Please be sure to read my Malware Home Page

Things I Did, Below

I, personally, receive email in HTML format. The following was received (and looked) like I received it.

• I removed my email addresses. These came to various accounts and some no longer exist. There are places on this site you can get hold of me if you wish or need to. They are protected from spambots using JavaScript, but all you have to do is click on them.
• All scammer and related email addresses, and any actual website links have been changed, at least putting spaces into them. They appear as underlined blue links, though they aren't.
• Any notes I added in the actual letter are in square brackets ("[" "]"), are bold, red in color, and highlighted. If what I found "behind the links" (email or website) are different than what was displayed, I will include them in this type of note.
• All spelling, spacing, line-wrapping, and punctuation errors are the ones that appeared in the original received email. (I may or may not analyze some or all of these.)

Malware Email Example 004
Received 10/23/2006

This email contained a file called UPDATE.exe (106KB).

Example Email 004 Headers
10/23/2006

If you're not interested in the technical aspect of the headers, skip to Example 004 Notes

Notes

• First of all, my Windows updates are AUTOMATIC. Why would I receive a file from them to install manually?
• The email addresses used (FROM and TO) are whatever @ bulletin.ms.com. When you enter www.ms.com, it goes to the Morgan Stanley website. Why would Morgan Stanley be sending me a Microsoft Bulletin?
• The return email address is crockhold @ lyn.net. Why is it not a Microsoft address?
• The attached filename was UPDATE.exe. Don't most MS updates START with MS, have some type of number associated, etc.? And, again, since my updates are automatic, why would they send this to me?
• Even MS knows about all those viruses out there, attempting to exploit every vulnerability. They know about all the spoofed emails, the scams, the spam, etc. And, despite what a number of people may think, they are NOT stupid enough to send a patch through email. They would send a link to THEIR OWN site. (AND, if THIS happens, be sure to VERIFY that the site is MicroSoft!)
• Besides, this came to email address I've never used at MS. Why would they send an email like this to it? While it's a HOTMAIL address, it was the ONLY one of my HOTMAIL addresses that got it. Therefore, it was direct to that email address, and, again, MS shouldn't know it (alone) as an MS user. Hmmm...
• Being from someone I don't know, and an executable, I WILL NOT OPEN IT.

I will NOT be attempting to run this one! (No reason to!)

---

Send comments/questions about this page to Bill Sanders at:

Go to Malware (Viruses, Adware, Spyware) Home page
Go to Malware Examples Home Page
Go to NEXT Malware Example Page (last in sequence is not a link)

Send email to Bill Sanders ()
with questions or comments about this page or site.

This site, all text and graphics (unless otherwise noted) on it
were designed, developed and published by Bill Sanders of Orange Frog Productions.
It and it's CSS was validated and complies with both the: CSS and HTML 4.01 validators from W3C.
NOTE: All CSS validates except the "New Window Buttons" which include some invalid code (ie: hacks),
added PicoSearch Tables, and warnings for using transparent backgrounds when color foregrounds defined.
Copyright © 2003, 2004, 2005, 2006, 2007 by Bill Sanders / Full site last modified: October 21, 2006
Any reproduction, printing, or selling of this content is prohibited without express written consent from William D. Sanders.