MS Security Section Spoof?

M

M. Eikel

Today I received an e-mail from the "Microsoft Program
Security Section" <[email protected]> that
urges me to install an attached patch named pack.exe.
This e-mail was sent only to my home, but not to my place
of work, which also uses Windows XP and IE 6.0.

I am generally causious regarding any type of attachement
and have therefore not yet opened or downloaded that e-
mail, although Yahoo's Virus scan declares it free of
viruses.

Can anyone verify the legitimacy of the e-mail?

---- Header information of e-mail: -----

X-Apparently-To: (e-mail address removed) via
web80006.mail.yahoo.com; 18 Sep 2003 15:49:18 -0700 (PDT)
Return-Path: <[email protected]>
Received: from vm4-ext.prodigy.net (207.115.63.115)
by mta819.mail.yahoo.com with SMTP; 18 Sep 2003
15:49:16 -0700 (PDT)
X-Originating-IP: [68.1.17.243]
Received: from lakemtao02.cox.net (lakemtao02.cox.net
[68.1.17.243])
by vm4-ext.prodigy.net (8.12.9/8.12.3) with ESMTP
id h8IMn9vE315476
for <[email protected]>; Thu, 18 Sep
2003 18:49:09 -0400
Received: from nnkjktb ([68.11.150.46]) by
lakemtao02.cox.net
(InterMail vM.5.01.06.05 201-253-122-130-105-
20030824) with SMTP
id
<20030918224903.DJRV10677.lakemtao02.cox.net@nnkjktb>;
Thu, 18 Sep 2003 18:49:03 -0400
FROM: "Microsoft Program Security Section"
<[email protected]>
TO: "Customer" <[email protected]>
SUBJECT: Current Network Critical Update
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="yoxizpzdpy"
Message-Id:
<20030918224903.DJRV10677.lakemtao02.cox.net@nnkjktb>
Date: Thu, 18 Sep 2003 18:49:08 -0400


---- END HEADER INFORMATION ----

Note: The first part of my e-mail address has
been 'blanked out' with xxxxxxx.xxxxx to protect my
privacy and to deter spammers.


---- Message Body --------
Microsoft All Products | Support | Search |
Microsoft.com Guide
Microsoft Home


Microsoft Customer

this is the latest version of security update,
the "September 2003, Cumulative Patch" update which fixes
all known security vulnerabilities affecting MS Internet
Explorer, MS Outlook and MS Outlook Express as well as
three newly discovered vulnerabilities. Install now to
continue keeping your computer secure from these
vulnerabilities, the most serious of which could allow an
attacker to run code on your computer. This update
includes the functionality of all previously released
patches.


System requirements Windows 95/98/Me/2000/NT/XP
This update applies to MS Internet Explorer, version
4.01 and later
MS Outlook, version 8.00 and later
MS Outlook Express, version 4.01 and later
Recommendation Customers should install the patch at the
earliest opportunity.
How to install Run attached file. Choose Yes on
displayed dialog box.
How to use You don't need to do anything after
installing this item.

Microsoft Product Support Services and Knowledge Base
articles can be found on the Microsoft Technical Support
web site. For security-related information about
Microsoft products, please visit the Microsoft Security
Advisor web site, or Contact Us.

Thank you for using Microsoft products.

Please do not reply to this message. It was sent from an
unmonitored e-mail address and we are unable to respond
to any replies.

----------------------------------------------------------
----------------------
The names of the actual companies and products mentioned
herein are the trademarks of their respective owners.

----- END MESSAGE BODY ----

The message appears to be from MS and includes a design
sheeme equal to that of MS and apperant links to MS web
site. However, if Windows Update is launched, no critical
updates are listed for download (as of 09/18/2003.)

I am open to answer any furhter questions if required.

Regards,

M. Eikel
 
J

Joe727

Microsoft never sends patches (updates) by e-mail. You might want to read
this Microsoft article:

http://www.microsoft.com/technet/security/policy/swdist.asp

Joe

M. Eikel said:
Today I received an e-mail from the "Microsoft Program
Security Section" <[email protected]> that
urges me to install an attached patch named pack.exe.
This e-mail was sent only to my home, but not to my place
of work, which also uses Windows XP and IE 6.0.

I am generally causious regarding any type of attachement
and have therefore not yet opened or downloaded that e-
mail, although Yahoo's Virus scan declares it free of
viruses.

Can anyone verify the legitimacy of the e-mail?

