K J Watking & Co Remittance Advice – excel malware — 29 Comments

  1. I received an email exactly like the one mentioned, suspicious, as I usually sm and always look up company’s/peoples names to see if its scam or real
    Thank you for posting your information

  2. Many thanks for your original advice.

    My wife received a similar email dated 5 December 2014. We were suspicious of it straightaway and found your website after searching on Google for “K J Watkings”.

    I have deleted the email and done security checks with MS Security Essentials and Malwarebytes Anti-Malware. Both came up clear.

    But one question: I single clicked on the bogus Excel file and Outlook tried to preview it and said the file couldn’t be previewed as it was corrupted. Do you know if this will have effectively opened the file and released the malware?



    • What version of Microsoft office do you have on your computer. If the preview said it was corrupted, then it is very likely that you do not have the outlook preview function enabled so should be safe.
      Just keep an eye on it and continue to do daily scans with MSE and MBAM and they will find anything wrong. MBAM should detect both the macro in this document and any downloaded malware. Make sure it is fully updated before running the scans

      • Hi,

        We’re using Office 2013. Thanks again for the advice. I’ll keep doing scans. I read on some other sites that you have to run the macros in the spreadsheet to get infected. Let’s hope that’s true.

        Many thanks


  3. Hi,

    I received the K J Watking email today and opened the excel attachment on my Blackberry. The spreadsheet appeared to be completely blank, at which point I realised it was probably a virus and closed it. Will this have infected my Blackberry, and if so, what are the implications?

    I don’t use my phone to do any internet banking or purchasing via PayPal etc.



    • It should not have affected your blackberry. As far as I know Blackberries, Android and Windows phones can only open plain Excel files or word docs. They cannot run macros that re embedded inside the files.

      All of those mobile phones use a cut down basic version of Office to view and do very basic editing or creation of Office documents

  4. i got this email today. stupdily i opened the attachment and then casue it was blank i enabled editing. what do i do now cause i dont want my computer going wrong or being hacked?

  5. Hi

    Thanks for this info, do you know if it will infect an imac. Opened it on imac blank excel file came up and quickly shut and deleted it. Not sure if I need to do anything now?

    Many thanks


  6. Hi
    Have just received an K J Watking email and unfortunately opened the attachment, however I did this on my Apple Mac via
    forwarding via Outlook, would the apple system protect me? or would my Windows systems be corrupted?
    If I delete all the emails on windows will that be enough?



  7. I have received one of these emails today, no attachment though!! opened the email & read it, then deleted. I hope that means i’m safe as opened it on my ipad.

  8. At this time, these only affect windows computers. They do not affect a Mac, IPhone, Blackberry, Windows phone or Android phone.
    The malicious excel file can open on any system, and potentially the macro will run on windows or mac BUT the downloaded malware that the macro tries to download is windows specific, so will not harm or infect any other computer except a windows computer.

  9. Yes like all of you -I have just received the email ! Should this case be passed on to the police or a similar authority as I`m sure as there is criminal & theft intent it should be
    Any one like to comment ?

  10. I have received an email via my hotmail account today saying a remittance advice from Sherrie Gamble of K J Watking & Co tel 01469 792004 which does not exist as tried to ring the numbe my amount was for £376 will infirm my bank

  11. This is the second I have received. Today’s 23.12.14 is headed
    Remittance Advice -VHSN35

    From an email address hudson45 in finland.
    I am expecting remittance advices from Finland which is what is so frustrating about getting all these – they are so very like the real things I receive every day.

  12. Just had very similar email…


    Attached are the tickets you have requested

    Kinds Regards kath

    Milestone Holdings

    Tel: 01676 541133
    Mob: 07976 440015

  13. I clicked the link on my iPhone and it opened blank page with 3 tabs with strange writing at the top of them is it possible this will now be able to infect iPhones?

Leave a Reply

Your email address will not be published. Required fields are marked *