Ok everyone.. public service announcement time. There is a new Facebook-related virus going around that my friend Alison had until I helped her clear it up last night. It spreads via appending a url to your Facebook Chat messages that you MAY or MAY NOT see yourself. The url is similar to this but I’ve deliberately obscured the “http” bit so that you won’t click on it, so for god’s sake if you do type this in out of curiosity, DON’T run the .exe file that it downloads:
h**p://turl.ca/photo4912?=facebook-pic-04-21-2011.JPG
When someone clicks on the URL, rather than getting a JPG image, it downloads an EXE file with a name like facebook-pic000494991337.exe and of course, when you run it, it will infect you and cause you to start spreading it as well. Alison left me talking to one of her six year daughters a few days ago and when she sent this to me and I wondered why what appeared to be the URL of a JPG was instead forcing a Windows Executable file down my throat, I was like “Uhh, Ali, you have a virus”, but it took me a while to realise that SHE wasn’t seeing the URL she was sending me, only I was, so she didn’t know what I was talking about at first, which is probably the case with yourself or your friends if they are likewise infected .. they probably have no idea they are spamming you with this dangerous URL.
If you use Facebook, and especially if you are one of Ali’s 620 friends (nothing personal Ali, it’s not your fault you got this virus, I’m just trying to help your friends here), you should ask everyone you chat to regularly if they’ve seen you type the URL listed above in a Facebook Chat.
The other hint that you may have this virus is if you find that on start-up, or during operation of your computer, you get sent to a page with this URL:
http://showmelove.gr/css/
It LOOKS mostly like Google, but it lacks the extra menu options that Google normally has, and if you scroll down the page further, you will see it has lots of blog posts that look like legitimate news articles, but that you would not find if you went to http://www.google.com … so if you get a Google window pop up suddenly, check the URL, and if it has this URL in the address bar, you know you have this virus.
So if you don’t want to hear the lengthy explanations about what this virus does and how and why and all that rubbish, I will quickly explain how to get rid of this thing for good, and if you care about the mechanics of it, you can read on to my boring explanation afterwards
What is this virus ?
In short, this virus is a newer variation of the virus known as:
Dropper.Generic3.BBGJ
Gen:Trojan.Heur.hqW@yXUOwjfO
IMWorm.Win32.Yahos.ig
Win32/Yimfoca.AA
W32/Obfuscated.A!genr
Trojan.Win32.Generic.pak!cobra
AVG calls this new variation “SHeur3.BVYJ” and it appears to be the only anti-virus program that calls it that, so that would suggest that either no other anti-virus detects this new version, or else if they do, they call it something different.
How do you get rid of it ?
The vast majority of anti-virus software cannot yet detect this new virus, or even the earlier strain listed above. The main ones that can at least detect some of the older strains include AVG, F-Secure, and NOD32, but most other main ones such as McAfee, Kaspersky, Sophos, Symantec (Norton), TrendMicro etc cannot, so this virus will go largely undetectable in around 90% or more of the antivirus software out there. I am personally going to recommend you use AVG to kill it off though, because a bit of research tells me that AVG seem to be by far on the top of their game when it comes to detecting this strain of viruses, as in their most recent definition updates, they are detecting dozens of variants of it, and while I haven’t compared them all, because I don’t have the time or inclination to do so, of those, AVG is the most well known and arguably best free scanner of those, so I recommend you use that, and as I mentioned above, AVG is the only vendor that knows of it by the name that I gave of “SHeur3.BVYJ”.
What problems you will encounter
The main problem is going to be that if you have this virus, it would appear to prevent you going to the AVG website, because the author apparently knows that AVG are onto them, and as a result tries to stop you downloading AVG or accessing their site in any way. As a result, you most likely will not be able to access the AVG website without getting fatal errors (regardless of browser) if you have this virus, but even if you CAN access avg.com please do not assume that means you aren’t infected, because results seem to vary, and I have only seen the variety on Alison’s computer, and the variety on my own that I deliberately infected myself with and they acted slightly differently. But if you CAN’T reach the http://free.avg.com website, and it either just says you’re not connected to the internet (when you know you are), it cannot display the webpage, or it throws some obscure XML error at you, it almost certainly does mean that you are infected, so either way, follow this next piece of advice.
