I got an unusual message from Microsoft
(windowssecurity@email.microsoft.com) that starts out with

>*** PLEASE NOTE: Due to the critical importance of this
message, this communication is being sent to all of our
Microsoft customers to alert you of this Security
Bulletin. ***

I have asked a number of people whether they also got this
message - none have seen it. The message goes on:

>It has been widely reported in the press and on
Microsoft's own web site, that on July 16th we released a
critical security bulletin (MS03-026) and a patch
regarding a vulnerability in the Windows operating system.
We wanted to make sure that if you were not aware of this
bulletin and corresponding patch that you take a moment to
go to http://www.microsoft.com/security/
security_bulletins/ms03-026.asp to find out if you are
running an affected version of the Windows operating
system and get the specific information as to what you
need to do to apply this patch if you have not already.

>Although we encourage you to pay attention to all
security bulletins and to deploy patches in a timely
manner we wanted to call special attention to this
particular instance as we have become aware of some
activity on the internet that we believe increases the
likelihood of the exploitation of this vulnerability.
=============

I followed the instructions, downloaded and installed all
the patches (Win2000, IE affected) and now EVERY SINGLE
EMAIL ATTACHMENT IS BLOCKED BY OUTLOOK EXPRESS, its
filename replaced with

OE removed access to the following unsafe attachments in
your mail:

The message from "Microsoft" ends with

>We apologize for any inconvenience the implementation of
this patch might cause and appreciate you taking the time
to update your system.

According to the message header, the message was sent by
Digital Impact, which is known to do bulk mailing on
behalf of Microsoft.

Does anybody know anything about this? And How do I get my
email attachments back???

Thanks in advance.

WK

Re: Bogus Microsoft security message? by Jake

Jake
Thu Aug 07 12:45:53 CDT 2003

Dunno why you got the message, but it isn't bogus. MS03-026 is a valid
security issue, and the link the e-mail provides you with is a real one. I
suggest that if you run one of the affected operating systems, you apply the
patch as the email suggests.
--
Jake W. Paris

"WK" <wendellcosmol@altavista.com> wrote in message
news:07c301c35d05$cfa6f170$a001280a@phx.gbl...
> I got an unusual message from Microsoft
> (windowssecurity@email.microsoft.com) that starts out with
>
> >*** PLEASE NOTE: Due to the critical importance of this
> message, this communication is being sent to all of our
> Microsoft customers to alert you of this Security
> Bulletin. ***
>
> I have asked a number of people whether they also got this
> message - none have seen it. The message goes on:
>
> >It has been widely reported in the press and on
> Microsoft's own web site, that on July 16th we released a
> critical security bulletin (MS03-026) and a patch
> regarding a vulnerability in the Windows operating system.
> We wanted to make sure that if you were not aware of this
> bulletin and corresponding patch that you take a moment to
> go to http://www.microsoft.com/security/
> security_bulletins/ms03-026.asp to find out if you are
> running an affected version of the Windows operating
> system and get the specific information as to what you
> need to do to apply this patch if you have not already.
>
> >Although we encourage you to pay attention to all
> security bulletins and to deploy patches in a timely
> manner we wanted to call special attention to this
> particular instance as we have become aware of some
> activity on the internet that we believe increases the
> likelihood of the exploitation of this vulnerability.
> =============
>
> I followed the instructions, downloaded and installed all
> the patches (Win2000, IE affected) and now EVERY SINGLE
> EMAIL ATTACHMENT IS BLOCKED BY OUTLOOK EXPRESS, its
> filename replaced with
>
> OE removed access to the following unsafe attachments in
> your mail:
>
> The message from "Microsoft" ends with
>
> >We apologize for any inconvenience the implementation of
> this patch might cause and appreciate you taking the time
> to update your system.
>
> According to the message header, the message was sent by
> Digital Impact, which is known to do bulk mailing on
> behalf of Microsoft.
>
> Does anybody know anything about this? And How do I get my
> email attachments back???
>
> Thanks in advance.
>
> WK
>



Re: Bogus Microsoft security message? by wk

wk
Thu Aug 07 13:10:48 CDT 2003

I DID apply the patch. The patch is what is causing the
problem!

