Researchers at McAfee found malicious pages on the social networking site which spawn pop-up windows attempting to spoof Microsoft's automatic update service.
The pop-up tells the user that an official update, identified as 'updateKB890830.exe', is ready to be installed.
The attacker has further tried to confuse users by using a URL which includes 'winxpupdate.microsoft' in the address.
A McAfee spokesperson said that the software is "a true malware cocktail".
A remote-control tool and several Trojan programs attempt to download other malicious packages. The various downloads have been traced to servers in China, Malaysia and Ukraine.
McAfee said that the malicious profiles were still active on Friday afternoon, and that MySpace and Microsoft had been notified of the incident.
The security firm recommends users not to accept friend requests from unknown parties, and to avoid visiting suspicious profiles.
This is not the first worm to spread via MySpace. In late 2006 a flaw in QuickTime was used to launch a phishing attack which altered user profiles and hijacked friend lists.
MySpace page pushes fake Microsoft update
By
Shaun Nichols
on Jan 15, 2008 7:28AM
A bogus profile on MySpace is being used to push a new malware attack..
Got a news tip for our journalists? Share it with us anonymously here.
