It reaches the computer in an email message which seems to have been sent by the Facebook team requiring users to update their account by clicking a link from which the Trojan is downloaded. It is designed to steal confidential information from the computer.

Windows 2003/XP/2000/NT/ME/98/95

Sinowal.WUR is a Trojan which is distributed in email messages that seem to have been sent by the Facebook team, informing users that a new login system has been developed and they are required to update their Facebook account.

This message includes several links that point to the download of the Trojan, which is designed to steal information from the computer, concretely, informmation about the executable files installed in the computer. Then, this information is stored in several files and sent to its creator later.

Sinowal.WUR does not spread automatically using its own means. It needs an attacking user's intervention in order to reach the affected computer.

Sinowal.WUR is easy to recognize, as it reaches the computer in an email message that seems to have been sent by the Facebook team and which has the following characteristics:

• The subject of the message can be one of the following, among others:
  Facebook Account Update
  Facebook Update Tool
• The message informs users that a new login system is going to be introduced nd they are required to update their account. This message contains several links that point to the download of the Trojan.
• The following is an example of the email message in which Sinowal.WUR is being distributed: