Tech: Virus alert: Fake Microsoft e-mail

Subject: Tech: Virus alert: Fake Microsoft e-mail
From: michaelr
Date: 04 Oct 04 - 07:46 PM

In my inbox today, I found a very official-looking message puporting to be from Microsoft. It reads:

Microsoft Partner
this is the latest version of security update, the "November 1995, Cumulative Patch" update which resolves all known security vulnerabilities affecting MS Internet Explorer, MS Outlook and MS Outlook Express. Install now to protect your computer from these vulnerabilities, the most serious of which could allow an malicious user to run executable on your system. This update includes the functionality of all previously released patches.

System requirements         Windows 95/98/Me/2000/NT/XP
This update applies to         MS Internet Explorer, version 4.01 and laterMS Outlook, version 8.00 and laterMS Outlook Express, version 4.01 and later
Recommendation        Customers should install the patch at the earliest opportunity.
How to install        Run attached file. Choose Yes on displayed dialog box.
How to use        You don't need to do anything after installing this item.

Microsoft Product Support Services and Knowledge Base articles can be found on the Microsoft Technical Support web site. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site, or Contact Us. Thank you for using Microsoft products. Please do not reply to this message. It was sent from an unmonitored e-mail address and we are unable to respond to any replies. The names of the actual companies and products mentioned herein are the trademarks of their respective owners.

There is an attachment: Q272333.exe which I had Norton AV scan. And guess what? Norton says:

Virus "W32.Swen.A@mm" found.

BASTARDS! And I was so looking forward to a patch that "resolves all known security vulnerabilities"! Be ever alert, folks.

Cheers,
Michael

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: Bernard
Date: 04 Oct 04 - 08:30 PM

Not a particularly new hoax - and they all carry the very virus they claim to protect you from!

The best thing is always to RIGHT click on the message header, then you can find out where it came from!

Microsoft never send out emails with files attached, which is another clue!

Glad you didn't get caught by it - I've had to sort out a few machines which have been affected that way...

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: The Fooles Troupe
Date: 04 Oct 04 - 08:39 PM

I have MailWasher set up to detect the section header that encodes an executable and is coded with the top priority - displays a message "possible virus" - this clearly identifies them.

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: leeneia
Date: 04 Oct 04 - 09:00 PM

What is the message header, exactly?

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: Ebbie
Date: 04 Oct 04 - 09:08 PM

Another clue is bad grammar. No self-respecting professional office would send out something referring to "an malicious" something. If you've noticed, some of these spammers are barely literate.

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: The Fooles Troupe
Date: 04 Oct 04 - 09:21 PM

Not 'natural English Speakers' often too.


"What is the message header, exactly?"

It's much more complex than just that. In Mailwasher you can test for many things, including Scripts etc, which can carry viruses, trojans, malware, emails not addresses personally to you, etc. If you are really interested (and without running the program or an equivalent one, any interest is purely academic), you really should visit the Mailwasher page at www.mailwasher.net (type it in so you don't get a 'redirected link'). There are lists of 'plugin scripts' there. Studiying them will educate you considerably.

Any exhaustive discussion in this thread will probably bore most people.

Robin

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: The Fooles Troupe
Date: 04 Oct 04 - 09:40 PM

On second thought, perhaps you meant "What is _A_ message header".

Inside emails, there can be many sections, each with a 'header-id-code'. You won't necessarily visibly see all these sections - some can be just the pure ASCII text of the message, some can be HTML encoded versions of the message text, some can be Word mungles of the text, some can be executable code, some are technical routing information. It will depend on your email package, and how you have set the options as to what you will know is there. With the right tools, you can peer inside the full message - MailWasher is one of these tools which is intended to look at your email and filter/delete/bounce things before you download it into your normal mail package.

Robin

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: Q (Frank Staplin)
Date: 04 Oct 04 - 10:26 PM

A digression, but I would like to know.
Frequently, when I run Spyware Doctor, this item shows up-
"Altnet software. Bundled with Kazaa. Installs a browser helper object, which loads when IE-- (can't get the rest of the sentence)."

And what is Kazaa?
Spyware Doctor removes the item, but itbothers me. I also think my cable provider is adding some of these items.
Boxcar words like vulnerabilities and functionalities seldom used in messages from Microsoft (Their communications can be confusing enough without them).

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: GUEST
Date: 04 Oct 04 - 10:42 PM

IGNORANT SUCKERS!!!!

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: Peace
Date: 05 Oct 04 - 12:16 AM

What a lovely colour!

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: Dave the Gnome
Date: 05 Oct 04 - 04:13 AM

IGNORANT SUCKERS!!!!

For stopping a virus? Wierd...

I don't like the coulour though, Brucie. Prefer a nice shade of green myself;-)

Cheers

DtG

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: Geoff the Duck
Date: 05 Oct 04 - 04:27 AM

Personally I like this one!
Quack!
GtD.

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: kendall
Date: 05 Oct 04 - 04:59 AM

The grammar was my first clue even though here at mudcat, some of the reasonably bright folks can't spell or write worth a damn.

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: Ron Davies
Date: 05 Oct 04 - 07:07 AM

May be a long time before Microsoft offers a patch that "resolves all known security vulnerabilities". Even if they did, there's that word "known".

"Hey, we didn't know about that one".

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: Bernard
Date: 05 Oct 04 - 09:15 AM

Ignorant suckers? I thought suckers were usually rubber...!!

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: RichM
Date: 05 Oct 04 - 10:13 AM

Never run a purported "fix" from an email you receive.

Instead, go to www.microsoft.com to do so.

Subject: RE: Tech: Virus alert: Fake Microsoft e-mail
From: JennyO
Date: 05 Oct 04 - 11:03 AM

NOW HERE'S A PRETTY COLOUR!!!