This morning MessageLabs blocked a suspicious message to a recipient in our finance department.
Subject: Re:tax contract for
The message contained a Word document attachment named incomplete_contract.doc. The word doc contained a embedded exe named MicrosoftWordhasencounteredanerrorandneedstoclose.Pleasedoubleclicktheicontoreloadmsword.exe
These are probably the same people who tried last week with subject lines "Re : Tax Refund for %firstname% %lastname% with a scr attachment.
Going through my email I see a similar detection back in February Complaint Filled against
Saw this in the morning. Postini wasnt nice enough to pick it up the way message labs did.