邮件为英文，主题为Mail server report.，附件为ZIP文件，文件名貌似微软更新文件，解压后图标为记事本图标，很具欺骗性，其实是EXE文件。

收到这类邮件的朋友，一定小心，不要运行。　运行后，出现数个可疑进程，并试图修改注册表，在windows目录中生成msupdtwiz.exe等四个文件，在system32目录中生成大约六七个文件，看文件的创建日期可以确定。

邮件正文：

Mail server report.

Our firewall determined the e-mails containing worm copies are being sent from your computer.

Nowadays it happens from many computers, because this is a new virus type (Network Worms).


Using the new bug in the Windows, these viruses infect the computer unnoticeably.
After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail
addresses

Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service