Computer Repair Tech

A teacher recently received this email message in the Amphitheater Outlook Web Access (bold formatted words are my emphasis):

From: serv@niet.com [mailto:serv@niet.com]
Sent: Fri 10/27/2006 1:46 AM
To: Some User
Subject: [WARNING: Virus Attack Detected] Mail server report.
Mail server report.
Our firewall determined the e-mails containing worm copies are being sent from your computer.
Nowadays it happens from many computers, because this is a new virus type (Network Worms).
Using the new bug in the Windows, these viruses infect the computer unnoticeably.
After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail addresses
Please install updates for worm elimination and your computer restoring.
Best regards,
Customers support service

Please notice a number of things that stand out and are good indicators that this is an attempt to get the user to open a bogus attachment:

1. The address in the FROM field is not from Microsoft or Symantec Antivirus, but from serv@niet.com.


2. The email is coming from the "mail server"; in reality, the virus scanning software running on the mail server would be the message sender.


3. The message states that "the firewall" has determined that the user's PC is sending out emails containing "worm copies". The network firewall would never be checking this nor would it be generating this type of warning.


4. The grammar is atrocious.


5. The user is expected to install the attached update (update-KB6500-x86.zip) which is also 86 Bytes. Here are problems with this scenario:


• Microsoft never sends out Updates to any of the Windows operating systems directly to users via email.


• Microsoft never sends out updates or patches in a ZIP file format: these updates will be in the form of an .EXE file (an executable program) or an .MSI (Microsoft Installer) file.


• There would never be an update or a patch that is only 86 bytes - the code could be 86 bytes, but the distribution program container would be substantially larger--many Kilobytes.

So, if you really inspect the message and have a foundation in basic knowledge about how Microsoft does business and what are sound business practices in today's world, you will quickly identify the above attempt as phishing and mark the message as Junk Email, and then delete the email and attachments without a second glance. Let's hope that there comes a day when none of this will be necessary, until then, please be safe out there!