Fake Microsoft Patch Triggers Virus Attack

Like day follows night, a bogus "cumulative update" with a malicious attachment has followed Microsofts patch day.

In what has become a monthly staple, virus writers are taking advantage of the heightened public interest around Microsofts patching cycle to trick users into executing a malicious attachment.

The latest social engineering trick arrives via e-mail with an attachment that purports to be a "cumulative patch" for May 2005.

The claim is that the executable file contains patches for vulnerabilities in Internet Explorer, Microsoft Outlook and Outlook Express, three widely used products with a history of serious security bugs.

The file is actually an executable for a variant of W32.Pinfi, a memory-resident polymorphic virus capable of replicated via mapped drives and network shares.

The Pinfi virus, also known as Pate or Parite, has been programmed to infect every PE and SCR file on every drive and network share.

It targets users of Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me.

Click here to read more about a Trojan that masqueraded as a critical Microsoft security patch.

"This is a common scam," a Microsoft representative said Thursday. "Its important to remind customers that Microsoft will never attach software updates to security e-mail notifications."

She pointed out that most Microsoft software updates are provided through Microsoft Windows Update, Microsoft Office Update, or the Microsoft Download Center, adding that, as a best practice, "users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources."

Because the scam has become a monthly occurrence, Microsoft has provided guidance for customers to help identify genuine security messages.

The document, titled How to Tell If a Microsoft Security-Related Message Is Genuine, includes the following advice:

Read more here about a worm that barraged inboxes with German spam.

Anti-virus vendor Sophos Inc. has provided step-by-step disinfection instructions for PE executables.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.