I've seen a fake YouTube site (looking very much like the real thing) downloading a fake Flash.exe file. The site is now dead, but for a while it was serving up a nasty Trojan. A casual look might have given the impression that the page really was YouTube. A Google cache search reveals it was spammed a couple of time at least as a YouTube video. I wonder if this is the sort of thing people have seen?

http: //warguru.net/youtube.php

Complete scanning result of "adobe_flash-9.24.exe", received in VirusTotal at 04.22.2007, 19:39:06 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.4.21.0 04.20.2007 no virus found
AntiVir 7.3.1.53 04.22.2007 no virus found
Authentium 4.93.8 04.20.2007 no virus found
Avast 4.7.981.0 04.21.2007 no virus found
AVG 7.5.0.464 04.21.2007 no virus found
BitDefender 7.2 04.22.2007 DeepScan:Generic.Malware.IFYd.B030D472
CAT-QuickHeal 9.00 04.21.2007 no virus found
ClamAV devel-20070416 04.22.2007 no virus found
DrWeb 4.33 04.22.2007 DLOADER.Trojan
eSafe 7.0.15.0 04.22.2007 no virus found
eTrust-Vet 30.7.3585 04.21.2007 no virus found
Ewido 4.0 04.22.2007 no virus found
FileAdvisor 1 04.22.2007 no virus found
Fortinet 2.85.0.0 04.22.2007 no virus found
F-Prot 4.3.2.48 04.20.2007 no virus found
F-Secure 6.70.13030.0 04.22.2007 no virus found
Ikarus T3.1.1.5 04.22.2007 no virus found
Kaspersky 4.0.2.24 04.22.2007 no virus found
McAfee 5014 04.20.2007 no virus found
Microsoft 1.2405 04.22.2007 no virus found
NOD32v2 2210 04.22.2007 no virus found
Norman 5.80.02 04.21.2007 no virus found
Panda 9.0.0.4 04.22.2007 no virus found
Prevx1 V2 04.22.2007 no virus found
Sophos 4.16.0 04.20.2007 no virus found
Sunbelt 2.2.907.0 04.19.2007 no virus found
Symantec 10 04.22.2007 no virus found
TheHacker 6.1.6.095 04.15.2007 no virus found
VBA32 3.11.4 04.21.2007 no virus found
VirusBuster 4.3.7:9 04.22.2007 no virus found
Webwasher-Gateway 6.0.1 04.22.2007 no virus found
FreewheelinFrank | Homepage | 06.21.07 - 7:12 am | #