Win32 Virus Removal

Written by

There has been a virus unleashed in the twitter community. It comes to you via the goo.gl url shortening service. Often it will send you to a series of URL's that will eventually land you at a top level Ukrainian domain, whitch will them send you to a website known for anti-virus software scams. How The Code Is Executed After landing at the final website, you will than be asked to run a security and virus scan. If agreed to, the scan will then proceed and then you will be informed of a threat, then asked if you would like it removed. When removal is agreed to, a download of "Security Shield," a bogus program, will commence.A Few Small Symptoms Soon after receiving the bogus program, you may start to notice an increase in tweets that you didn't write, coming through on your feed. Most all of the tweets will have a goo.gl link that end in "m28sx.html." At this point, it seems that most users have been unaware of the issue. But, a few users paid attention to the unmade tweets and reported the security breach.Where The Virus Came From The head of Twitter's trust and safety efforts, Del Harvey, yesterday tweeted to the masses that they are "working to remove the malware links and reset passwords on compromised accounts." When asked concerning the nature of the breach and how it came about, he claimed that folks who got phished in the last round but whose accounts weren't used to attack others" was the origination point. An Ounce Of Prevention While I could go far into the technicalities behind the virus, I would prefer to give a little advice to those who suspect they may have been infected. First, if you suspect you have been affected by the virus, do a legitimate virus scan from a reputable company, there are a lot of them out there, and even some very good freebies. Next, after you have removed or quarantined the virus, change your passwords.Why Not Just Block The Domain McAfee Labs principal researcher Adam Wosotowsky, claimed that the attack isn't unusual, and easily executed by any hacker. In a statement he said, "The attack is most likely a Trojan that began by phishing, possibly by a social media worm like Koobface. Shortened URL sites are not 100 percent malicious, so blocking the domain completely can cause false positives, which is something researchers try and avoid." And Google may not like the blocking of their domain name.