...at least, according to the links posted (which I actually read; did the author? ;)). Trouble is, if true this isn't really a bug, it's correct functionality being abused. One for advertising vendors, perhaps, not browser developers.

Playing with a bit of wget and changing the user agent to Firefox/IE, the quoted exploit site appears to just redirect me to Google's home page. Does this mean that someone's already clobbered the target site? Or is it looking for some bit of cleverness that I failed to duplicate? I run NoScript on Firefox so if that's the vector then I'm not likely to find out by accident.

A user came by with a laptop, then later a desktop, where the clipboard wasn't functional and would only paste a similar link yesterday.

A fresh Ad-Aware install + Avast found nothing, rebooted and things were fine. Haven't seen it since.

I've received a lot of spam email today, supposedly from MSNBC Breaking News. Actual return email addresses vary.

Is this how the virus/trojan/malware is being spread?

I have recently had to write JavaScript code that reads and writes the clipboard, and making it work for Mozilla is painful. You need about 30 lines of gobbledegook, and even then it doesn't work unless you change a security setting in about:config, and you then still get a warning when the code first runs.

The interesting thing is that permission to access the clipboard is covered by the same setting as the most serious types of access, such as reading and writing local files. So it's not impossible that the hole that's being exploited here could be put to more unpleasant purposes.

But if it's flash, perhaps things are different.

This week I have had a fair number of msnbc news updates in my spam as well as nearly as many cnn news updates.

Most likely it is a small Flash (SWF) embedded object on the page. It continuously copies data to the clipboard.

I encountered this once when taking an opinion survey.

to google with iceweasel under linux or telnetting to web site. Connects to internetscanner2009.com if running under XP and tries to get user to install the program AV2009Install_77011807.exe by lying about infected system. I will try and find the method/advert used to get link into the clipboard. could take sometime.

This happened to me on July 29th while browsing technology and news sites (so nothing I expected to be particularly dangerous) with Firefox 2 and Linux. I then pasted the link, I saved the AV2009... file and tested it with an online virus scanner. It tested negative. The day after, it tested positive.

At the time I could not find information about this on the web, but this exact attack has been in the wild for at least two weeks.

I just ignored the MSNBC spam assuming it was piggybacking on the CNN top ten junk from last week.

Not sure it's related but a lot of the sites listed in the forums have had tons and tons of spam sent out in their names in the past several days... yesterday alone our spam server recorded over 7,000 emails from "MSNBC".

Coincidence? Probably.

Flash is full of obnoxious features ripe for abuse by malvertisements. If it's not the clipboard access, or cookies you can't block with the normal browser controls, it's the mundane irritation of pop-ups, surprise LOUD auto-playing sound and CPU-killing animations.

The Firefox Flashblock extension - or some similar means of disabling such plug-ins by default in other browsers - is the only sensible response.

Flash can only write to the clipboard, with a simple

System.copyToClipboard()

call. It cant read the clipboard.

After spending an hour setting up a new VM and over 2 hours browsing News and social networking sites (shudder), I just could not get infected, had clipboard viewer up all the time not a single bite. What this exercise has made me realise is how absolutely vital NoScript and AdBlock are to browsing. I was amazed at the amount of flashing junk and pop ups dominating websites, especially the American news sites. It's a shame I didn't find the swf or script that does this, I am curious how this is done. I will have another try tomorrow.

While using Facebook on Safari recently, with no other sites open, I got a pop-up window with an xp-vista-update.net URL. I can only guess it was due to a malicious ad served on Facebook. Looks like these goons have more than one vector.

I'm 90% certain I got hit on the Ars Technica site. I was using IE7 and the only strange thing I noticed was one of the ads was making some kind of clicking sound. My network folks scanned my comp. but didn't see any malware.

Possibily, they are just hoping that someone will paste a link and go to it.

Yep, I know, which is why I clarified my moan about read access with "(in IE at least)" because since version 5, it can read the clipboard contents (provided it's text) with an equally simple.

var clipContents = window.clipboardData.getData("text");

I believe Opera has clipboard access too. Attempting to read the contents of the clipboard will at least throw up a warning in IE7 but since when has a silly security prompt stopped the majority of users from clicking OK?

This is the code from clipboard.swf:

// Action script...

// [Action in Frame 1]

saveToClipboard = function (str)

{

System.setClipboard(str);

flash.external.ExternalInterface.call("copy_success");

};

flash.external.ExternalInterface.addCallback("setClipboard", this, saveToClipboard);

//END

So a Java function called via the onload command of a page or pop up would paste a url passed to the function to the clipboard.

