New virus?

[Jack Hannibal]

Hi guys,

Is this something new?
"MS Corporation Technical Support" <ofivqk-qwrjw@yyqnqzb.msdn.com>
09/18/2003 02:29 PM

To: "Microsoft Customer" <sttntl@yyqnqzb.msdn.com>
cc: (bcc: user@mycompany)
Subject: Net Security Update
All Products | Support | Search | Microsoft.com Guide
Microsoft Microsoft Home

Microsoft Customer

this is the latest version of security update, the "September 2003, Cumulative Patch" update which fixes all known security vulnerabilities affecting MS Internet Explorer, MS Outlook and MS Outlook Express as well as three new vulnerabilities. Install now to continue keeping your computer secure from these vulnerabilities, the most serious of which could allow an attacker to run executable on your computer. This update includes the functionality of all previously released patches.

System requirements Windows 95/98/Me/2000/NT/XP
This update applies to MS Internet Explorer, version 4.01 and later
MS Outlook, version 8.00 and later
MS Outlook Express, version 4.01 and later
Recommendation Customers should install the patch at the earliest opportunity.
How to install Run attached file. Choose Yes on displayed dialog box.
How to use You don't need to do anything after installing this item.
Microsoft Product Support Services and Knowledge Base articles can be found on the Microsoft Technical Support web site. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site, or Contact Us.

Thank you for using Microsoft products.

Please do not reply to this message. It was sent from an unmonitored e-mail address and we are unable to respond to any replies.
The names of the actual companies and products mentioned herein are the trademarks of their respective owners.
Contact Us | Legal | TRUSTe
©2003 Microsoft Corporation. All rights reserved. Terms of Use | Privacy Statement | Accessibility




All the links in the e-mail go to Microsoft. There is an update.exe file attached though. IMO, this has virus written all over it, but it got through my updated dats and security patches.

Your thoughts?

I thought Microsft never e-mailed customers directly about updates.

Thanks

[VHockey86]

Ya, Id definately be very suspicious of it. I get stuff from microsoft.. but thats only because I'm signed up for their newsletter. Heres an example of an email I've gotten from them

Dear IT Professional,

We are contacting you today to make you aware that we have released Microsoft Security Bulletin MS03-039 today, September 10, 2003. This bulletin details three critical vulnerabilities in the Windows operating system and provides instructions for applying the corresponding patch. While there is currently no active exploit of this vulnerability, if successfully exploited, these vulnerabilities would allow an attacker to gain control of the target system.

We strongly encourage you to obtain and deploy this patch to any affected system that connects to your infrastructure; this includes systems on your local area network and remote or mobile systems. For the most current information on affected systems and recommended remediation steps, please read the bulletin posted at: http://www.microsoft.com/technet/sec...n/ms03-039.asp

We understand the potential effect this situation and the recommended remediation steps may have on you. Microsoft is committed to providing you with information and tools to help run your enterprise safely and reliably on an on-going basis. When we become aware of vulnerabilities, it is our goal to quickly share protection and remediation information and work in partnership with you to eliminate these kinds of threats to your business. In order to help protect your computing environment from security vulnerabilities, we strongly encourage you to visit http://www.microsoft.com/technet/security/protect and implement the following three steps in your enterprise:

1. Verify firewall configuration. Audit Internet and intranet firewalls to ensure they comply with your security policy; these are your first line of defense. In addition, evaluate using host-level firewalls such as the Internet Connection Firewall in Windows XP. This is especially important for systems such as laptops and home PCs that connect to your network remotely.

2. Stay up to date. Use update services from Microsoft to keep your systems up to date. These services include three main components.

. Automatic Updates, available on Windows XP, Windows 2000 SP3 and SP4, and Windows Server 2003. Automatic Updates works with the Windows Update Web site to automate the process of updating Windows systems.

. Software Update Services (SUS), a patch-distribution server available for download from our Web site. SUS enables you deploy a server in your enterprise that Automatic Updates clients will use to get only approved and tested patches.

. Systems Management Server (SMS) is a flexible, enterprise-wide software update and systems management product.
In addition to using these update services, we strongly recommend that you subscribe to Microsoft's free security notification service at http://www.microsoft.com/securitynotification, so that you are proactively kept aware of new security issues.

3. Use and keep antivirus software up-to-date. Antivirus software programs will help protect your systems against viruses and other malicious code. To protect your systems from new viruses, it's also important to obtain up-to-date antivirus signatures through a subscription service from the antivirus software vendor. You should not let remote users or laptops connect to your network unless they have up-to-date antivirus software installed. In addition, consider using antivirus software in multiple points of your computer infrastructure, such as on edge Web proxy systems, as well as on email servers and gateways.

You should also protect your network by requiring employees to take the same three steps with home and laptop PCs they use to remotely connect to your enterprise, and by encouraging them to talk with friends and family to do the same with their PCs. To make this easier, we have set up a new Web site to assist PC users at http://www.microsoft.com/protect.

Again, we want to encourage you to read this security bulletin and deploy the patch to your systems. We want to thank you for your patience and work with you to protect your business from these kinds of security threats.



Thank you,

Microsoft Corporation



For information about Microsoft's privacy policies, please go to http://www.microsoft.com/info/privacy.htm

Theres no way microsoft would attach the file with their email... they would simply direct you to a download link on their site

[ragtop]

Very suspicious

There was a virus floating around recently that used a similar M.O. The thing that really raises a red flag for me is the fact that it says its compatible with everything from WIN 95 to WIN XP. God knows, nothing is ever compatible with that many MS products Besides, I thought they quit providing updates for WIN 95 a while ago.

I wouldn't install any Windows updates unless you get them direct from the MS update site.

[vass0922]

DO NOT OPEN THAT MAIL

MS does NOT send updates by mail

[Epyon9283]

http://securityresponse.symantec.com...swen.a@mm.html

[DanGrease]

Did you open that mail or downloaded something from it? Dont do it, thanks for all the information since this can happen to me and now I know what to do when I recieve these malicious mails. Yep, a virus, I just think its ridiculous that they do it this way, but smart since my mother would have downloaded that file easy since it claims to be Microsoft, I would have done the same as you did, as my people from TechIMO

dan

[Dj-Icer]

Weird too, Microsoft somehow was too kind asking you how are you doing today I once had an email subjected, "will you marry me?". I thought it was done by some jerk and thought it could be a girl in my class. I didn't open the email, not because I knew its a virus, but I refusing it. The email, however, was about 200 kb, which is heavy for some reason. It could be a virus, I don't know but I won't missing anything if the email was truly from a person.

If you printed out something, sometimes theres some kind of windings letters and symbols appeared on the very bottom of the paper. I have heard someone told me that the computer has a virus. Is this thing true?

[zepper]

I figured it was something like that but I never imagined the thing did so much messing around with the computer of anyone dumb or ignorant enough to execute the attachment.
. I've gotten more copies of this thing in one 24hr period than any other worm/trojan/etc.
.bh.