENT BY FARMVILLE !!! IT'S A VIRUS!!! PLEASE DO NOT OPEN.. PLEASE COPY A PASTE THIS ON YOUR WALL SO THAT WE CAN ALL PROTECT EACH OTHER...........Very important KEEP IT GOING”

End of quote

Nothing evil on the contents of the post. No harm is done. We and all security experts that have researched this post agree that there is no malware related to the message. Since this message is reaching almost a million hits, you can imagine what a waste of time and resources this one is. We are glad that so far, as of this date, there is no harm involved. Those critics that say that we only publish malware related items, take note, this one is not a malware. Just ignore it or delete it from your desktop wall to save space and avoid that others will re-post to friends.

Twitter: “ Twitter Might Start to Charge in October, Sign This Petition to Keep the Service Free ” Scam is Spreading Fast

By Cesar Ortiz
In this variation of the “scares” scam, hackers are attempting to steal your user name and your password and in turn, your private credentials, and in effect, take control of your account for hidden criminal actions. Users will receive a message from one of their friends passing up the “news” of a possible monetary charge for the social service. Hackers are using human social engineering in making sure they are not mentioning a final determination to charge, but rather they mention that there is a “possibility”. Users will think that there is no harm to sign such a petition. The research firm Sophos warned of the scam originally. In the scam scenario,one of your friends that already have fallen in the scam will unknowingly send you a message post that will say:

"Twitter might start to charge in October, sign this petition to keep the service free! -URL- http:/bitly.zxxx[Link]”

Let’s pretend for a moment you are the victim user. When you click on the short link to access your petition, a problem “appears” to happen. You are then presented with a very, very Twitter professional looking frame with logo and perfect colors and typefaces (a fake). In the window you are warned that your session has timed out and that you need to "re-authenticate" and login again. Users will “need” to proceed and type their password and user name in the Twitter fake window. As soon as the user clicks the login button, a hidden script will propagate the same message received about the scam to all his or her friends, therefore propagating the scam. The same script will record your credentials.

Needless to say, the “petition” is not shown anywhere. Unsuspecting users that clicked the short link may expect that many other unknown actions will take place from that point on, since the criminals have the user name and password. Users who fall into this trap should move quickly and do the following:

(1) Change your password immediately.

(2) Go to the Twitter Web Site using a PC, if you can, and revoke any application with a related name to the scam and revoke and delete any unknown posts, photos, API’s and any post, friends or anything else that does not look familiar to you. Remember, the scammers had full access to your account and a malicious script can create and post anything using a hidden malware. Be on the look out for scam e-mails and scam phone calls. Take your time on this task. Twitter is aware of this scam and is taking measures to block, warn users and mitigate the scam damage, but scammers will change the location of their DNS servers and URL’s sites very fast to keep the scam alive.

(3) Notify your friends of the scam and help them clean up the mess, make sure that you mention that you did not send the scam related post willingly, but rather unknowingly.

(4) Run your anti virus in full scan mode and make sure you set the anti virus program menu to "Real Time" scan.

Twitter: iTunes Gift Card Scam Moves From Facebook to Twitter

By Cesar Ortiz

A variant of the familiar Facebook Free iTunes Gift card scam that we covered in this Blog on July 6, 2011 is back, but now is spreading virally in Twitter. The scam begins when users receive messages from their friends with enticing text that offer free iTunes Gift Cards. The message from the unsuspecting, already a victim, friend, read like the samples below:

(Beginning of quote)

“i have got,get yrs free iTunes Gift Card giveaway today [LINK]

wow,iTunes Gift Card got just today free lol [LINK]

awesome lol,today got iTunes Gift Card [LINK]

Your Chance to choose Your Best iTunes Gift Card [LINK]

Find out how to get a iTunes Gift Card! [LINK]”

(End of quote)

Unsuspecting users who click on the friend’s message about the “Free iTunes Gift Card” will trigger the scam hidden script immediately. According to security researchers, all of the scams will show a profile of a pretty female photo, at times wearing very few clothes or a bikini. The very professional looking window will tempt users to follow the lady, sometimes called Milda Fountaine or Lucy Adams with interesting feeds of tweets like quotes of the day, but inserted in the feeds is one that says:

 “[Blue letters link] Milda Fountaine2-Milda Fountaine awsome lol  today got iTunes Gift Card

www.arks.in/ogtd

xx minutes ago"

Users who click on the blue link before the Milda name in the hope of receiving a Free iTunes card will immediately send the same message that they just received to all their friends, therefore propagating the scam. After clicking the blue link, users will receive an enticing advertising or form related to the user location country and city. It could be an offer for a Friends Club, Dating Club or any male oriented  “pay per filled form” site that unsuspicious or shady merchants contract the scammers for. If you clicked on to “Follow” Milda Fountaine, you have given permission to the scammers to play and even hack your Twitter account. Another option is to invade you and your friends with scam offers. Please beware that a malware (virus, password, credit data hacks) link can be inserted anywhere in the scam, therefore creating a more serious problem. There is no iTunes Free Card anywhere.

To remove this hack from your Twitter account, (1) Go to the Twitter Website page, log-in to your profile (1) Click on your user window pull down arrow at the top right of the menu where your thumbnail picture is ( 2) Select “Settings” (3) Select “Applications” (4) “Revoke Access” to any related scam application (if any) (5) Delete all related tweets (6) Contact and help your friends to clean up their accounts (7) Run your Anti Virus in Full Scan mode.

United Parcel Service Fake Message Attack Still Alive.

By Cesar Ortiz

We are not beating on a dead horse; the UPS notification malware attack that was initiated around February 4, 2011 is making a comeback. In this scam users receive a very professional looking graphic message with an official UPS logo and brown colors. There is no text in the message, just that graphic saying:


“The parcel was sent to your home address. It will arrive within 3 business days. More Information and the tracking number are attached in the document below. Thank you. United Parcel Service. Copyright UPS, All rights reserved”

Do not click on the attachment, just delete the whole e-mail and your machine will be okay. If unsuspecting users click (open) the attachment, there will be a text saying:

“Subject: United Parcel Service notification #<random number> Attached file: USPS_Document.zip Message body: Dear customer. The parcel was sent to your home address. And it will arrive within 3 business days.More information and the tracking number are attached in the document below.Thank you.United Parcel Service.Copyright (c) 1994-2011 United Parcel Service of America, Inc. All rights reserved.”

Attached to the email is a file called USPS_Document.zip, which contains the malware attack. The damaging files are known as Mal/BredoZp-B and the Troj/Agent-QGH Trojan horse. These two malwares contain files that propagate in your computer and create problems in your machine, including making the PC inoperative. Up to date anti-virus and malware detection and cleaning software should be able to cope with the problem in some cases, if not, users are better off taking the PC to a qualified shop.This malware can be a nasty experience.

It is unknown, why this attack is making a come back. Normally, scammers will switch to a similar or new content attack when a scam have been around enough time to give anti-virus and malware detection vendors time to develop cleaning files, as in this specific instance. This malware is only capable of infecting computers running Windows.