Downloader: Fake Facebook antivirus spreads through tagged photos, wall post spam

Monday, March 29, 2010

Fake Facebook antivirus spreads through tagged photos, wall post spam

I have no doubt that most of our regular readers would know better than to install a site-specific antivirus app...But unfortunately for the Internet, there are plenty of people who will believe that something called Facebook Antivirus could really offer them protection from malware on the popular social networking site.

Nothing could be further from the truth, of course. Facebook Antivirus is just another piece of useless malware feeding off unsuspecting users. Facebook is a tantalizing target for the scareware pushers with an audience of several hundred million users, many of whom don't know the difference between real and fake antivirus programs.

Like many other rogue antivirus apps, Facebook Antivirus uses images "borrowed" from legitimate software. The interface above, for example, is ripped from Panda Cloud Antivirus and the app also uses a Norton icon in certain places. The familiar yellow circle and stethoscope is all the convincing it would take for many users to install the malicious app.

Once a profile is infected, the rogue goes to work tagging your photos with 20 of your friends and then publishes the photo to your wall. Friends receive update notifications, stumble across the Antivirus, unknowingly click through, and spread the infection.

Facebook will no doubt shut down the app soon, but it's important to remember to be careful what you click. Less experienced users who need a little extra help identifying threats should check out some of the free tools we've mentioned before like WebOfTrust and the list of real free antivirus programs for Windows.

The good folks at F-Secure have posted a number of screenshots of FB Antivirus and you'll find information at Facebook Insider that will help you clean up your photos and wall if you've been victimized by the rogue program.