Subject: Re: FWD: Try this security update from Microsoft. (fwd)

From: "Dwight K. Elvey" <[email-masked]>
Date: Wed Apr 16 15:40:00 2003

Hi Don
 I've gotten this several times on my hotmail account as
well. I just hope that most people are not stupid enough
to ask for it and put it on their machines. I doubt anyone
on this list is that stupid so mining list list would be
a waste of time.
Dwight

>From: "Don Maslin" <[email-masked]>
>
>This guy has obviously mined the classiccmp mail list for his
>address list!
>						- don
>
>---------- Forwarded message ----------
>Date: Wed, 16 Apr 2003 11:00:02 +0200
>From: Alexander Thaler <[email-masked]>
>To: [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], 
[email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked],
>     [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], 
[email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked], [email-masked], [email-masked],
>     [email-masked]
>Subject: FWD: Try this security update from Microsoft.
>
>
>----- Original message follows -----
>
>Microsoft Customer
>
>this is the latest version of security update, the
>"April 2003, Cumulative Patch" update which eliminates all
>known security vulnerabilities affecting Internet Explorer,
>Outlook and Outlook Express as well as five newly discovered
>vulnerabilities. Install now to protect your computer from these
>vulnerabilities, the most serious of which could allow an attacker to
>run executable on your system. This update includes the functionality
>of all previously released patches.
>
>System requirements:
>Win 9x/Me/2000/NT/XP
>
><snip>
>
>[demime 1.01a removed an attachment of type APPLICATION/X-MSDOWNLOAD which had 
a NAME of update797.exe]

---

From: "Patrick Rigney" <[email-masked]>
Date: Wed Apr 16 16:38:01 2003

Don,

I'd guess this is part of an earnest, recently-launched campaign that I
think might be even more generic.  I have of late received many (all
deMIMEd) emails with similar content from several people who I know for a
fact are not on cctalk.  It may well be, however, that one of us accidently
was infected by its payload, and that payload is now emailing everyone in
that person's address book.  I know a lot of people who use Outlook's "Put
everyone I reply to in my Address Book" feature, which would then easily
result in this effect, particularly for someone who has been on the list for
a while and carried on a few off-list conversations.

In any case, it seems to be going around.  The most recent I received, just
this morning, came under the guise of being a virus
scanner/remover/innoculator for Klez that should be run immediately, "before
infecting [sic] can occur."  Riiiiight...

Patrick

---

From: Kevin Handy <[email-masked]>
Date: Wed Apr 16 19:04:00 2003

>think might be even more generic.  I have of late received many (all
I've been getting such emails for months, but they have been blocked
by my ISP's virus scanners. It's not new, but seems to becomming more
common lately.

MicroSoft does NOT email updates, so any such e-mails you get are
99 and 44/100% going to be a virus.  Never trust emailed updates
without verifying that they are legitimate, and from the original source
(in this case MicroSoft).