FAIL: "Microsoft has released an update for Microsoft Outlook"

There's been a whole host of these recently, so this one is nothing new - except that in this case, only 1 out of those he's seen, actually resolves.

Incase it was just a case of his DNS server not having the IP's yet, I ran the hostnames he listed through hpObserver, and the results showed exactly the same thing. In this case, the one that does resolve, is quite obviously a part of a botnet, and not surprisingly, consists mainly of home DSL lines by the looks of it.

hpObserver results are at;

http://hosts-file.net/misc/hpObserver_-_Microsoft_Outlook_Malware.html

This email looks like it's from Microsoft, but it is really intended to load a trojan onto your PC:

From: Microsoft Customer Support [mailto:no-reply@microsoft.com]
Sent: 18 June 2009 22:47
Subject: Microsoft has released an update for Microsoft Outlook

Critical Update

Update for Microsoft Outlook / Outlook Express (KB910721)
Brief Description
Microsoft has released an update for Microsoft Outlook / Outlook Express. This update is critical and provides you with the latest version of the Microsoft Outlook / Outlook Express and offers the highest levels of stability and security.
Instructions
• To install Update for Microsoft Outlook / Outlook Express (KB910721) please visit Microsoft Update Center:
http://update.microsoft.com/microsoftofficeupdate/isapdl/default.aspx?ln=en-us&id=[redacted]
Quick Details
• File Name: officexp-KB910721-FullFile-ENU.exe
• Version: 1.4
• Date Published: Thu, 18 Jun 2009 16:46:55 -0500
• Language: English
• File Size: 81 KB
System Requirements
• Supported Operating Systems: Windows 2000; Windows 98; Windows ME; Windows NT; Windows Server 2003; Windows XP; Windows Vista
• This update applies to the following product: Microsoft Outlook / Outlook Express
Contact Us
© 2009 Microsoft Corporation. All rights reserved. Contact Us |Terms of Use |Trademarks |Privacy Statement

Read more
http://www.dynamoo.com/blog/2009/06/fail-microsoft-has-released-update-for.html