Troj/JSRedir-HW

Troj/JSRedir-HW is a malicious browser hijacker Trojan that is distributed through a spam email campaign involving fake email messages from Facebook. Basically, criminals send out email messages disguised as photograph tag notifications such as the ones Facebook sends out whenever a computer user is tagged in a photo. These email messages include a spoofed email address and a subject line that makes them appear authentic. However, looking carefully at the message, ESG security researchers have noticed that the email address for these supposed Facebook email messages uses three 'o's' to write Facebook – that is, 'Faceboook.' Clicking on the link for this supposed photograph leads to a malicious website that uses a JavaScript exploit in the form of a malicious iFrame script in order to attempt to infect the victim's computer system with the Troj/JSRedir-HW Trojan. To do this, this malicious JavaScript uses exploits in the Blackhole Exploit Kit. If you have committed the mistake of clicking on this fake link, ESG security researchers recommend using a reliable anti-malware program to search your system for possible malware.

With the rise of phishing email scams, ESG security analysts strongly advise being extremely careful when opening unsolicited email messages and always confirming their sender by mousing over the sender's address or checking email details before clicking on any links or opening any file attachments. In fact, ESG security researchers strongly advise against opening any email attachments contained in unsolicited email messages, even if they appear to have been sent from a credible source such as Facebook. The subject and sender for this malicious email spam message reads:

Subject: Christine McLain Gibbs tagged a photo of you on Facebook
From: Facebook

The sender's name can vary from one case to the other. Also, you will of course notice that the supposed Facebook email address uses 'faceboook' with three 'o's.' Clicking on this link leads to a Blackhole Exploit Kit attack. This exploit kit takes advantage of multiple known operating system and program vulnerabilities in order to attack your computer. It is important to understand that this attack takes place in just a few seconds and that after being directed to this malicious iFrame attack, the victim is actually taken to an actual Facebook page. This means that computer users exposed to Troj/JSRedir-HW may not even realize that they have clicked on a malicious link or been exposed to malware, instead believing that the supposed tagged photo was simply removed or that it was a simple Facebook glitch.