How to get around that problem.
Ok, since the virus seems to be focussed on the website address, the best solution is to get a copy of AVG elsewhere. It doesn’t appear to monitor the filename itself, but I haven’t tested extensively, but it does block access to the AVG website, so what I’ve done is I’ve downloaded the latest version (as of 23rd April 2011) of “AVG Free 2011″ and made it available on my own website under an innocuous name that it won’t detect based on either the website URL or the filename. While normally I would tell people never to download a program from someone you don’t know, or from a strange location, in this case, just shut up and trust me, ok ? I wouldn’t be writing this crap if I was out to infect you, I’ve clearly put too much time and effort into it.
The additional problem comes into play because the primary version of AVG that you download is not the full program, but a simple installer which fetches the rest of the program off the internet, which it will most likely be unable to do due to access to the AVG website being denied by the virus. In Alison’s case, she was able to use the small version and had no problems installing it. Why she had no problems I don’t know because I don’t have access to her computer to check in further detail, but when I infected myself with the same virus, I could not install the smaller version and I had to get the full version, so I am not going to suggest the smaller version to you because the chances are it’s not going to work. So, you can download the latest “full” copy of “AVG Free 2011 for Windows” from this URL:
http://catpa.ws/pics/bigthingforali.exe
So how do you use AVG and clean this damn virus off ?
If you’re comfortable installing and running AVG yourself, just go right ahead, there are no surprises in this section, and I will only go through this for those of you who are afraid to install this or confused by what some of the options mean. If you happen to have a different anti-virus program installed, I do urge you to disable it first. This is normally done by going down to the “System Tray” box beside your clock at the bottom right of your Windows task bar where the little icons are, and holding your mouse over each for a second until you find your anti-virus software and then right clicking on it and choosing the logical option, be it “disable”, “exit”, “quit”, or whatever seems the obvious thing. It doesn’t always matter if you can’t do this, but anti-virus vendors always strongly recommend you do this, because it is possible that simply by the act of holding in memory the signature for the virus that it’s looking for, one anti-virus program may be detected by the other anti-virus program as being a virus itself, which is sorta gonna screw things up for you for obvious reasons. If worst comes to worst and you are having this happen, just uninstall your old virus software and if you need to, later after you’re done cleaning the virus up, you can then uninstall AVG and install your old software again, though it’s possible that AVG’s superiority in this particular case may lead you to stick with it.
When installing AVG, you will at one point be prompted whether you want the full “internet protection suite” or just the basic antivirus. If you have another anti-virus program, then make sure you ONLY select the basic antivirus, as having two different “security suites” is going to be massively problematic. If this is your only antivirus package, by all means, install the full suite if you want the extra protection, but in my personal opinion, I believe that such programs often slow your computer down unacceptably for what they provide, so the decision is up to you – either opt for the better protection, or choose less intrusion and less additional software running in the background. The next screen will ask you a couple of questions about whether you want to install the “security toolbar” and some other question. You absolutely don’t want this crap so untick both options. I know it has it’s benefits such as anti-phishing and stuff, but realistically, unless you’re desperate for extreme protection, don’t do it.. it will only slow your computer down, and you don’t need that.
When you finish installing it, you should see a balloon pop up in your system tray (near your clock) that tells you that the program is out of date and requires updating. Click on this balloon to initiate the virus definition updates, which is very important to do before scanning for new viruses such as the one we’re dealing with today. This will initiate an update, and after a few seconds or some minutes, you should see a small window slide up in the background telling you that your virus definitions are now up to date. Though to be honest, since the virus is blocking your access to the AVG website, there’s every chance that it won’t be able to update its virus definitions, but in this case, the program itself may be enough, so just try it anyway. Your mileage may vary, as they say.
