Microsoft helps Facebook administer a worming

According to Microsoft's Malware Protection Center, the March update for the Malicious Software Removal Tool (MSRT) led to a dramatic reduction in the number of Koobface worm infections on Windows PCs. The signature for detecting the worm was added to MSRT, apparently at the behest of Facebook's security team, to clear the worm from PCs belonging to Facebook users.

Koobface uses crafted profiles on Facebook and MySpace to offer users what purports to be a video codec for playing films. According to an analysis, around 40 per cent of decontaminated systems were located in the US and approximately 14 per cent in the UK. None-the-less, with 200,000 disinfections, Koobface was not the most frequently removed piece of malware in March. That honour went to Taterf, a piece of malware that spreads via network shares and steals passwords for online games, which MSRT cleared from 1.5 million computers.

Microsoft is including further signatures in its tool at the request of CERTs and other organisations in order to blunt major threats. Due to the limited number of signatures, MSRT does not represent a full-featured anti-virus program, but it has nevertheless already proven its value. In late November 2008, it cleared one million PCs of scareware. The standard version of MSRT that is downloaded by Windows Update runs automatically in the background. A version that can be run on command is available to download from the Microsoft MSRT page.

See also

• Adobe warns about falsified Flash player updates, a report from The H.
• Microsoft clears 1 million PCs of fake anti-spyware, a report from The H.

(crve)