>-----Original Message-----
>Dunno why you got the message, but it isn't bogus. MS03-
026 is a valid
>security issue, and the link the e-mail provides you with
is a real one. I
>suggest that if you run one of the affected operating
systems, you apply the
>patch as the email suggests.
>--
>Jake W. Paris
>
>"WK" <wendellcosmol@altavista.com> wrote in message
>news:07c301c35d05$cfa6f170$a001280a@phx.gbl...
>> I got an unusual message from Microsoft
>> (windowssecurity@email.microsoft.com) that starts out
with
>>
>> >*** PLEASE NOTE: Due to the critical importance of this
>> message, this communication is being sent to all of our
>> Microsoft customers to alert you of this Security
>> Bulletin. ***
>>
>> I have asked a number of people whether they also got
this
>> message - none have seen it. The message goes on:
>>
>> >It has been widely reported in the press and on
>> Microsoft's own web site, that on July 16th we released
a
>> critical security bulletin (MS03-026) and a patch
>> regarding a vulnerability in the Windows operating
system.
>> We wanted to make sure that if you were not aware of
this
>> bulletin and corresponding patch that you take a moment
to
>> go to http://www.microsoft.com/security/
>> security_bulletins/ms03-026.asp to find out if you are
>> running an affected version of the Windows operating
>> system and get the specific information as to what you
>> need to do to apply this patch if you have not already.
>>
>> >Although we encourage you to pay attention to all
>> security bulletins and to deploy patches in a timely
>> manner we wanted to call special attention to this
>> particular instance as we have become aware of some
>> activity on the internet that we believe increases the
>> likelihood of the exploitation of this vulnerability.
>> =============
>>
>> I followed the instructions, downloaded and installed
all
>> the patches (Win2000, IE affected) and now EVERY SINGLE
>> EMAIL ATTACHMENT IS BLOCKED BY OUTLOOK EXPRESS, its
>> filename replaced with
>>
>> OE removed access to the following unsafe attachments in
>> your mail:
>>
>> The message from "Microsoft" ends with
>>
>> >We apologize for any inconvenience the implementation
of
>> this patch might cause and appreciate you taking the
time
>> to update your system.
>>
>> According to the message header, the message was sent by
>> Digital Impact, which is known to do bulk mailing on
>> behalf of Microsoft.
>>
>> Does anybody know anything about this? And How do I get
my
>> email attachments back???
>>
>> Thanks in advance.
>>
>> WK
>>
>
>
>.
>

Re: Bogus Microsoft security message? by Karl

Karl
Thu Aug 07 14:25:29 CDT 2003

Sigh... the official answer from Microsoft gives you a way to fix this
without entirely disabling the protection feature. Somehow people aren't
getting the message that this is out there. See here:

http://securityadmin.info/faq.htm#attachments


"Jake Paris" <jparis.removethiscrap@whpi.com> wrote in message
news:ScxYa.1$Sb2.0@nwrddc02.gnilink.net...
> Sorry, I didn't read far enough down in your email to see that part...
> assumed this was just a question regarding the veracity of the email.
Within
> OE's Tools menu -> Options -> Security -> Uncheck the box for "Do not
allow
> attachments to be opened or saved that could potentially contain a
virus"...
> however, do this at your own risk.



Re: Bogus Microsoft security message? by wk

wk
Thu Aug 07 15:54:47 CDT 2003

Thanks!

OK, now that I know that I'm talking to an MVP: Why does
the message from MS start by saying it's being sent to all
MS customers, and yet nobody else I know got it?

I'm only a MS customer by virtue of having purchased
various PCs with Windows & Office preinstalled.

WK


>-----Original Message-----
>Hence why I am not mvp, and you are... learn something
new every day my
>friend ;)
>
><--- tryin my best
>--
>Jake W. Paris
>
>"Karl Levinson [x y] mvp" <levinson_k@despammed.com>
wrote in message
>news:eRdAJqRXDHA.2464@TK2MSFTNGP09.phx.gbl...
>> Sigh... the official answer from Microsoft gives you a
way to fix this
>> without entirely disabling the protection feature.
Somehow people aren't
>> getting the message that this is out there. See here:
>>
>> http://securityadmin.info/faq.htm#attachments
>>
>>
>> "Jake Paris" <jparis.removethiscrap@whpi.com> wrote in
message
>> news:ScxYa.1$Sb2.0@nwrddc02.gnilink.net...
>> > Sorry, I didn't read far enough down in your email to
see that part...
>> > assumed this was just a question regarding the
veracity of the email.
>> Within
>> > OE's Tools menu -> Options -> Security -> Uncheck the
box for "Do not
>> allow
>> > attachments to be opened or saved that could
potentially contain a
>> virus"...
>> > however, do this at your own risk.
>>
>>
>
>
>.
>

Re: Bogus Microsoft security message? by Lanwench

Lanwench
Thu Aug 07 20:40:24 CDT 2003

Read recent posts - you are not the only one. :-)

wk wrote:
> Thanks!
>
> OK, now that I know that I'm talking to an MVP: Why does
> the message from MS start by saying it's being sent to all
> MS customers, and yet nobody else I know got it?
>
> I'm only a MS customer by virtue of having purchased
> various PCs with Windows & Office preinstalled.
>
> WK
>
>
>> -----Original Message-----
>> Hence why I am not mvp, and you are... learn something new every day
>> my friend ;)
>>
>> <--- tryin my best
>> --
>> Jake W. Paris
>>
>> "Karl Levinson [x y] mvp" <levinson_k@despammed.com> wrote in message
>> news:eRdAJqRXDHA.2464@TK2MSFTNGP09.phx.gbl...
>>> Sigh... the official answer from Microsoft gives you a way to fix
>>> this without entirely disabling the protection feature. Somehow
>>> people aren't getting the message that this is out there. See here:
>>>
>>> http://securityadmin.info/faq.htm#attachments
>>>
>>>
>>> "Jake Paris" <jparis.removethiscrap@whpi.com> wrote in message
>>> news:ScxYa.1$Sb2.0@nwrddc02.gnilink.net...
>>>> Sorry, I didn't read far enough down in your email to see that
>>>> part... assumed this was just a question regarding the
> veracity of the email.
>>> Within
>>>> OE's Tools menu -> Options -> Security -> Uncheck the
> box for "Do not
>>> allow
>>>> attachments to be opened or saved that could
> potentially contain a
>>> virus"...
>>>> however, do this at your own risk.
>>>
>>>
>>
>>
>> .



Re: Bogus Microsoft security message? by Jake

Jake
Fri Aug 08 07:52:16 CDT 2003

That's a different e-mail my friend.
--
Jake W. Paris

"Shaz" <sharongenge@blandford28.freeserve.co.uk> wrote in message
news:048701c35d55$d453a240$a501280a@phx.gbl...

