Windows 7 - New Worm Leading to Rogue AV Is Spreading on Twitter

JMH · 01-22-2011

Quote:

Security researchers from Kaspersky Lab warn that a new worm rapidly spreading on Twitter spams rogue goo.gl URLs that direct users to fake antivirus distribution sites.

The spammed links take users through a series of redirects until landing them on an obfuscated scareware attack page.

According to Kaspersky Lab's Nicolas Brulez, the obfuscation is based on a JavaScript implementation of the RSA encryption algorithm.

"RSA is used as an obfuscation technique more frequently than any other, since the private key is available in the JavaScript page. The modulus 'N' seems to be 26 bits in length most of the time, which is ridiculously small," the researcher notes.

The fake AV variant served in this attack is called "Security Shield" and one interesting aspect about it is that its graphical user interface is localized depending on the language of the operating system.

New Worm Leading to Rogue AV Is Spreading on Twitter - Softpedia

sygnus21 · 01-22-2011

This is why I don't let stuff from the internet do system scans of my system. This is where you also need to know what your system is doing as well as its health. If I run into a page that tells me I have a virus or my system appears to be faulty, I close that page immediately as I know it's a fake because I know where my system is. If I have doubts, I don't my own scans/diagnoses using my own tools or those provided by Windows.

In short if you know your system and know what it's doing these fakes are easy to spot.

JMH · 01-22-2011

Of course.
Not everyone has our knowledge, discipline or experience.
{Often negative experiences are the best "teachers."}

sygnus21 · 01-22-2011

Quote: Originally Posted by JMH

{Often negative experiences are the best "teachers."}

Yeah, unfortunately that’s how viruses and other nefarious things spread

Jaxryley · 01-22-2011

Scan finished. 9 out of 19 scanners reported malware - MD5: bae499fc5844d814f942e870900c9d57 - pack.exe - Jotti's malware scan

New Worm Leading to Rogue AV Is Spreading on Twitter-sec.jpg

sygnus21 · 01-22-2011

I'm sorry but I’m a little reluctant to click that link. What is it? - virusscan.jotti.org

Looks like a scan website to me.... something to which I said I avoid.

Thanks.

JMH · 01-22-2011

Belt & braces there Andrew?

Tis best to be wary.

sygnus21 · 01-22-2011

Can never be too careful

I'm adventurous but....

Jaxryley · 01-22-2011

Quote: Originally Posted by sygnus21

I'm sorry but I’m a little reluctant to click that link. What is it? - virusscan.jotti.org

Looks like a scan website to me.... something to which I said I avoid.

Thanks.

When Virus Total is down then Jottis is an alternative. Not as many engines as VT but better than nothing.

And what do you mean by "avoid". Do you advise to avoid VT as well and why?

Maguscreed · 01-22-2011

I actually just removed this from a neighbor's system a couple of days ago, couldn't for the life of me figure out where he picked it up though. ...didn't see twitter in his history. Malwarebytes + safe mode with networking took it right out with latest update though.

Windows 7 - New Worm Leading to Rogue AV Is Spreading on Twitter

New Worm Leading to Rogue AV Is Spreading on Twitter problems?