Kaz (kazbaby) wrote,
Kaz
kazbaby

WARNING Rootkit virus embedded in video via comment spam

Originally posted by [personal profile] ninja007 at WARNING Rootkit virus embedded in video via comment spam
Originally posted by [personal profile] campylobacter at WARNING Rootkit virus embedded in video via comment spam
Lately, I've had to delete about half a dozen spam comments from various entries on my LJ & at other communities. They've all shared a commonality: a single embed & link to a YouTube video in Portuguese titled "Camarate: A confissao de Farinha Simoes" or in English titled "Dying call from prison. Details about Portugal Premier Minister air-crash!"

screengrab of video

DO NOT PLAY THE VIDEO. (That's just a screengrab of it, not the actual functioning embedded video.)

The video contains a Windows rootkit virus that keylogs your passwords & posts spam using your LJ account, not to mention some other stuff that may be more sinister, all unbeknownst to you.
[SOURCE: [Warning] Serious rootkit virus spreading in LJ comments by [profile] luma_chan ]
ETA: 25 July 2012: In this comment by [personal profile] brooke, we've been discussing the LACK of recent anti-virus articles about trojans that exploit the YouTube Flash video codec. Neither of us can find anything about computer malware being spread via playing a video.

Known accounts [now up to 56] that generate these spammy malware comments:
  1. [profile] 1310ardfey 108 comments posted 
  2. [profile] ageh822 77 comments posted
  3. [profile] aldovid 98 comments posted
  4. [profile] ambrosinev127 comments posted
  5. [profile] analiseacalo 93 comments posted
  6. [profile] andfeaaa71 90 comments posted
  7. [profile] blanchidovi135 comments posted
  8. [profile] bolvul 86 comments posted
  9. [profile] brinsonpuvyb 130 comments posted
  10. [profile] buehlerkos 134 comments posted... [more behind cut]


List of reported known bot accounts
  1. [profile] 1310ardfey 108 comments posted 
  2. [profile] ageh822 77 comments posted
  3. [profile] aldovid 98 comments posted
  4. [profile] ambrosinev127 comments posted
  5. [profile] analiseacalo 93 comments posted
  6. [profile] andfeaaa71 90 comments posted
  7. [profile] blanchidovi135 comments posted
  8. [profile] bolvul 86 comments posted
  9. [profile] brinsonpuvyb 130 comments posted
  10. [profile] buehlerkos 134 comments posted
  11. [profile] bunchgen 126 comments posted
  12. [profile] dangelodow 124 comments posted
  13. [profile] dulcleopyqy 154 comments posted
  14. [profile] elfontomek 135 comments posted
  15. [profile] fhatit829 81 comments posted
  16. [profile] golubcavav 98 comments posted 
  17. [profile] hatcheqan 137 comments posted
  18. [profile] herwinifab 137 comments posted
  19. [profile] hofmannfuvuw 119 comments posted
  20. [profile] iernaulegu 122 comments posted
  21. [profile] jenamenute 75 comments posted
  22. [profile] jonmeino 95 comments posted
  23. [profile] justiczjatu 95 comments posted
  24. [profile] karcooo83 95 comments posted
  25. [profile] kassite 108 comments posted
  26. [profile] khalidaky 95 comments posted
  27. [profile] lockfatev109 comments posted
  28. [profile] lorisxuva135 comments posted
  29. [profile] mafirusii0 86 comments posted
  30. [profile] marowov570 86 comments posted
  31. [profile] mehygqo 90 comments posted
  32. [profile] meratee05250 97 comments posted
  33. [profile] milburrujyvy 116 comments posted
  34. [profile] millfordiqy 100 comments posted
  35. [profile] mortieywize 137 comments posted
  36. [profile] ngpase 106 comments posted
  37. [profile] nieboman 91 comments posted
  38. [profile] nofamcmehyn 96 comments posted
  39. [profile] nonxautore 95 comments posted
  40. [profile] normunb 85 comments posted
  41. [profile] novund89 comments posted
  42. [profile] octavianes 103 comments posted
  43. [profile] oicuee218 115 comments posted
  44. [profile] omne807 98 comments posted
  45. [profile] oniskeytosap 106 comments posted
  46. [profile] oroolkodd101 comments posted
  47. [profile] osvelxa4211 80 comments posted
  48. [profile] owenddhd 99 comments posted
  49. [profile] paicuo 104 comments posted
  50. [profile] philemonan 120 comments posted
  51. [profile] pilpmaddyjo 102 comments posted
  52. [profile] planteujy 122 comments posted
  53. [profile] proplasmoc 92 comments posted
  54. [profile] reereree00 110 comments posted
  55. [profile] rjwoily 99 comments posted
  56. [profile] symanuvawe 80 comments posted
  57. [profile] veatorecu 122 comments posted
Let's get LJ admins alerted to this exploit (the more reports, the better!) by following these instructions:
1. Hover your cursor over the little LJ userhead userhead next to the username.
step 1

2. In the box that pops up, click the "Ban user" boxes that apply. (Community owners & moderators see the "in my communities" ticky box.)
ban

3. Click the "Report a Bot" link to notify LJ admin of the spam account.
report bot



Alternate link to report a bot:
http://www.livejournal.com/abuse/bots.bml

Alternate link to ban a user:
http://www.livejournal.com/manage/banusers.bml

Warn your LJ Friends:


Originally posted here. Feel free to comment there using OpenID if you don't have an account.|comment count unavailable comments
Tags: lj, psa
Subscribe
  • Post a new comment

    Error

    default userpic

    Your reply will be screened

    Your IP address will be recorded 

    When you submit the form an invisible reCAPTCHA check will be performed.
    You must follow the Privacy Policy and Google Terms of use.
  • 0 comments