Comments on: Microsoft Outlook Notification Scam Email

By: appointment scheduling software

appointment scheduling software — Fri, 18 Jun 2010 18:35:39 +0000

I’ve operated my computer business from a paper appointment pad, then tried the ms outlook program but wow, bill gates has never run a small business, i couldn’t use it on a network . then i tried ms excel since the cells were like a calendar, but that was a farce since i couldn’t keep track of any customer info… when is microsoft gonna get it right? Perhaps it’s more a case of when are you going to learn to use it properly, but then again you don’t have to, as you have your own scheduling software that you are promoting? BM

By: Audrey Jones

Audrey Jones — Fri, 23 Oct 2009 07:58:51 +0000

New Microsoft scam mail:

Update for Microsoft Outlook / Outlook Express (KB910721)
Brief Description
Microsoft has released an update for Microsoft Outlook / Outlook Express. This update is critical and provides you with the latest version of the Microsoft Outlook / Outlook Express and offers the highest level of security and stability.
Instructions
To install Update for Microsoft Outlook / Outlook Express (KB910721) please visit Microsoft Update Center:

This is then followed by a link which obviously should not be followed….. hope this is helpful to others

Audrey

By: TallyMatt

TallyMatt — Mon, 19 Oct 2009 14:09:57 +0000

Rec’d it @ 5:35am on 10/18/2009. Deleted it. Thanks to this blog, I’ve gotten everyone in my organization up to speed.

By: Mr Video

Mr Video — Sun, 18 Oct 2009 07:04:22 +0000

Yep, I knew this was a tojan spam as soon as I saw it. Why? 1) I don’t use Outlook at home (forced to use it as work), I use mutt and 2) I’m on a Solaris 10 server. I won’t exactly be running any of the Microcrap stuff on my Solaris x86 server.

The following DLLs are referenced in the exe file:

KERNEL32.DLL
MSVCRT.DLL
USER32.DLL
ADVAPI32.DLL
RPCRT4.DLL
GDI32.DLL

There are bunch of functions that are called as well. But I won’t put that long list here.

Buyer beware!

Whilst I appreciate your helpful comment - Microcrap? - that offends the hundreds and thousands of people that use Microsoft products to run their machines. What’s so special about Solaris? Did you build your 1990’s amateur website on the solaris? Looks like it. Offended? Not nice is it? BM

By: Kujoy

Kujoy — Sat, 17 Oct 2009 12:03:32 +0000

Started getting this one after a Nigerian Scammer tried to rip me off on eBay. Was surprised to see it got through the mail servers anti virus protection plus ESET smart security 4 didnt pick it up either both of which have never let me down before.

By: Chris

Chris — Sat, 17 Oct 2009 07:30:43 +0000

Got that on 16th Oct in South Africa too…….

By: Dean

Dean — Fri, 16 Oct 2009 18:33:57 +0000

I have been getting these for a few days now. I “saved as” and did a scan, it’s a trojan alright:

Documents\install.zip/install.exe detected: Trojan-Downloader.Win32.FakeRean!IK

By: Rich

Rich — Fri, 16 Oct 2009 18:19:47 +0000

Have received a fair splattering of these over the past week or so - there are 5 in my inbox at this very moment(Midlands, UK, by the way). I delete them as a matter of course, but they’re pretty convincing. I’ve also now added the sender to my Blocked Senders List. Won’t stop them, but at least it makes me feel that - however delusional - I’m doing something to make life that little bit more awkward for these anti-social pests.

By: Marilyn

Marilyn — Fri, 16 Oct 2009 13:31:36 +0000

Received this via our company’s website. It was forwarded via to our customer service contact address.

By: Willem

Willem — Fri, 16 Oct 2009 06:34:58 +0000

Also in the Netherlands
Have been receiving this mail on several accounts within our domain for the last 2 weeks!
Beware!!

By: EC Web

EC Web — Fri, 16 Oct 2009 02:45:49 +0000

my client had the same email this morning.
He fell straight for it and tried his best to open the ‘install.zip’ - thank God he was unable to open it and asked for my help!

By: Jeff Salmeto

Jeff Salmeto — Fri, 16 Oct 2009 01:25:59 +0000

Recieved the same email today to our ecommerce site. Checked into it and was informed that the only email that Microsoft Outlook will send is the test email when you setup the account. They will not send a zip file. Also, the email address that the message was sent to is not even an address setup with our Outlook client. It has an auto forward in our website control panel which sends messages from that account to the correct email accounts. These people are getting pretty slick!

By: Justin

Justin — Thu, 15 Oct 2009 15:20:33 +0000

I work in IT support, we’ve had two customers in the UK hit by this today so far.

Subject: Microsoft Outlook Notification for the @

Body text:
You have (6) New Message from Outlook Microsoft

- Please re-configure your Microsoft Outlook Again.
- Download attached setup file and install.

Attached file: install.zip (21Kb)

Note the file size on the attached file. I think this is going to ‘do the rounds’ over the next week or so, please make sure everyone follows the excellent advice above and uses + on this message as soon as they receive it.

By: Glen in DC

Glen in DC — Thu, 15 Oct 2009 14:54:16 +0000

Thanks for this info.

By: Jenna

Jenna — Thu, 15 Oct 2009 14:24:52 +0000

My Sales Manager received this today in Ohio. He called me over to his desk to ask me what it was. The from line said “Support” - but when you look closer, it was actually using his e-mail address in the from field.

I knew right away something was not right when I noticed the “install.zip” attachment and the fact that it says
“Outlook Microsoft” instead of just Outlook or Microsoft Outlook.

We deleted it immediately but I encourage others to keep an eye out.

By: Peter Yurgel

Peter Yurgel — Thu, 15 Oct 2009 14:17:39 +0000

I just got one too. IT confirmed it to be dangerous.

By: Nick

Nick — Thu, 15 Oct 2009 14:14:06 +0000

Got the same message. It seemed strange that MS would even care about my 2000 Outlook. Thanks for the heads-up.

By: Paul

Paul — Thu, 15 Oct 2009 11:48:55 +0000

Received this about an hour ago and although it “seemed” legit I preferred to have it check by our IT crew.

They confirmed it was not only spam but the bad kind too.

By: captain sparkle

captain sparkle — Thu, 15 Oct 2009 10:34:47 +0000

received identical email this morning, through my website address, not my personal email address!

By: Nathalie

Nathalie — Thu, 15 Oct 2009 09:51:58 +0000

same for me, received today in France !

By: Stargazer

Stargazer — Thu, 15 Oct 2009 09:06:38 +0000

I have even spotted those messages on various mailing lists which *definitively* do not have outlook installed.

Remember kids: never do this at home on your windows box as it can lead to a virus outbreak if you don’t know exactly what you’re doing.

The ZIP file contains a file named install.exe which is more or less just another archive containing a few more files which are as follows:

.text, .rdata, .data, .tls and .edata

A more in deep analysis would be required, but I was seeing parts in those files saying “FuC1.FuC1.FuC1″

So I totally agree on deleting the received mail. But be prepared for some more unpleasant surprises like that.

By: fs

fs — Thu, 15 Oct 2009 08:31:05 +0000

I came to work this morning to find several colleagues inc. myself with this email. I started doing checks/scans on the mailserver but could not find anything untoward. Any idea how these are generated, they have the correct email addresses which makes me wonder if its something within the network.
They cull the email addresses off the net and spam that they send is simply set so that the “from” email address appears the same as the “to” address. BM