Bogus Microsoft Update Delivers Nasty File Infector
June 1, 2008 – 8:54 AMEven though Patch Tuesday is still two weeks from now, crimeware authors are already sending out fake Microsoft “critical updates.” The TrendLabs Content Security Team recently found a hoax purporting to be from Microsoft that urges users to update their computers due to a “critical security issue”.
The email, which has the subject heading Important update from Microsoft Windows XP/2003 Professional Service Pack 2(KB946026), urges recipients to install the latest security update to avoid a successful attack which could result in comprising therecipinets’s PC.
If the unlucky victim clicks on the file name, WINDOWS-KB946026-X86-ENU, they won’t be getting any security patch — but rather, malware detected by Trend Micro as PE_VIRUT.XZ.
PE_VIRUT.XZ is a pretty old variant that appends its code to EXE and SCR files, making a pretty big mess depending on where it is executed.
Admittedly, we have been seeing these fake security notifications for a long time (we’ve discussed this in the past here and here). But apparentlty, consumers still seem to fall for this trap anyway.
Always keep your OS, third-party applications, and other associated software updated — this is one sound piece of advice that consumers can bank on.
And also make sure to get those Windows updates only from the source, Microsoft Corporation.
You must be logged in to post a comment.