[nsp-sec] Spate of "anjelina" video EXE malware

[Jose Nazario]

Folks

As most of you know we've been seeing a flood of malicious EXE links with 
the common the subject of videos of Angelina Jolie (often misspelled with 
a "j").

Do we know how these EXEs are getting on these servers? Am I correct in 
assuming these are compromised websites?

If we know how these EXEs are getting on these servers, do we have clear 
information for the hosting sites - victims here - to detect, remove, and 
prevent such malcode incidents?

This would be targeted in remediation/followup emails outside of the 
NSP-SEC community.

-- jose

-------------------------------------------------------------
jose nazario, ph.d.  <jose at arbor.net>
security researcher, office of the CTO
Arbor Networks
v: (734) 821 1427
PGP: 0x40A7BF94
www.arbornetworks.com
-------------------------------------------------------------