Fake Microsoft e-mail contains Trojan virus
Along with the vulnerabilities that Microsoft patched Tuesday, the software giant's customers have a new problem to grapple with: a fake notification e-mail that looks remarkably legitimate.
Attackers are apparently taking advantage of Microsoft's Patch Tuesday to send legitimate-looking e-mails that include a Trojan virus. Trojan.Backdoor.Haxdoor allows attackers to execute files and steal information from compromised computers. The fake mailing includes a legitimate-looking PGP signature, as well as purporting to come from a real Microsoft employee.
Christopher Budd, a security program manager in the Microsoft Security Response Center, offers this perspective on the e-mails in a security posting:
We received some questions from customers about an e-mail that's circulating that claims to be a security e-mail from Microsoft. The e-mail comes with an attached executable, which it claims is the latest security update, and encourages the recipient to run the attached executable so they can be safe. While malicious e-mails posing as Microsoft security notifications with attached malware aren't new (we've seen this problem for several years) this particular one is a bit different in that it claims to be signed by our own Steve Lipner and has what appears to be a PGP signature block attached to it. While those are clever attempts to increase the credibility of the mail, I can tell you categorically that this is not a legitimate e-mail: it is a piece of malicious spam and the attachment is malware. Specifically, it contains Backdoor:Win32/Haxdoor."
Dancho Danchev at ZDNet's Zero Day ponders whether the timing of this malware campaign will affect its success rate.
"Compared to the recent targeted malware attack against U.S schools, and the massive fake CNN news items campaign taking advantage of client-side vulnerabilities, this one is definitely going to have a lower success rate--no matter the timing," Danchev writes.
Microsoft's October 2008 security bulletin included four critical bulletins concerning Windows, Internet Explorer, Microsoft Host Integration Server, and Microsoft Excel.
Steven Musil is the night news editor at CNET News. Before joining CNET News in 2000, Steven spent 10 years at various Bay Area newspapers. E-mail Steven. 
Educate people to not open unannounced attachments regardless of the OS.
Read the message, how can tortured grammar such as
"Since public distribution of this Update through the official website http://www.microsoft.com would have result in efficient creation of a malicious software, we made a decision to issue an experimental private version of an update for all Microsoft Windows OS users."
How can you say that looks legitimate?
Seriously, these are the same kind of social engineering ala nigerian fraud that people had used to prey on people. Due to lack of education, some people fall for these things.
Dear Account User,
You are advice to verify your account details below to enable us upgrade your account. E.G Your Mail ID, Password, Date Of Birth etc.
In failure of doing this, you will Automatically lose your Mail Account.
Thanks for using Online Mail Accounts.
VERIFY YOUR ONLINE MAIL ACCOUNT NOW TO AVOID CLOSE!!!
Dear Account User,
This message is from Microsoft message center to all Online account owners and premium account owners. We are currently upgrading our data base and e-mail account center. We are deleting all unused Mail accounts to create more space for new accounts.
To prevent your account from closing, you will have to verify it below before One (1) week from now!
VERIFY YOUR ONLINE MAIL ACCOUNT NOW TO AVOID CLOSE!!!
Mail Account ID:............................................
Password:.........................................................
Your Birthday:.....................................................
Your Country or Territory:............................
Warning!!! Account owner that refuses to update his or her account before One (1) week of receiving this warning will lose his or her account permanently.
Sincerely,
The Microsoft Live Team
--
The information contained in this message is confidential and is intended for the addressee only. If you received this message in error or there are any problems please notify the originator immediately. The
unauthorised use, disclosure, copying or alteration of this message is strictly forbidden. This mail and any attachments have been scanned for viruses prior to leaving the network. The ONLINE ACCOUNT UPGRADING UNIT will not be liable for direct, special indirect or consequential damages arising from alteration of the contents of this message by a third party or as a result of any virus being passed on.
- by anitaescott January 4, 2009 5:21 PM PST
- so how do you get rid of it
- Like this Reply to this comment
-
(14 Comments)