The “patch” is a virus, and a nasty one.
It posts itself as being a virus fix – that’s the “social engineering†that is getting people to open it. So don’t!
We have lots of customers that are receiving these messages (1000s of them), but many spam filters are catching them (as is the Terrapin Spam Protection Service). The problem is that the spam filters get overloaded and something gets through.
Here is how it works: it comes in as an email. It says you have a virus, and here is the fix. So you run the fix…and get the virus. It says it is from the “Customer Support Centerâ€, and looks real official, and all that. It “recommends you install this patch…â€. Of course, the “patch†is the virus.
The ingenious thing is that it sends along this ZIP file, which is password protected. Anti-virus apps can’t scan the ZIP because it is password protected. The email – “please install this patch…†– contains the password.
Actually — warning: tecnobabble coming — the ZIP file isn’t the virus, but a downloader, which downloads a variety of virus payloads that cause various bits of damage. that is the hard part to detect and clean up once the virus has been loosed.
Here is a ink from the Kaspersky virus people that gives a very general explanation. General, because the “fix†they propose is different from variant to variant of the virus. But it does give a general idea of the infection.
Here is a list – also from Kaspersky – detailing some of the recent variants:
Our advice: don’t open anything with any attachments until this gets cleaned up. If at all in doubt: delete. Right-click and delete — don’t even open.
As we see more info on this virus we’ll post it here. Stay tuned!