---- Header information of e-mail: -----

X-Apparently-To: (e-mail address removed) via
web80006.mail.yahoo.com; 18 Sep 2003 15:49:18 -0700 (PDT)
Return-Path: <[email protected]>
Received: from vm4-ext.prodigy.net (207.115.63.115)
by mta819.mail.yahoo.com with SMTP; 18 Sep 2003
15:49:16 -0700 (PDT)
X-Originating-IP: [68.1.17.243]
Received: from lakemtao02.cox.net (lakemtao02.cox.net
[68.1.17.243])
by vm4-ext.prodigy.net (8.12.9/8.12.3) with ESMTP
id h8IMn9vE315476
for <[email protected]>; Thu, 18 Sep
2003 18:49:09 -0400
Received: from nnkjktb ([68.11.150.46]) by
lakemtao02.cox.net
(InterMail vM.5.01.06.05 201-253-122-130-105-
20030824) with SMTP
id
<20030918224903.DJRV10677.lakemtao02.cox.net@nnkjktb>;
Thu, 18 Sep 2003 18:49:03 -0400
FROM: "Microsoft Program Security Section"
<[email protected]>
TO: "Customer" <[email protected]>
SUBJECT: Current Network Critical Update
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="yoxizpzdpy"
Message-Id:
<20030918224903.DJRV10677.lakemtao02.cox.net@nnkjktb>
Date: Thu, 18 Sep 2003 18:49:08 -0400


---- END HEADER INFORMATION ----

Note: The first part of my e-mail address has
been 'blanked out' with xxxxxxx.xxxxx to protect my
privacy and to deter spammers.


---- Message Body --------
Microsoft All Products | Support | Search |
Microsoft.com Guide
Microsoft Home


Microsoft Customer

this is the latest version of security update,
the "September 2003, Cumulative Patch" update which fixes
all known security vulnerabilities affecting MS Internet
Explorer, MS Outlook and MS Outlook Express as well as
three newly discovered vulnerabilities. Install now to
continue keeping your computer secure from these
vulnerabilities, the most serious of which could allow an
attacker to run code on your computer. This update
includes the functionality of all previously released
patches.


System requirements Windows 95/98/Me/2000/NT/XP
This update applies to MS Internet Explorer, version
4.01 and later
MS Outlook, version 8.00 and later
MS Outlook Express, version 4.01 and later
Recommendation Customers should install the patch at the
earliest opportunity.
How to install Run attached file. Choose Yes on
displayed dialog box.
How to use You don't need to do anything after
installing this item.

Microsoft Product Support Services and Knowledge Base
articles can be found on the Microsoft Technical Support
web site. For security-related information about
Microsoft products, please visit the Microsoft Security
Advisor web site, or Contact Us.

Thank you for using Microsoft products.

Please do not reply to this message. It was sent from an
unmonitored e-mail address and we are unable to respond
to any replies.

----------------------------------------------------------
----------------------
The names of the actual companies and products mentioned
herein are the trademarks of their respective owners.

----- END MESSAGE BODY ----

The message appears to be from MS and includes a design
sheeme equal to that of MS and apperant links to MS web
site. However, if Windows Update is launched, no critical
updates are listed for download (as of 09/18/2003.)

I am open to answer any furhter questions if required.

Regards,

M. Eikel
 
A

Alan Edwards

See here for some details of this virus.

F-Secure
http://www.f-secure.com/v-descs/swen.shtml

Network Associates:
http://vil.nai.com/vil/content/v_100662.htm

Trend Micro:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SWEN.A

Symantec
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

Computer Associates:
http://www3.ca.com/virusinfo/virus.aspx?ID=36939

....Alan
--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

In microsoft.public.windows.inetexplorer.ie6.browser, "M. Eikel"
Today I received an e-mail from the "Microsoft Program
Security Section" <[email protected]> that
urges me to install an attached patch named pack.exe.
This e-mail was sent only to my home, but not to my place
of work, which also uses Windows XP and IE 6.0.

I am generally causious regarding any type of attachement
and have therefore not yet opened or downloaded that e-
mail, although Yahoo's Virus scan declares it free of
viruses.

Can anyone verify the legitimacy of the e-mail?

---- Header information of e-mail: -----
(snip)
 
G

Glenn Meyer

Fortuantely, I don't use Windows much when I'm reading e-mail.
Unfortunately, I currently am receiving more than 100 bogus
MS security "updates" a day, thereby doubling my spam with
messages that make it hard to construct an good spam filter. I have
looked for but so far not found anything that the headers of
all these messages have in common. I COULD filter out some
HTML expression, I suppose, but before I do that, has anyone found
a word or phrase that is common to the headers of all these e-mails?

Glenn
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top