Finnish anti-virus firm F-Secure warned Friday that a new malware-laced Microsoft Update page has appeared in the wild and is hosted on a URL that incorporates the actual Microsoft Update address – microsoft.com/cfm48 – with a period substituted for a forward slash.
The slightly modified URL takes the victim to a fake Microsoft Update “welcome” page that prominently features an urgent notice telling the visitor to install a “critical Windows XP/2000/2003/Vista update!” Install is mispelled on the bogus update page (“intall”), F-Secure reported.
An “Urgent Install” button appears in the fake notice, next to a prompt reading “Get critical update (obligatory).” Users who click on the button receive a file labeled WindowsUpdateAgent30-x86-x64.exe, which installs a trojan-dropper on the victim's PC. F-Secure said the bogus update page is a “fast flux” site and uses a wide range of IP addresses attached to the “cfm48.com" portion of the URL.
The security research firm said in its blog posting that the malicious program delivered via the trojan dropper is a previously identified piece of malware known as Backdoor:W32/Agent.CVU.
Last month, McAfee researchers warned of a MySpace phishing campaign in which users received “friend” requests that attempt to infect them with malware disguised as a Microsoft update.
Users clicking on the profile of the person trying to befriend them were sent to a page overlaid with a bogus Windows pop-up box promising automatic Windows updates, which, when clicked on, installed a malicious mix of trojans on the victim's PC.
