Now: A virus from blogspot.gr comes with a Facebook message

A new virus is currently circulating at Facebook. It is hidden behind a hidemyass.com address (a service απόκρυψης IP και domain) και οδηγεί σε ιστοσελίδα του blogspot.gr. Ο ιός δεν μπορούμε να πούμε ότι έρχεται από Ελληνικό blog καθώς η  blogspot αλλάζει την κατάληξη των domains ανάλογα με την γεωγραφική θέση του επισκέπτη. Με μια καλύτερη ματιά όμως τα πράγματα αλλάζουν.

Below you can see the message που διακινείται μέσω του Facebook. (Την picture our friend sent it to us from safer-internet.gr)

If someone clicks on the "secure Youtube Video" that comes with the Facebook message, they are taken to the following address.

The page that opens represents Youtube but the video (classic) will not play unless you install the "adobe flash player."

In the screenshot of the blog below you can see the Greek name that the malicious user uses: Note the URL of the page. The title of the post is sugar cookies (This page is displayed with Firefox)

If you use Firefox you need to download the file (video) that is actually a Windows executable (.exe) file.

If someone uses Chrome and opens the hidemyass URL, the executable file will be downloaded on its own.

See the page displayed in Chrome

The malicious file is downloaded with a different name each time, since the numbers it contains change each time. So the "Private_Video_23429.mp4.exe" next time it downloads changes to "Private_Video_xxxxx.mp4.exe."

What is happening with the virus now:

We uploaded the malicious file to jotti.org, The virustotal and VirSCAN. You can see them Results and which antiviruses recognize it.

More information about the virus and the files it imports into the infected system below:

PE sections

PE imports