If you want to at this point, you can disable any of the components that you don’t need on the configuration screen that should still be visible. Personally, as I said earlier, I don’t really believe in all the protection crap, and all I want is a plain virus scanner that I run myself and nothing else, so I untick everything except the virus scanner, and also probably the “resident shield” which is basically a virus scanner that stays in memory and looks for any signatures that pop up in memory. This is a an extra burden on your computer, but it’s an acceptable one in my mind and probably worth putting up with for the benefits gained. And you most likely want the “anti-spyware” option as well because that is always a good idea in this day and age, but I would mostly tend to disable the other stuff. “Email scanner” sounds like a good idea in theory, but to be honest, it can be a real pain, and if you have the resident shield, it’s going to warn you if you get a virus via email anyway, so that’s enough in my opinion. It is possible to have “too much” protection, and this can cause problems and also slow things down.
At this point, just hit the “Scan Now” button over the left hand side of the window and it will perform a “whole computer scan”. Now, when Ali ran this, she tells me that it did identify “multiple threats” on her computer (whereas TrendMicro had sworn there were none), but that without her intervention, it had just removed the threads and moved on and started a second scan without her telling it to. Now, either I didn’t understand her properly, or she didn’t explain properly and she did press something, but I find this rather odd, because when I scanned, it stopped and told me what virus it had found. Since she’s about 4000km from me and I don’t have access to her computer, I don’t know why this was the case for her, but it doesn’t really matter because either way, whether it tells you about the virus and prompts you to remove it (I believe the term it uses is “quarantine” and of course you should answer affirmatively), or it just does the scan, deletes it for you, and scans again, that’s fine.
The end result is that it will be gone. When it’s finished scanning, reboot your computer straight away and then when it restarts, run the scanner again to make sure it’s not re-infecting at boot, because many viruses do this. If, after a reboot and another scan, AVG tells you that you don’t have any viruses, then yay, you’ve killed this nasty little bugger and you can rejoice and go back to Facebook safe in the knowledge that you’re not spamming your friends with URLS that will give them a dangerous virus. What you SHOULD do though, is tell ALL of your friends that you have had this virus, and direct them to this web page and suggest they scan for it as well, even if they haven’t seen or clicked on this URL from you, because this virus is doing the rounds, and it’s better safe than sorry and there could be newer variations out there that I haven’t encountered or described, so best get them to install AVG anyway and scan to be sure, because you never know what variant is going to turn up tomorrow, and even if your friend says “It’s fine, I have a virus scanner”, please warn them that this virus is simply not picked up by the vast majority of scanners at the time of me writing this at 23rd April 2011 (The previous variations I mentioned above were only seen in the wild in March, and I suspect this new one came along in April sometime, so it is VERY new), and since AVG detects far more variations of this than anyone else, urge them to install AVG and scan anyway ! You can never be too careful !
One thing I won’t specifically insist you do because I don’t THINK it’s necessary, is that you should consider changing your Facebook password because it would not be too difficult for this virus to steal it. But as I explain in the detailed explanation later in this article, I don’t THINK that’s what this virus’ goal is. But it really wouldn’t hurt for you to do this, and if you really want to be sure, and it would bother you if your Facebook page got totally trashed and all your friends spammed to hell and back by the author of this virus if he decides “Hey, this wasn’t effective enough, I’m gonna use all those stolen Facebook passwords and do something even nastier”, then seriously.. change it to be sure ! Because there is genuinely a valid black market trade in stolen Facebook passwords out there and there ARE many viruses whose goal is to do just that – steal your password and sell it to someone nasty and unpleasant. So unless you’re very blasé about the whole Facebook thing and you just really don’t want to change your password because you’re terrible at remembering them, by all means, don’t. But if your page gets trashed or your computer or friends infected further, don’t say I didn’t warn you.
And my final comment to those who don’t want to read the more detailed explanation below is that you should NEVER EVER run a program (ie, a file ending with .exe) from a website that you don’t trust completely, and even if a trusted person appears to send you to it, don’t trust them either. If ANYONE for ANY reason gets you to go to a web page, and it causes an “.exe” file to download, DON’T RUN it, and tell the person immediately what’s happened and ask them if they intended to send you to that link, and if they didn’t, then they are infected and you should urge them to install the latest virus software (in this case, I recommend AVG), update it, and scan, reboot, scan again. And to be honest, the same often goes for Word documents or even PDF files. If someone ever sends you to ANY file that isn’t an image such as a .GIF, a .JPG, a .BMP, or a .PNG, then you should be IMMEDIATELY DUBIOUS about it and ask the person what it is and if they meant to send you to it, and only open it if you both trust the person, AND they confirm they meant for you to open it.
