MySpace Users Decked Out With Adware

In a campaign remiscent of the October 2003 QHosts Trojan attack, visitors to MySpace, WebShots, and other popular websites were exposed to a malicious banner ad that attempted to foist ClickSpring's PurityScan onto unpatched systems. The banner advertised the website DeckOutYourDeck.com. The ad was reportedly hacked to exploit a security vulnerability in the handling of WMF image types. A patch for the WMF vulnerability was released by Microsoft in January 2006. Those who visited the ad-bearing sites and had not yet applied the patch would have been subjected to drive-by installations.

1.07 million impacted
According to a report by Brian Krebs of the Washington Post, a website tracking the installations reported 1.07 million users may have been affected. This is not the first high profile attack on MySpace users. Earlier this month, ZDNet reported that a rogue affiliate created MySpace profiles that offered up free videos in exchange for installing the Zango toolbar from 180Solutions.

All of this presumably prompted UserFriendly.org to dedicate Sunday's comic strip to the plight of MySpace users. While the comic strip is a good laugh, it's important to remember that the social networking site MySpace is itself a victim of the attack.