Internet Scam — Fake News Website Loaded With Malware

There’s a new internet malware/scam/virus circulating. They’re targeting people by email directly. It is a web attack, a “Fake Facebook Survey 3” according to virus software. It attacks your hardrive while it is getting your personal information from you. It has been hitting website forums for a while now, but seems to be attacking individuals directly now by email.

We got this one sent from an associate’s email address:

“this is interesting http://business7newsaw.net/work/?page=09011”

If you go to http://business7newsaw.net, you will notice that the link points to a fake news site registered in Russia. It purports to have work related articles on it. None of the links work. It likely is sucking data from your computer while you’re on the site. If you go to the full page: http://business7newsaw.net/work/?page=09011, the Fake Facebook Survey begins…unless it is blocked by your virus protection software.

If you see this link, delete it immediately. The leading text in it may vary and the page it points to may differ, but the main address usually is http://business7newsaw.net

Here are some of the variations we found on the net:

you should check this out http://business7newsaw.net/work/?readme=24413

wow this is crazy you should look into it http://www.business7newsaw.net/work/?money=60675

here take a look at this http://www.business7newsaw.net/work/?alert=84122

this thing out http://www.business7newsaw.net/work/?finance=54060

this is pretty awesome you should look into this http://www.business7newsaw.net/work/?finance=76376

this is crazy you should look into it http://www.business7newsaw.net/work/?alert=35074

There are other versions of the message with different web addresses. Here, they have attacked a web forum – notice the fake user names:

”
you should check this thing out http://www.finance15elnews.net/biz/?news=9529152…
Bob Ukachukwu
bobfonukachukwu Jun 4, 2012
10:13 pm
hey
wow this is crazy you should look into this http://www.finance15elnews.net/biz/?page=0390271…
Selema Nwoye
snw2010@… Jun 5, 2012
2:00 am
hey
wow this is crazy you should look into this http://www.finance15elnews.net/biz/?page=0390271…
Selema Nwoye
snw2010@… Jun 5, 2012
2:00 am
hey
wow this is awesome http://www.finance15nonews.net/biz/?employment=6693773…
Emmanuel Ejiogu
Chiekwe123@… Jun 7, 2012
8:15 am
hey
this is rather awesome http://www.incomedt15news.com/work/?article=01511…
Richee Egenti
richegenti@… Jun 17, 2012
7:15 pm
hey
please look in to this http://www.localeanews15.net/work/?money=28344…
Arthur Obika
arthur_obika Jun 20, 2012
3:14 am
hey
wow this is crazy you should look into this http://www.newsawonow.net/jobs/?finance=32840…
Zubbie Ekwueme
zekwueme Jul 16, 2012
2:24 am
hey
this is crazy you should check the out http://www.consumernews7om.net/work/?alert=63936…
Cletus Curah
curah@… Sep 23, 2012
8:10 pm
hey
wow this is crazy you should look into it http://www.business7newsaw.net/work/?alert=35074…
Joseph Onwuazo
bendixent@… Sep 24, 2012
11:47 pm
hey
wow this is pretty awesome you should give it a look http://www.business7newspa.net/work/?money=74520…”

Here’s another list from a different web forum:

“hey
please look in to this http://www.financereview23.net/breaking/?read=45436… stephen mugarura
mugarura51 Feb 14, 2012
7:54 pm
hey
wow this is amazing look into this http://www.news15l.net/biz/?work=95548…
fred korir
frdkorir Mar 14, 2012
6:39 pm
hey
wow this is amazing look into this http://www.news15l.net/biz/?work=95548…
fred korir
frdkorir Mar 14, 2012
6:39 pm
hey
wow this is intense you should give it a look http://www.ca15news.net/biz/?page=4598606 ~*Advertisement…
leshou pierrot
knshu04 Apr 24, 2012
5:06 pm
hey
here take a look at this /biz/?page=0874609…
RUZIBIZA Violette
ruvivy Jun 12, 2012
12:22 pm
hey
this is crazy you should check the out http://www.business7newsca.net/work/?finance=62458…
Rukimbira Innocent
benroukynno Sep 24, 2012
6:59 pm
hey
awesome you should check this out wow http://www.business7newsaw.net/work/?finance=80353…
Fulgence AFRIKA
fntwali Sep 25, 2012
5:29 am”