Security threats Toolkit

Trojan masquerades as Windows patch

Tags:
Viruses,
Security Update,
Trojan

Published: 27 Jan 2005 08:55 GMT

Microsoft's patch process has spawned an attempt to fool Windows users into downloading and installing a Trojan horse.

A fake email message, sent to ZDNet UK sister site CNET News.com, purports to be a Microsoft security notification about problems with the Windows operating system. The message, which carries the subject line "MS Windows/Critical Error", attempts to fool PC users into downloading and installing an attached program. However, numerous spelling and grammar errors in the message could tip people off to the danger.

"In the libraries of OS Windows(r) critical errors have been found," reads the email message that contains the Trojan horse attachment. "This errors lead to destruction of the system files from your computer without an opportunity on restoration."

The attached executable file, named Windowsupdate.rar, appears to be a Windows archive file, a format used to install code on PCs. Antivirus company Symantec said the file is not listed in the virus database, so it's unclear whether the file is a virus, a prank or any other kind of attack.

"Microsoft is aware of a possible threat by which a person sends an email claiming to be from Microsoft and enticing users to download Windows updates in the form of an attachment in the email," Debby Fry Wilson, director of Microsoft's security response centre, said in a statement. "Initial investigations from Microsoft and third parties have found that there is no malicious payload associated with this attachment at this time, and Microsoft is not aware of any customer impact."

The scam is common enough that the software giant has created a Web page to answer Windows' users questions. The company notes on that Web site that it never sends updates as attachments to email messages.

"We never attach software updates to our security email notifications," the software giant stated on its site. "Rather, we refer customers to our Web site for complete information on the software update or security incident."

The software maker typically delivers patches through its Windows Update service, or through downloads from its Web site.