Y2K VIRUS

Dear all,

Recently, we found a new virus that use "Support@Microsoft.com" as the
sender, and send a Y2Kcount.exe to many customers. Please take care that it
is not real, it is a VIRUS. If you receive an e-mail that claims to contain
software from Microsoft, do not run the attachment. The safest course of
action is to delete the mail altogether

Situation:  There is a Trojan horse virus (Y2Kcount.exe) in circulation
claiming to be a Year 2000 countdown timer provided by Microsoft.  This
Trojan horse is distributed via email, the originator of the email has
spoofed a Microsoft email address "Support@Microsoft.com"



Talking Points:
* Microsoft was notified on Wednesday afternoon (Sept. 15) that a
Trojan email hoax (called Y2Kcount.exe) had been distributed to Microsoft
customers. This email was not sent by Microsoft and the attachment that is
being distributed is not a Y2K countdown program, but instead a Trojan
virus.
* Microsoft does not distribute software via email
* Microsoft will only distribute year 2000 related updates from its
website (http://www.microsoft.com/y2k) or a tangible CD ROM, such as the
Microsoft Year 2000 Resource CD.
* Microsoft distributes upgrades via the Internet. When Microsoft does
this, the software will be available via the web site, http://www.microsoft.
com, or through the FTP site, <ftp://ftp.microsoft.com>.
* Microsoft occasionally sends e-mail to customers to inform them that
upgrades are available. However, the e-mail will only provide links to the
download sites -- Microsoft will never attach the software itself to the
e-mail. The links will always lead to either the web site or the FTP site,
never to a third-party site.
* Microsoft always uses Authentic code to digitally sign their
products and allows users to ensure that they have not been tampered with.
* If you receive an e-mail that claims to contain software from
Microsoft, do not run the attachment. The safest course of action is to
delete the mail altogether.
* Microsoft is notifying its customers of this Trojan horse and has
updated its year 2000 website with the latest information/details


The message reads:

From: support@microsoft.com
Sender: support@microsoft.com
Subject: Microsoft Announcement
Date: Wed, 15 Sep 1999 00:49:57 +0200

To All Microsoft Users,

We are excited to announce Microsoft Year 2000 Counter.

Start the countdown NOW.
Let us all get in the 21 Century.
Let us lead the way to the future and we will get YOU there FASTER
and SAFER.


Thank you,

Microsoft Corporation

Attached is the INTERNAL Security bulletin:

<< Message: ITG Information Security Warning  W19990915-42-B-Windows:
Y2KCOUNT (AKA:Polyglot) Trojan - Yellow Alert >>



J.M.Ho
Microsoft Taiwan
Sr. Technical Account Manager
Tel: 886-2-2508-7834
Fax: 886-2-2508-9575
Email: jmho@microsoft.com