We've received several reports of a mass mailing that's going around. The messages have been spoofed to look like they are from update@microsoft.com and arrive with title "Warning! New Virus On The Internet! Update Now!".



The link in the mail goes to http://update.microsoft.go.ro and downloads an IRC backdoor. Administrators might want to filter web traffic to this site.

Abuse messages on the site have been sent. The downloaded file is detected as W32/FakeMSUpdate by our latest update (2006-07-26_02).