Microsoft and other vendors do not issue security updates using email messages, even though this new spoofed version appears to be realistic.

Microsoft Security Updates - Spoofing Attack
http://www.f-secure.com/weblog/archives/archive-072006.html#00000926

Copy of EMAIL message - HTML coding looks realistic
http://www.f-secure.com/weblog/archives/chto.gif

QUOTE: We've received several reports of a mass mailing that's going around. The messages have been spoofed to look like they are from Microsoft and arrive with title "Warning! New Virus On The Internet! Update Now!".  The link in the mail goes to <<<URL REMOVED>>> and downloads an IRC backdoor.  The downloaded file is detected as W32/FakeMSUpdate by our latest update