FAO Guardian CIF-ERS and Blair-haters: PLEASE CLICK AWAY NOW
THE BELOW WILL NOT INTEREST, AND DOES NOT APPLY TO YOU
Comment at end.
18th February, 2009
IGNORE THE CLONED BBC SITE
MR BLAIR IS STILL VERY MUCH ALIVE
For the last several days I have had searches in my stats like this:
” Tony Blair has died”,
“Former British Prime Minister killed”,
“Blair murdered by terrorists”,
“Top Secret. Tony Blair assassinated”,
“Al Qaeda suspected of killing Mid East envoy Blair”.
“BBC reports Tony Blair may have been murdered”
I ignored these searches, and put them down to wishful thinkers from The Guardian. The littlies, desperate for that sad day to dawn.
In fact it turns out that there is a trick website out there, cloned from the BBC news site, with a link to a virus download.
This website with its dramatic heading seems to have raised curiosity, unsurprisingly.
If you come across that site and are tempted to view the ‘car crash‘ which it claims killed him, you will be downloading a virus (Trojan.Agent-21076)
Be warned. Don’t do it.
If Mr Blair meets his maker before he should, I’ll let you know here. Through my tears.
Thanks to this site for the information, pasted below.
TONY BLAIR HAS NOT DIED TODAY
It seems like the Armenian Branch of Nathan Associates Inc (per a whois lookup of the IP address) is hosting a webpage claiming that former UK Prime Minister Tony Blair has died. As far a we know, Tony Blair is well as of February 17, 2009. This page uses the same template as BBC News. As soon as the page is loaded, the user is prompted to upgrade the latest “Adobe Flash Version in order to watch the video” of the car crash that allegedly took the life of Tony Blair.
Pic.1: Upgrade your Flash Version
Consenting to the flash update downloads: http://91.103.XXX.XXX/BBC_News_UK/2/hi/uk_news/bbc_movies/get_flash_update.exe
Pic.1: Trojan download
ClamAV detects this file as Trojan.Agent-21076. The Trojan changes the start page of Internet Explorer to the adult website adultmeeter.com and updates the Windows host file to contain entries for URL-to-IP mapping. This mapping effectively prevents users from accessing the websites for the banks Addey and Caja Madrid by typing abbey.com or cajamadrid.es in their web browers. The entries in the host file will redirect users to phishing websites.
- Thanks for this information due to VRT
- VRT blogspot: The Blog of Sourcefire’s World Leading Vulnerability Research Team
Tags: BBC reports Blair murder, cloned BBC news site Blair dead, former Prime Minister dead car crash, Tony Blair died, Tony Blair is dead, Tony Blair killed assassinated Al Qaeda, virus trap, vrus download trap Tony Blair
February 19, 2009 at 1:04 am |
as long as it is a hoax about blair i will be happy and i will pray for him to be safe
February 19, 2009 at 2:41 am |
It’s a hoax, margaret.
February 20, 2009 at 5:01 pm |
RE: your comment asking for more information
The ClamAV anti-virus tool detects this malware as we mentioned in the blog post. We have no information as to wether or not the site has been removed or if it has been moved to another site.
Most of the Anti-Virus engines should now detect this malware though.
February 21, 2009 at 1:01 am |
Thank you, Nigel.