New Worm Leading to Rogue AV Is Spreading on Twitter

[JMH]

Security researchers from Kaspersky Lab warn that a new worm rapidly spreading on Twitter spams rogue goo.gl URLs that direct users to fake antivirus distribution sites.

The spammed links take users through a series of redirects until landing them on an obfuscated scareware attack page.

According to Kaspersky Lab's Nicolas Brulez, the obfuscation is based on a JavaScript implementation of the RSA encryption algorithm.

"RSA is used as an obfuscation technique more frequently than any other, since the private key is available in the JavaScript page. The modulus 'N' seems to be 26 bits in length most of the time, which is ridiculously small," the researcher notes.

The fake AV variant served in this attack is called "Security Shield" and one interesting aspect about it is that its graphical user interface is localized depending on the language of the operating system.

New Worm Leading to Rogue AV Is Spreading on Twitter - Softpedia

 

[sygnus21]

This is why I don't let stuff from the internet do system scans of my system. This is where you also need to know what your system is doing as well as its health. If I run into a page that tells me I have a virus or my system appears to be faulty, I close that page immediately as I know it's a fake because I know where my system is. If I have doubts, I don't my own scans/diagnoses using my own tools or those provided by Windows.

In short if you know your system and know what it's doing these fakes are easy to spot.

 

[JMH]

Of course.

Not everyone has our knowledge, discipline or experience.
{Often negative experiences are the best "teachers."}

 

[sygnus21]

{Often negative experiences are the best "teachers."}

Yeah, unfortunately that’s how viruses and other nefarious things spread

 

[Jaxryley]

Scan finished. 9 out of 19 scanners reported malware - MD5: bae499fc5844d814f942e870900c9d57 - pack.exe - Jotti's malware scan

 

[sygnus21]

I'm sorry but I’m a little reluctant to click that link. What is it? - virusscan.jotti.org

Looks like a scan website to me.... something to which I said I avoid.

Thanks.

 

[JMH]

Belt & braces there Andrew?

Tis best to be wary.

 

[sygnus21]

Can never be too careful

I'm adventurous but....

 

[Jaxryley]

I'm sorry but I’m a little reluctant to click that link. What is it? - virusscan.jotti.org

Looks like a scan website to me.... something to which I said I avoid.

Thanks.

When Virus Total is down then Jottis is an alternative. Not as many engines as VT but better than nothing.

And what do you mean by "avoid". Do you advise to avoid VT as well and why?

 

[Maguscreed]

I actually just removed this from a neighbor's system a couple of days ago, couldn't for the life of me figure out where he picked it up though. ...didn't see twitter in his history. Malwarebytes + safe mode with networking took it right out with latest update though.

 

[sygnus21]

I'm sorry but I’m a little reluctant to click that link. What is it? - virusscan.jotti.org

Looks like a scan website to me.... something to which I said I avoid.

Thanks.

When Virus Total is down then Jottis is an alternative. Not as many engines as VT but better than nothing.

And what do you mean by "avoid". Do you advise to avoid VT as well and why?

If you have virus software already installed on you system than I see no need to go to the internet for a scan. Yes there are exceptions to the rule but outside of those, why?

To sum it up - I don't go to sites for virus scans (unless directed by my software).... that's what the "installed" software is for

That's me, yours may vary.

 

[Jaxryley]

That's me, yours may vary.

Well all I can say is that if you think you need a realtime AV then you probably do.

No realtime AV here in years.

Virus Total and Jottis are both good in that you can post the results of a scan for all to see.

VT is up now and here are the detection results of the malware when first found and the results now. Would "your" AV have stopped it when first found?

First found:
VirusTotal - Free Online Virus, Malware and URL Scanner

Now:
VirusTotal - Free Online Virus, Malware and URL Scanner

 

[sygnus21]

That's me, yours may vary.

Well all I can say is that if you think you need a realtime AV then you probably do.

Thanks