Strange letter from my ISP! infected attachment

[Michael Hobbs]

Got an email from my ISP this evening. The subject was: Email account
disabling warning
Dear user of qwest.net
Our antivirus software has detected a large ammount of viruses outgoing from
your email account, you may use our free anti-virus tool to clean up your
computer software.
Further details can be obtained from attached file
Have a good day, the qwest.net team.

NAV detected the W32.beagle.A virus attached to this email, apparently in a
..pif file.

I wouldn't have clicked on the attached file anyway, not these days. But has
anybody seen this type of email before.
Norton said it was an infected file. I am concerned because it really did
look very convincing.

I did not realize that .pif files were at all dangerous.

 

[Alastair Smeaton]

I did not realize that .pif files were at all dangerous.

pif. exe, scr, and many many others - basic look at one of the big av
sites should help - sorry - don't have a url to hand

 

[DH]

I also rec'd a message from my 'IP' saying essentially the same. My
up-to-date virus program (EZ Virus) did not label it as a virus. I've
sent them the zip file. I assume EZ could not 'view' the file if it were
not opened and it needed a password to open it --- very clever.

I took a look at the routing of the message and it came from a friend in
the US while it 'looks' like it came from my IP. Clever. I'm glad I came
across this first and not my wife who tends to be very trusting.

 

[Arne Anka]

I alt.comp.anti-virus, sa Michael Hobbs utan att tänka först:

Got an email from my ISP this evening. The subject was: Email account
disabling warning

I get some from YahooGroups...

Dear user, the management of Yahoogroups.com mailing system wants to
let you know that,

Our antivirus software has detected a large ammount of viruses
outgoing from your email account, you may use our free anti-virus
tool to clean up your computer software.

Advanced details can be found in attached file.

For security purposes the attached file is password protected.
Password is "87855".

The Management,
The Yahoogroups.com team http://www.yahoogroups.com


But since they are text-only groups, the attached file/virus is removed.

--
Arne Anka

Men det värsta är inte själva baksmällan,
den verkliga pärsen börjar när gårdagens
oundvikliga sanningar börjar rullas upp för en...

<http://starcruiser.dk/arne/>

 

[mrp]

Got an email from my ISP this evening. The subject was: Email account
disabling warning
Dear user of qwest.net
Our antivirus software has detected a large ammount of viruses outgoing from
your email account, you may use our free anti-virus tool to clean up your
computer software.
Further details can be obtained from attached file
Have a good day, the qwest.net team.

NAV detected the W32.beagle.A virus attached to this email, apparently in a
.pif file.

I wouldn't have clicked on the attached file anyway, not these days. But has
anybody seen this type of email before.
Norton said it was an infected file. I am concerned because it really did
look very convincing.

I did not realize that .pif files were at all dangerous.

Taked from filext.com...

<quote>
A Program Information File dates back to the early versions of
Windows. Basically, it's an information file that when you click on it
the information in the file is used by Windows to run some program;
including code that can be in the PIF file. It is a potentially
dangerous file type and one should never click on one received via
E-mail without extensive knowledge of exactly what it will do first.
</quote>

http://filext.com/detaillist.php?extdetail=pif&Submit3=Go!

 

[Gabriele Neukam]

On that special day, Michael Hobbs, ([email protected]) said...

Dear user of qwest.net
Our antivirus software has detected a large ammount of viruses outgoing from
your email account, you may use our free anti-virus tool to clean up your
computer software.
Further details can be obtained from attached file
Have a good day, the qwest.net team.

I got a similar one, with qwest being replaced by t-online.com, and the
text was the last one given on the site below. It came from Korea. Go
figure.

http://www.viruslist.com/eng/alert.html?id=1081172


Gabriele Neukam

(e-mail address removed)