伪装的病毒程序 会伪装成邮件服务器发送的报告，谎称检测到用户所使用的IP发送大量垃圾邮件，需要安装防火墙及补丁才能处理。诱骗用户点击邮件附件 安装假冒的KB补丁。
一般他们会这样的形式
Do not reply to this message
Dear Customer,
Our robot has fixed an abnormal activity from your IP address on sending e-mails.
Probably it is connected with the last epidemic of a worm which does not have patches at the moment.
We recommend you to install a firewall module and it will stop e-mail sending. Otherwise your account will be blocked until you do not eliminate
malfunction.
Customer support center robot
Dear Customer,
Our robot has fixed an abnormal activity from your IP address on sending e-mails.
Probably it is connected with the last epidemic of a worm which does not have patches at the moment.
We recommend you to install a firewall module and it will stop e-mail sending. Otherwise your account will be blocked until you do not eliminate
malfunction.
Customer support center robot
附件名通常为 Update-KB390-x86.zip 类似的格式
大家请注意 千万不要上当受骗。
卡巴斯基检测到以下信息
安全起点提醒大家，尽快升级您的卡巴杀毒软件，开启邮件保护 以免中毒。
关于此病毒的信息[中文]
关于此病毒的信息[English]
已删除: 病毒 Email-Worm.Win32.Warezov.nf 文件: C:\Documents and Settings\new\桌面\Update-KB390-x86.zip\Update-KB390-x86.exe
