If you run this file, the virus will get itself silently installed and also its bringing a friend in their family called SecurityTool, a Rogue Antivirus. Similar flavor of this kind had been got caught in the mid 2009 with the same KB article. One thing you have to stick it in your mind is that “Microsoft will never send you any updates or patches to your email”.

Courtesy: Panda Security

Related posts:

1. Michael Jackson Email Viruses – A Warning from Sophos
2. Be Cautious when it comes to Fake Microsoft Security Essentials Alert
3. Spam Emails offering KB910721 Outlook Updates

This email contains the following Subject Line as "Remembering Michael Jackson" and it is claimed to be coming from sarah(at)michaeljackson(dot)com

The email tells recipients that an attached file titled "Michael songs and pictures.zip" contains secret songs and photos of Michael Jackson, the pop music icon who died in United States on June 25.

Sophos advised users not to open the email as the computer users will be exposed to the infection and will in turn automatically spread the worm to other internet users. This virus will also exploit itself to USB Storage device as an Autorun Component. Sophos said that many computer users likely to be moved in opening up the attachment because of the interest in the King of Pop’s sudden death.

"Anyone who receives this email should delete it immediately to save themselves the embarrassment of infecting their email contacts."

Related posts:

1. M.Jackson Died – Sad News Generate Bad Things
2. Bredolab.Y Trojan spreading through Fake Email from Microsoft Updates
3. A Digital Pollution warning on Safer Internet Day 2010

These Spam Emails will be seen as official looking one (screenshot below) and it will arrive to your Inbox using one of these Subject Lines:

Critical Update for Microsoft Outlook
Install Critical Update for Microsoft Outlook
Install Update for Microsoft Outlook
Microsoft has released an update for Microsoft Outlook
Microsoft Outlook Critical Update
Microsoft Outlook Update
Update for Microsoft Outlook

Spam Email Campaign for Outlook Updates

which in turn will redirect you to a website(screenshot below) to download the Trojan file.

Spam Email redirects to Malicious website

This Phishing websites are coming from more than 70 different domain names including:

update.microsoft.com.11hilf.com
update.microsoft.com.11hilf.net
update.microsoft.com.1llijk.com
update.microsoft.com.1llijk.net
update.microsoft.com.hfhilf.com

Out of 41 Antivirus scans 14 were detected the file from that website as malicious as per the report by Virus Total. This email campaign ties to the top notch password stealing malware in the world called as “ZBOT” aka “Zeus Botnet”.

So if you use any Antivirus or Internet Security Suite with up-to-date virus and spyware definitions, when you are visiting the phishing or malicious websites you will see the screen similar to the one below.

Antivirus protects blocks the malicious website

You may ask “How do I know it didn’t come from Microsoft?”. Well two reasons here:

First Microsoft never sends out email attachments directly to your Email.

Second when you look deep in to this malicious website name as update.microsoft.com.1llijk.com you can see 1llijk.com is the main phishing website, probably they have created update.microsoft.com as a sub domain or else created a folder in that name in their web server. So its obvious that we will note only the first few words in the address bar and we believe that its from trusted website.

So henceforth watch out for the entire domain name and if you found anything suspicious DO NOT go forward.

Have something informative about this issue please proceed with the comments or share it across.

Related posts:

1. Bredolab.Y Trojan spreading through Fake Email from Microsoft Updates
2. Waledac Spam hits on US Independence Day
3. Tech Twitter Weekly Updates for 2009-07-05