Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Back to news

New Trojan targets Facebook, Twitter and Google Plus

May 16, 2013

Russian anti-virus company Doctor Web has discovered previously unknown features in the new malware for Facebook that has been widely discussed in the mediadoesn't simply change a user’s status, join groups and leave comments on the user's behalf, but it can also send spam on Twitter and Google Plus.

Trojan.Facebook.311 is a JavaScript plugin for Google Chrome and Mozilla Firefox. Attackers use social engineering methods to spread the Trojan; a special malicious program disguised as a security update for watching videos facilitates the Trojan's installation. It should be noted that the installer incorporates a digital signature belonging to Updates LTD which is owned by Comodo. The plugins' names are Chrome Service Pack and Mozilla Service Pack, respectively. To spread the Trojan, criminals created a web page in Portuguese, apparently for Facebook users from Brazil.

screen

After the installation and as soon as the browser is launched, Trojan.Facebook.311 attempts to download a file containing instructions from a remote server. Next, the plugin waits for the user to authorize on Facebook. After that, the Trojan horse can perform actions on a user's behalf in accordance with instructions found in its configuration file. These include marking something with “like”, updating a status, leaving a message on a wall, joining a group, leaving a comment, and inviting a user on the friends list to join a group or sending that user a message. In addition, when commanded, the Trojan can download and install new versions of the plug-ins and send spam on Twitter and Google Plus.

screen

Recently Trojan.Facebook.311 posted messages containing an image that mimics an embedded media player. Clicking on the image redirects the user to various bogus sites. Similarly, the Trojan sends personal messages and updates a user’s status to advertise rogue quizzes in which one supposedly can win a variety of prizes.

screen

The threat's signature has been added to the virus databases, so it poses no threat to systems protected with Dr.Web anti-virus software. Despite the fact that criminals are targeting the citizens of Brazil, the scheme can be implemented for any target group. Doctor Web recommends that users exercise caution and refrain from downloading and installing suspicious applications or browser security updates.

Tell us what you think

You will be awarded one Dr.Webling per comment. To ask Doctor Web’s site administration about a news item, enter @admin at the beginning of your comment. If your question is for the author of one of the comments, put @ before their names.


Other comments

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2019

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040