The boring stuff
I did write a lot of stuff about this virus, but to be honest, most of it is speculation and based on circumstantial research due to the fact that there is little to no information about this virus or indeed any of it’s family available on the internet. I’m not into viruses, either making them or dissecting them. It’s just not my thing. I use only Mac and Unix systems so I’m as good as invulnerable to viruses anyway, so the only reason I’m even writing this, is because I want to make sure Alison’s friends and any of my own friends on Facebook are adequately warned about this and take steps to clean their computers, even if they don’t think they have it.
The main reason that I think that SHeur3.BVYJ is related to the other viruses that I mentioned at the start of this article is that all the viruses mentioned all operate by in some way spamming a user via some communications medium and sending the victim to a url starting with:
http://turl.ca/photo (followed by a number and then some other info that is just to make it look like a legit image for instance.)
The number after the word photo differs for each virus variant, because I guess each virus wants to send you to download another copy of itself, but they could just as easily choose to send you to download a different variant than the one the infected person has been infected by. They could do this by having some form of “auto-updating” system whereby they “phone home” to a central location, which tells them to change the way they operate and start spreading the newer variant instead, which would make it particularly tricky to eliminate. I don’t know for a fact that this family of viruses do that, but it’s plausible they could, since they all direct the victim to the same website, but with different targets depending on the strain.
The other thing that my research tells me that they do, and the actual reason for them to exist, beyond propagation, is that they collect information of some sort, most likely your web browsing history and possibly your friends list and email addresses etc, and they send it off to a third party website to collect for nefarious purposes. Some of the variants send the data to these websites for example:
tokyonews.edns.biz
tokyoIP.freewww.info
But I haven’t bothered to sniff the traffic of this particular strain to see what it does, because it’s 9 am in the freaken morning and I’ve been dealing with this goddamn virus ALL BLOODY NIGHT, even after Ali rage-quit Facebook on me and stopped helping me because she was being moody about some stuff I’ll politely choose not to go into which meant I then had to setup a Windows computer of my own and infect myself with the virus so that I could clean it and identify what the virus was actually called. Ultimately, I’m just not that interested. If you are, sniff it yourself because I don’t care that much.
It is POSSIBLE that it steals your Facebook password, because it would be very easy for a trojan to do, but this virus’s manifesto seems to be about intercepting network traffic, and Facebook uses the HTTPS protocol to log you in, so it could not easily do that. To be fair, it could easily do it via a keylogger as well, but most Facebook users log in once and it keeps them logged in, so to be honest, I don’t think this is all that likely, which is why I haven’t insisted that you to do this. But if you want to be careful, and changing your password doesn’t bother you, you should definitely do it, because virus authors are crafty people and often have an extra ace up their sleeves, and just selling your personal data to spammers may not be enough for you. They may also want to sell your Facebook or even your email passwords to the Russian Mafia, I dunno. If I could be bothered dissecting and monitoring this virus I could tell you with more conviction whether it does this, but as I said… I just don’t have the time or inclination, so be as careful as you want to be. If having your email passwords stolen would be the end of the world for you, then by all means, change them. I just don’t think that’s this virus’ goal, but again, I don’t know because I’m too lazy to check in greater detail !
One thing of interest that may be worth noting is that the different variants of this virus spread via different means. I suspect that their goal of stealing your personal information and browsing history is probably the same for all of them, but it would seem that the author or authors (because I suspect this virus family may have been created with a “do it yourself” virus creation kit) are basically using the same basic virus, and then just experimenting with different ways to distribute it, either to achieve wider distribution, or because they’re curious and want to see which one works the best. I haven’t researched them all because I don’t have any idea how many other variants there are, and the ones I list at the start of this article aren’t different variants, they’re just different names for the same variant, which I have chosen to use as an example because they seem related to this new one. But that previous one uses not Facebook, but MSN to propagate, but via a very similar means.
