Two weeks after its first appearance, a new variant of the recent Facebook worm is spreading again. The worm propagates by sending out links of alleged video clips on what looks like a YouTube page to all the friends in the victim’s facebook account. Following the spammed link will end up infecting your system with the worm.
The fake YouTube page of the video is designed in a way that makes it look as if it was uploaded by the person who sent the message.
Once this worm is run, it contacts a server in order to receive the content of the messages to be sent. The server supplies the worm with the subject of the spammed message, the body of the message, and links with obfuscated URLs pointing to the fake YouTube website.
The sent messages attemp to entice users into clicking on the spammed link using sentences such as:
• “Your ass looks not bad in this video”
• “Who and when made this video of you?!!!”
• “Nudity makes you beautiful. Who made this video?You look disgusting this video!”
The link leads to a fake YouTube page which then requires an update for the user’s Flash player in order to watch the video. Clicking on the button will end up downloading an executable that if executed, will infect the victim’s system with the worm. According to VirusTotal, only 11 out of 36 antivirus products detect this variant of the worm.
The following are the symptoms of infection:
1. The worm copies itself as: c:\windows\fbtre9.exe
2. It also creates the following file: c:\windows\fmark2.dat
3. It creates the following registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
"sysftray2" = "c:\windows\fbtre9.exe"
4. This worm also deletes the following registry key:
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating
