Twitter worm is getting spread via goo.gl.

1. Introduction

On Jan 20, 2011, Fake Anti-Virus SW called "Twitter worm" has been reported.
So users who are geeking in SNS need to be careful on using Social Network Services. This "Twitter worm" has been spread via Twitter especially using Google's shorten URL service, goo.gl.

[Fake anti-virus attack spreads on Twitter via goo.gl links]
http://nakedsecurity.sophos.com/2011/01/20/fake-anti-virus-attack-twitter-via-goo-gl-links/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+nakedsecurity+%28Naked+Security+-+Sophos%29

[New Twitter worm redirects to Fake AV]
http://www.securelist.com/en/blog/11136/New_Twitter_worm_redirects_to_Fake_AV

2. Spreading path and symptoms of infection

This fake Anti-Virus SW is known as spreading via Twitter and SNS. Because it especially uses goo.gl shorten URL, user can't know where to be moved before clicking.

http://isc.sans.edu/diary.html?storyid=10297

Clicking shorten URL can redirect downloadable address, and user can install fake Anti-Virus SW.

Fake warning screen infected by 31 warnings will appear after installed fake AV.

As same as usual malicious SWs, it will induce user to pay.

3. How to prevent

This kind of fake anti-virus SWs can commonly induce user to pay. Furthermore, lately found fake anti-virus SW uses its spreading path to Twitter or SNS.
To use PC safely from security threats of these malicious attachments, we recommend following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.
5. Execute downloaded file after scan with anti-virus SW.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function with nProtect Anti-Virus/Spyware for detecting such as malicious file stated above and runs responding system against various security threats.

Diagnosis name

- Script-HTML/W32.Agent.TM
- Trojan/W32.FakeAV.253952.B
- Trojan/W32.FakeAV.313104.B