MySpace page pushes fake Microsoft update

A bogus profile on MySpace is being used to push a new malware attack.

Researchers at McAfee found malicious pages on the social networking site which spawn pop-up windows attempting to spoof Microsoft's automatic update service.

The pop-up tells the user that an official update, identified as 'updateKB890830.exe', is ready to be installed.

The attacker has further tried to confuse users by using a URL which includes 'winxpupdate.microsoft' in the address.

A McAfee spokesperson told vnunet.com that the software is "a true malware cocktail".

A remote-control tool and several Trojan programs attempt to download other malicious packages. The various downloads have been traced to servers in China, Malaysia and Ukraine.

McAfee said that the malicious profiles were still active on Friday afternoon, and that MySpace and Microsoft had been notified of the incident.

The security firm recommends users not to accept friend requests from unknown parties, and to avoid visiting suspicious profiles.

This is not the first worm to spread via MySpace. In late 2006 a flaw in QuickTime was used to launch a phishing attack which altered user profiles and hijacked friend lists.

See also:

Cambridge admissions tutor checks Facebook

'Discreetly' checking up on new applicants  11 Jan 2008

Police subpoena MySpace over Meier suicide

Wire fraud laws may have been broken  10 Jan 2008

Cyber-gangs gear up for 2008

Let's be careful out there  24 Dec 2007

Facebook backs down on Beacon plans

Service won't tell your friends what you buy  03 Dec 2007

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!