This post is completely unrelated to City of Villains, it’s regarding a web offender trying to trick me into installing malware masked as an update to Flash Player.

I was sent a link to a fake youtube-like site, http://www.facebook.com/l/127ca;bit.ly/dfjqi, that told me that I need to upgrade my Flash player. Filename is setup.exe, size is around 40k, file icon reminds of MSN messenger and according to file information, the original name is “HpqUnSet.exe”.

The virulence is only recognized by four out of 40 anti-virus programs, and it is known as W32/Koobface.G.gen!Eldorado and Win32.HLLW.Facebook.358. The malware file as well as the fake youtube site is hosted on the IP address 66.57.218.131