Fake KB923029 update installs CryptoLocker

ichito · Nov 29, 2013

It was probably not mentioned yet

Julie Yeates of SophosLabs (thanks Julie!) alerted us earlier today to a spam campaign that seemed to originate from a whole raft of different security and anti-virus companies.

The messages have a variety of subject lines, such as:

Windows Defender: Important System Update -
requires immediate action

AVG Anti-Virus Free Edition: Important System Update -
requires immediate action

AVG Internet Security 2012: Important System Update -
requires immediate action

Kaspersky Anti-Virus: Important System Update -
requires immediate action

Microsoft Security Essentials: Important System Update -
requires immediate action
(...)
Important System Update - requires immediate action

It's highly important to install this security update due to the new malware circulating over the net. To complete the action please double click on the system patch KB923029 in the attachment. The installation will run in the silent mode. Please pay attention to this matter and inform us in case there is a problem.
Click to expand...

The email doesn't explicitly mention the CryptoLocker ransomware that locks your files and tries to sell them back you.

But there is little doubt that many recipients, having heard of the ongoing saga of CryptoLocker, will be more inclined than usual to read on.

It's all a pack of lies, of course.

There is no "system patch KB923029," and even if there were, neither Microsoft nor any other reputable company would send out security updates as email attachments.
Click to expand...

http://nakedsecurity.sophos.com/2013/11/21/spam-from-an-anti-virus-company-its-zeus-malware/
The same fake update is reported also by Symantec
http://community.spiceworks.com/topic/411624-fake-symantec-email-virus-warning

guest · Nov 29, 2013

And that's why we only install updates from WU or Microsoft Download Center.

siljaline · Nov 29, 2013

Thanks for this. If you receive any email messages telling you to update something it will always be from a trusted source such as Microsoft.

If you receive an email message that claims to be distributing a Microsoft security update, it is a hoax that may contain malware or pointers to malicious websites. Microsoft does not distribute security updates via email.
Click to expand...

See also email hoax and associated references. In case you missed it - there is also this standing thread. https://www.wilderssecurity.com/showthread.php?t=353171
Also from ESET.

Log in or Sign up

Fake KB923029 update installs CryptoLocker

ichito Registered Member

guest Guest

siljaline Registered Member

Log in or Sign up

Fake KB923029 update installs CryptoLocker

ichito Registered Member

guest Guest

siljaline Registered Member

Useful Searches