Beware of Fake Microsoft Security Alerts

A new wave of spam that disguises itself as a Microsoft security bulletin contains a link to malicious software that gives attackers complete access to the infected machine, security researchers are reporting.

The e-mail, which began circulating late Tuesday, identifies itself as Microsoft Security Bulletin MS05-039, and offers a link to what it claims is a patch against the Sober Zafi and Mytob worms.

In fact, there is no such thing as Microsoft Security Bulletin MS05-039, and real Microsoft security bulletins provide links to a Microsoft download site, rather than to the patches themselves, says Mikko Hyppönen, director of antivirus research at F-Secure. Microsoft has a Security Home Page.

The phony patch is a variant of the SDBot Trojan horse software, which is at present not detected by antivirus software products, according to a report from security research firm WebSense.

Low Risk Now

The risk of someone downloading this Trojan horse is very low right now, because the server hosting the Trojan horse downloads no longer seems active, Hyppönen says. That server, which appeared to be hosted by ThePlanet.com Internet Services, evidently has exceeded its allowed bandwidth, he says.

"I think this particular case is not going to be a problem anymore, but nevertheless I think it was a fairly interesting case," Hyppönen says. "I wouldn't be surprised to see more of this happening."

The Swen e-mail worm, which began circulating in 2003, used a similar technique, he adds.