Risk: High
Anti-virus vendors have raised the alarm on a malicious new Trojan masquerading as a critical Microsoft security patch.
The email-borne attack comes just days ahead of Microsoft's scheduled patch day and highlights a growing trend of using social engineering tactics to dupe users into downloading malicious files.
According to an advisory from anti-virus specialist Sophos Inc., the attackers are using a coordinated email campaign to direct users to download the bogus Microsoft patches from a malicious web site.
Even though Microsoft never sends out updates or security alerts via email, the public's rising paranoia about the security of Windows computers plays into the hands of the attackers.
The email includes the Microsoft Windows logo and is disguised under one of the following subject lines: "Update your Windows machine," "Urgent Windows Update" and "Important Windows Update."
It purports to come from "Windows Update" (update@microsoft.com) and includes links pointing to an "Express Install: High Priority Updates For Your Computer."
If users follow the link in the email and attempt to download the fake patch, a Trojan Horse is installed instead, allowing the attacker to hijack the computer remotely.
Sophos has identified the file as Troj/DSNX-05, a backdoor Trojan that runs in the background as a server process allowing a remote user (using a client program) to gain access and control over the machine.
When first run, the Trojan copies itself to the Windows System directory using the name of a randomly chosen DLL file and a .exe extension.
Sophos warned that the Trojan then creates a registry entry to run the file automatically each time the infected machine is rebooted.
It's not the first time a bogus Microsoft security patch was used to trigger a worm attack.
In 2004, a patch promising to protect users from the MyDoom worm turned out to be a malicious virus targeting Windows machines throughout Europe and parts of North America.
That attack was also email-borne and arrived with a subject line of "Microsoft Alert: Please Read!"