Kaspersky Lab: watch out for Twitter-linked scamware

The company says that the latest scamware is a program that is being promoted by the Twitter social networking site called "MalwareRemovalBot," and is actually "Not-a-virus:FraudTool.Win32.MalwareRomovalBot.e."

According to Kaspersky Lab, the scamware is being promoted in Twitter messages - known as tweets - and which lead to a `vendor site' which also routes to an Internet download.

The downloaded filename generated by the scamware site varies between `setup.exe,' `setupxv.exe' and `setup-trial.exe.' In all cases, says the company, the download is a UPX-compressed Windows PE-executable.

Once the program has been installed and a scan has been run, the program will then report fake spyware infections to scare the user into registering.

The registration website leads to the shop where a `special offer' is waiting for the potential customer.

A license for a single PC costs as much as the 3 PC license - $39.95 plus two 'extra' technologies for $9.95. The total payment of $59.85 can be made by PayPal or credit-card.

This is, says Kaspersky Lab "pretty expensive for fake protection," adding that, whilst you cannot expect every tweet to lead to an interesting website, you can expect that some of them will lead to malicious sites.

"Use your common sense, and don't be a twit when you tweet," says the IT security company.

What’s hot on Infosecurity Magazine?