MySpace page serves up fake Microsoft security update

Clicking the fraudulent update could install malicious code on your desktop.

According to security vendor McAfee, one of the profiles on MySpace currently serves up a fraudulent Microsoft security update that, if clicked, attempts to load malicious software. The profile of a 42-year-old woman from Arkansas appears to exist solely for the purpose of infecting visitors. McAfee says that both Microsoft and MySpace have been contacted.

Joris Evers, publicity director at McAfee, says "attackers send unwitting MySpace users a friend request, asking them to become friends with 'Rita.' When the user clicks to see who 'Rita' is they are sent to the profile that serves up malware." The profile page is "overlaid with what looks like a legitimate Windows 'Automatic Updates' pop-up box. Clicking on or near the pop-up results in a request for a file download masked as a Microsoft update called 'updateKB890830.exe' from a server that includes 'winxpupdate.Microsoft' in its name."

As of now the page is still available on the MySpace site. McAfee says its customers are protected. CNET tested ZoneAlarm and a few other security apps that also blocked access to the malicious code.

Featured Video

Why do so many of us still buy cars with off-road abilities?

Cities are full of cars like the Subaru XV that can drive off-road but will never see any challenging terrain. What drives us to buy cars with these abilities when we don't really need them most of the time?

by Drew Stearne