>-----Original Message-----
>I got an unusual message from Microsoft
>(windowssecurity@email.microsoft.com) that starts out with
>
>>*** PLEASE NOTE: Due to the critical importance of this
>message, this communication is being sent to all of our
>Microsoft customers to alert you of this Security
>Bulletin. ***
>
>I have asked a number of people whether they also got
this
>message - none have seen it. The message goes on:
>
>>It has been widely reported in the press and on
>Microsoft's own web site, that on July 16th we released a
>critical security bulletin (MS03-026) and a patch
>regarding a vulnerability in the Windows operating
system.
>We wanted to make sure that if you were not aware of this
>bulletin and corresponding patch that you take a moment
to
>go to http://www.microsoft.com/security/
>security_bulletins/ms03-026.asp to find out if you are
>running an affected version of the Windows operating
>system and get the specific information as to what you
>need to do to apply this patch if you have not already.
>
>>Although we encourage you to pay attention to all
>security bulletins and to deploy patches in a timely
>manner we wanted to call special attention to this
>particular instance as we have become aware of some
>activity on the internet that we believe increases the
>likelihood of the exploitation of this vulnerability.
>=============
>
>I followed the instructions, downloaded and installed all
>the patches (Win2000, IE affected) and now EVERY SINGLE
>EMAIL ATTACHMENT IS BLOCKED BY OUTLOOK EXPRESS, its
>filename replaced with
>
>OE removed access to the following unsafe attachments in
>your mail:
>
>The message from "Microsoft" ends with
>
>>We apologize for any inconvenience the implementation of
>this patch might cause and appreciate you taking the time
>to update your system.
>
>According to the message header, the message was sent by
>Digital Impact, which is known to do bulk mailing on
>behalf of Microsoft.
>
>Does anybody know anything about this? And How do I get
my
>email attachments back???
>
>Thanks in advance.
>
>WK
>
>.
>Hi WK
I recieved the following email...........

Microsoft Customer

this is the latest version of security update, the
"August 2003, Cumulative Patch" update which eliminates
all known security vulnerabilities affecting Internet
Explorer,
Outlook and Outlook Express as well as five newly
discovered vulnerabilities. Install now to protect your
computer
from these vulnerabilities, the most serious of which
could allow
an attacker to run executable on your system. This update
includes
the functionality of all previously released patches.

System requirements Win 9x/Me/2000/NT/XP
This update applies to Microsoft Internet Explorer,
version 4.01 and later
Microsoft Outlook, version 8.00 and later
Microsoft Outlook Express, version 4.01 and later
Recommendation Customers should install the patch at the
earliest opportunity.
How to install Run attached file. Click Yes on displayed
dialog box.
How to use You don't need to do anything after installing
this item.

Microsoft Product Support Services and Knowledge Base
articles
can be found on the Microsoft Technical Support web site.
For security-related information about Microsoft products,
please
visit the Microsoft Security Advisor web site, or Contact
us.

Please do not reply to this message. It was sent from an
unmonitored
e-mail address and we are unable to respond to any
replies.

Thank you for using Microsoft products.

With friendly greetings,
Microsoft Internet Security Section

-----------------------------------------------------------
---------------------
©2003 Microsoft Corporation. All rights reserved. The
names of the actual companies
and products mentioned herein may be the trademarks of
their respective owners.

I followed the instructions to install the attachment and
my anti virus kicked in. ITS A VIRUS!!!!
If you get this email again delete it. there is no such
patch!!
Go to tools, then options then security, the 4th option
(Do not allow attachments o be opened or saved that may
potentially contain a virus) should be unchecked. That
should sort your problem out for you.
Good luck
Shaz



Re: Bogus Microsoft security message? by Karl

Karl
Fri Aug 08 08:58:04 CDT 2003

I'm sorry, I didn't intend to offend. I wasn't really thinking about you in
particular when I wrote that, I was thinking about how that's the answer
given close to 100% of the time by pretty much everyone. Clearly my opinion
is in the minority. I just tried to be a little more emphatic in my words
to try to get the message stuck in people's heads this time around. Your
answer was correct and isn't really a mistake, in fact my answer is clearly
in the minority. I haven't stopped learning [or making mistakes] either.


"Jake Paris" <jparis.removethiscrap@whpi.com> wrote in message
news:A9yYa.19$Mp3.6@nwrddc01.gnilink.net...
> Hence why I am not mvp, and you are... learn something new every day my
> friend ;)
>
> <--- tryin my best
> --
> Jake W. Paris
>
> "Karl Levinson [x y] mvp" <levinson_k@despammed.com> wrote in message
> news:eRdAJqRXDHA.2464@TK2MSFTNGP09.phx.gbl...
> > Sigh... the official answer from Microsoft gives you a way to fix this
> > without entirely disabling the protection feature. Somehow people
aren't
> > getting the message that this is out there. See here:
> >
> > http://securityadmin.info/faq.htm#attachments