I usually Google the attachment name upon receiving such emails: Searching on Installer6.exe reveals: This is a mass-mailing worm that poses as a legitimate email from Microsoft Windows Update. It is official name is: W32/Swen@MM or W32/Swen-A or W32/Gibe-F. The worm also attempts to propagate via peer-to-peer (P2P) file-sharing networks, such as Kazaa, via IRC and also via newsgroups. Furthermore, it terminates running antivirus and firewall software running on an infected system. It was first discovered on the 18th September 2003. The attachment may also be called Install6.exe The above was on www.updatexp.com but other websites tell a similar story. It is surprising for how long such emails circulate. Chris ----- Original Message ----- From: "Art Seddon" <aseddon@artseddon.com> To: <gen-comp-tips@rootsweb.com> Sent: 30 March 2008 17:19 Subject: Re: [GEN-COMP-TIPS] MS Security - Critical Update Attached > Get your Microsoft updates from Microsoft only!!! > http://www.update.microsoft.com/windowsupdate/v6/default.aspx?ln=en-us > > As you note, the e:mail says Microsoft.net - the legit address is > microdot,com > > Chances are it is a hijacking virus. > > Art Seddon > > ----- Original Message ----- > From: "Shirley" <squirrelena@yahoo.com> > To: <GEN-COMP-TIPS@rootsweb.com> > Sent: Sunday, March 30, 2008 4:32 AM > Subject: [GEN-COMP-TIPS] MS Security - Critical Update Attached > > > Has anyone received an e-mail from the following: > > cdifalpwqntv@advisor.microsoft.net > > MS Customer > > this is the latest version of security update, the > "March 2008, Cumulative Patch" update which eliminates > all known security vulnerabilities affecting MS > Internet Explorer, MS Outlook and MS Outlook Express > as well as three newly discovered vulnerabilities. > Install now to protect your computer from these > vulnerabilities. This update includes the > functionality of all previously released patches. > > At the end is an attachment called (installer6.exe). > My question, is this legit? I can't recall ever > getting an update as an attachment. I don't want to > click the download, just in case it is a virus. > > Any suggestions as to how to verify this? > > Thanks for all your help. You guys and gals are the > greatest! > > Shirley > > > ____________________________________________________________________________________ > Be a better friend, newshound, and > know-it-all with Yahoo! Mobile. Try it now. > http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ > -------------------------------------- > Having trouble with your subscription? Contact the List Admin at > gen-comp-tips-admin@rootsweb.com > ------------------------------- > To unsubscribe from the list, please send an email to > GEN-COMP-TIPS-request@rootsweb.com with the word 'unsubscribe' without the > quotes in the subject and the body of the message > > -------------------------------------- > Having trouble with your subscription? Contact the List Admin at gen-comp-tips-admin@rootsweb.com > ------------------------------- > To unsubscribe from the list, please send an email to GEN-COMP-TIPS-request@rootsweb.com with the word 'unsubscribe' without the quotes in the subject and the body of the message > > -- > This email has been verified as Virus free. > Virus Protection and more available at http://www.plus.net >