Security companies are warning Internet users about a new Trojan horse program spreading via spam e-mail and masquerading as a Windows XP software update from Microsoft.

The program, known as "Xombe" or "Dloader-L," arrives as an executable attachment in spam e-mail messages purporting to come from windowsupdate@microsoft.com and installs itself on victims' computers when users open the attachments.

Once installed, Xombe connects to a Web site, then downloads and installs another program, called Mssvc-A, which is a Trojan horse that conscripts victim computers in distributed denial of service (DDoS) attacks against Web pages, according to antivirus company Sophos.

Xombe is considered a low risk by most antivirus companies, including Sophos, Computer Associates International and Symantec. The program is not a worm or virus and cannot make copies of itself. Instead, it is distributed using spam e-mail messages.

By Paul Roberts at TechWorld.

[ Read more ]