You do not need iframes, you can ask?

[polonus]

Hi malware fighters,
 
Hackers do not need refined technological tricks to install their malware. Just asking the user to install it is another option. Researchers of Sans Institute detected a website that seemingly mysteriously infected users with malware.

That website did not use any well-known iframes exploits to infect users.

"It really comes down to social engineering, the user is just asked to install the malware", according to  SANS Internet Storm Center's Bojan Zdrnja .

The site looked like an exact copy of the Macromedia Flash Player download site.

"The user was re-directed to a bogus version of the Shockwave Player Download Center", adds Zdrnja. All links for the page led to genuine Adobe's , but the 'install'-link did NOT.

While the users installed the malware by themselves so to say, lots of virusscanners did not flag the malware.

Scaring. Check your download links, pre-scan. Exploit prevention is better than malware cure!

polonus

[DavidR]

I guess they would first be informed that the version was out of date or a security patch, etc. before being invited to download the update, etc. This could be for any number of applications.

Don't take any of these notifications at face value, not use the link, visit the parent web site by typing in your own URL or using the program to check for updates. The visit to the site will probably show that there are in fact no updates, etc. but if it does you are more likely to be at the legit site.