VIRUS ALERT

[Blade]

Just recieved this email from "support@microsoft.com" subject "Screensaver". The body reads "All information is in the attached file." The attached file is named "approved.pif" at 53.6kb. Don't know about you guys but Microsoft doesn't send mail this way, and there is no hint of whats inside. My thinking is

[WebbPA]

I just got this in my mail this morning.  It looks awfully suspicious.  Safer is better - going back to delete it now.

[Craig.]

thanks for the heads up
i'll make sure to keep an eye out for it.
on a side note dont your mail programs have virus checkers? i know both MSN and Yahoo have them i dont know about others though

[Maccers]

In 99.9% of cases, its common sence that detects the viruses in your inbox.
I've never had an e-mail that was a virus and didn't know about before checking with Mcafee.

[Craig.]

well just recieved this one myself through yahoo, and used their virus scanner to check it and it is definatly a virus

[BFMF]

Just got an email supposedly from 'Support@microsoft.com' subject 'Re:Movie'.

interestingly enough, Norton did not pick it up. I probably better update it.

Anyhow, microsoft support never sends an e-mail to you with an attachment, let alone an e-mail without a tracking number.

flipin' morons....

[katana_1000]

thnx 4 telling me.havent gotten that email yet but ill keep a look out.

[SilverFox441]

I've got at least 7 versions of this so far...and they have all been deleted.

[RollerBall]

As I tell my support clients endlessly.

If you receive ANY email with an attachment that is one of the following file types it is an active program and should be DELETED IMMEDIATELY as it is almost certainly a virus.

.scr
.pif
.exe
.bat

The way these thing work is they plonk the prog somewhere in your Windows\System folder and place a 'Run' or 'RunOnce' entry in your registry.

Nothing happens immediately but when you reboot, the prog runs and the damage starts.

.scr is the file type for a screen saver -

[BFMF]

I just got 4 more e-mails!

The subject's were: "Re: My details", "Re: My application", "Your details", "Re: Approved (Ref: 3394-65467)"

I guess that proves my 'tracking number' theory wrong, even though what I got was obviously a fake one.

Even though this has been around for a while, something is causing it to be distributed more all of a sudden

[BFMF]

I just scanned one of the e-mails and the virus is 'W32.Sobig.B@mm'.

"W32.Sobig.B@mm is a mass-mailing worm that sends itself to all the email addresses that it finds in the files with different extensions"

You can read about it here: http://securityresponse.symantec.com/av ... .b@mm.html

[Blade]

My McAffee didn't pick it up either when I recieved it, but then I scaned it directly and it picked it up.

[pete]

I'm getting dozens of them daily - but all picked up on the mail server by norton.

'.de' is Germany - not Denmark & yes MS have a lot of German based support services - like they do in most countries so that wouldn't be unusual.

The main thing as always - get a good anti virus! If you are running one & it's updated & doesn't pick this virus up - scrap it ! You've been had.

[Ivan]

That's the price you pay for having a publicised e-mail adress...

and even if it isn't public, most family computers only get a virus scanner when at least one infection has had sevre results, leading to widespread havoc with every remailing virus

[Paul2k12]

Thanks Everybody


I just had a look in my inbox and I had an e-mail from them with "my password"

Deleted it and just to say thanks for letting me know before hand!!

Paul2k10