What I imagine it does (because this is how I would achieve it if I were writing it, and there are other hints that I shall go into), is that rather than directly affect your web browser itself, what it does is it just sits in the background and watches all your network traffic, and when it sees the right type of traffic that indicates either an outgoing MSN message in the case of the old variant, or a Facebook message in the case of the new one, it just intercepts that message before it goes out to the internet, and it attaches itself to the message at random (it doesn’t do it to every message you send, but curiously it seems to get more virulent as time goes on, and by the end of last night, nearly every second or third message Ali sent me had the virus URL attached, whereas a few days ago it rarely did it at all), and then goes out to the recipient.
The reason this is such a logical way for it to operate is that it doesn’t have to worry in great detail about needing to infect specific software. It just needs to know how the software sends messages and what they look like when sent, which is something that anyone with a packet sniffer and a little networking knowledge can work out, and makes the development of new strains that affect different software protocols much easier.
The other reason I suspect it works this way is because the user sending out the Facebook message does not see the URL in their message initially, only the recipient. So the person sending the virus spam is unaware they are even doing it, unless the victim realises what’s going on and brings it to their attention as I did with Alison, which makes it extra dangerous. However, due to the nature of Facebook being an “AJAX-based” web application (unlike MSN which will not exhibit this trait), if you reload the web page by hitting the “reload” button in your browser, or if you click a link on Facebook that causes it to load a new page, it will cause Facebook to re-send you the data for the page, including the messages that YOU sent, and because Facebook DOES see the URL that you’re spamming, when your page is reloaded, all of a sudden you WILL see the URL attached to your message, so if someone tells you that you’re sending out weird links via Facebook Chat, this is a good way to test… just hit the reload button on your browser (or even close Facebook and re-open it) and see if you can see the link now, because if it operates the way I have described above, by intercepting your traffic rather than messing with your web browser directly, then the chances are you will see the spam you’re sending out ! Nifty, huh ?
I’m gonna leave it at that for now, because I’m tired and I’ve been at this all night and that’s really all you need to know. You know what the virus is, the common signs that you or someone else have it, how to get rid of it, and even how it operates. The only thing I can’t say with absolute certainty is what it DOES, but as I explained, my research suggests that if the rest of its siblings are anything to go by, it steals your browser history, probably monitors what email addresses you send mail to, and other such things in order to send them to spammers. Basically it wants to sell your and your friends personal information to a third party who’s willing to pay money for it. I won’t get alarmist and suggest that it intercepts your internet banking or anything because I have no proof that it does that, and frankly, all but the most hardcore virus writers steer clear of that stuff, because it carries much heavier penalties than just stealing personal information and you go to jail for a long time for cleaning out someone’s bank account, so it’s not worth assuming that it does anything of this nature unless there’s proof that it does. Hopefully more information about this virus doesn’t come to light in coming months and prove me wrong on this assumption !
If you want any more information about this virus that I didn’t bother to include here in this already lengthy article, or you want to contact me to talk to me because you love me for doing this and want to thank me and send me cartons and cartons of beer, I’m totally open to that, and my email address is pawz@teamroot.net and I would be happy to respond to queries about viruses (although as I explained, they’re not my particular field of interest) or internet security and hacking prevention (which is much more my field), but I would prefer that if you needed help cleaning this virus and you can’t follow these instructions that you could please find your nearest neighbourhood geek and ask them for help, because frankly, I don’t have the time to answer ten million questions like “I have this other weird virus, how do I get rid of it ?” because I probably don’t know unless I spend another night researching it for you, and unless you happen to be my childhood girlfriend like Alison is, I’m most likely to politely tell you to find someone else to help you. But having said that, if you really have absolutely noone to turn to for help, and there’s something about my article you don’t understand or need a little help with, fair enough.. email me and I’ll see what I can do. I am a nice guy after all, just don’t expect miracles or a whole night of my assistance like I’ve given tonight unless you’re willing to shell out for it in the form of cash or booze. :”)
- pawz (pawz@teamroot.net)
Last year, Steve Jobs said he wasn’t going to work full time at Apple. He was becoming a “background CEO” and would continue to work from home. We knew what that meant.
Fuck Windows. Fuck it in the arse with a rusty star picket.