Not as devious as I thought, however this will only copy to clip once, I expect some looping java script is what accomplishes the constant refreshing.

This does not seem to work with the clipbook service disabled, as I have on my work machine.

Browsing Digg - Can only paste xp-vista....

Close Digg tab - Can paste anything

Only happens on some digg pages - Infected ad?

Care to expand, is it apparent with safari, firefox oe what?

I browsed Digg but didn't get infected, any chance of a link to an infecting page?

It is the same malware/crapware as "XP antivirus 2008". I've seen Google ads for this gem, that is worse than a real virus infection. They demand money to fix a problem they caused. Oh the joys of windows.

I did a quick Whois on the domains : xpantivrus.com, xp-vista-update.net, internetscanner2009.com. All registered under estdomains.com, in Delaware, US. The latter 2 use estdomains' DNS. Doing some more digging, some of the DNS servers come back to eosads, in the Motherland:

Registrant Name: Daniel Adams

Registrant Organization: eosads

Registrant Address1: 13 Baterman Street

Registrant City: London

Registrant State/Province: London

Registrant Postal Code: W1D 3AF

Registrant Country: UNITED KINGDOM

Registrant Country Code: GB

This forum:

http://www.bluetack.co.uk/forums/index.php?s=950ad5e6359847c4dfb715d9e753bfcf&showtopic=18064&st=60&p=87715&#entry87715

shows that this stuff has been going down since April or so.

So, maybe you Brits need to go door-knocking?

I don't know any browser/OS combination that would be immune, except for one without flash, though this only directs to a malware page, Linux/OSX* will almost certainly be immune to the .exe file even if its successfully pushed hrough firefox/opera/safari.

*Not necessarily from conventional security, but because these people will go for the biggest target.

Had an odd thing the other day possibly linked with this. I couldn't open FF, said it was already running. Checked the processes and sure enough there it was but no visible instance. Killed the process and we were back in business. Sounds similar to how this exploit operates but I didn't notice anything odd with the clipboard, that said I can't recall if I used the clipboard.

Stranger still, I run NOSCRIPT and this still appears to keep FF running, although maybe it didn't hijack my clipboard....

combatwombat: it's no use looking at any of the whois information in these cases. The addresses given are invariably either:

a. completely made up

b. just copied from some other entity's address

c. mailboxes/forwarding companies

The people behind these fake anti-virus apps are Russian hackers coming from the AWM scene (and others in the Russian satellites). The registrar Estdomains (aka Esthost, Inhoster, UkrTelegroup, Cernel, Rove Digital and a multitude of other aliases) are themselves blackhats, directly in on the porn->exploit/fake-codec->trojan/fake-AV-install game. So they're not too fussy about correct whois details.

You could complain to ICANN and get the domain revoked in, what, six months. But these guys constantly change their names and register hundreds of new domains, so it's kind of pointless.

Did you check out some of the "xploits" that are listed by the "virus scanner" (scanning my linux box with a very nice imitation of an XP dialog of course)

Spyware.EI.Monster.b

ZLob.PornAdvertise.Xplisit

Trojan. InfoStealer.Banker.s

They forgot, of course;

Malware.WifeStealer.CockSucker

XP.PasswordCracker.Attack

and of course my all time favourite

All.MyVirusAreBelong2.You

Using malwarebytes and spybot for a few registery settings that malwarebytes misses gets rid of it. At least in the 10 or so cases I've cleaned in the past 2 or 3 weeks, although I haven't seen any with the 2009 version which might have a few differences from Winav2008.

The "bad" is superfluous, as there can be no "good" in that context.

Another point for adblock I suppose. Soon flash ads will have made it impossible to make money out of a free to view website because everyone will have adblocked everything.

Of course, it would be far too difficult to expand the redirect page to check what OS you're running and provide an OS-based scan, or to offer a Mac download? The whole point is that it scares users into downloading something they don't need, pay for something they don't need (ie put their card details into the site, so not just paying for one thing), and possibly screw their PC by downloading it. If a user is prepared to download and run something, once they run it and get told it might be unsafe they'll probably still run it won't they?

Even worse, there's not going to be any AV on a Mac already to pick it up as dangerous. I'm not the biggest fan of Macs, but you have to be able to see that there is roughly the same (high) percentage of naive Mac users as PC users. As Macs get more popular, it's only a matter of time before a scam like this is adapted for Macs, it just makes sense.