As Tom notes below, malicious e-mails containing a worm or other virus may appear to be legitimate.

Microsoft does not include (executable) attachments to e-mails.

Here's how to verify that a Microsoft security-related message you receive is legitimate:

The message contains no attachments. Authentic Microsoft Security Bulletin notifications never include software updates as attachments. Rather, we refer customers to the complete version of the bulletin on our website, which provides a link to the update. Most Microsoft software updates are made through Microsoft® Windows® Update, Microsoft Office Update, or the Microsoft Download Center.

more from MS on spotting bogus, but authentic-looking, virus-laden e-mails.

The best advice is to avoid opening any executable email attachment, and to be extremely wary of and cautious with any attachment.

S