I have repeatedly cautioned folks not to accept "updates" from non proprietary sites: MS does not send update notifications by email. Ever. It has it's own updater which, if your OS is working correctly, does the work re update notification.

On another note (though in the same spirit as the OP), http://www.infopackets.com/news/security/2011/20110314_beware_fake_google_security_tool.htm

A malware Android app masquerading as the Google Security app which actually installs malware on your Android phone. Goes by additional names as well.

No?

I wonder what that service I signed up for, years ago on Windows Update, was then - and to this day still dumps an email in my inbox whenever there are any Windows updates ready.

Well...since it's so easy to scam people these days with fake emails...the smartest thing to do is if you happen to get an email notification (I've gotten notices like this) is to just delete it and go to the actual site to check on your own and get the update that way. I never trust anything I get via email.

I don't just get then in my spam box.... some come through to my inbox because they are supposedly from contacts/people I know.

I keep getting them from my 'son-in-law'... just an email with a dodgey link on it, but it's not him because he hasn't had access to the internet, let alone his hotmail account.  Even if he had access to the net and his account, I'd still know they weren't from him because he always addresses me in a certain way and always includes text with regard to what it's about.

Obviously somebody has hacked into his account and is using it for nefarious purposes, so they get the obligatory delete button treatment