Philip, Your email on Mon, 7 Oct 2002 14:37:24 +0530 (IST) with message id 20021007090724.249F65F446@mmb5.vsnl.net.in had a stock-obc.xls.pif file attached to it!!! Do you know anything about it?
!
On Thu, 10 Oct 2002, q u a s i wrote:
Philip, Your email on Mon, 7 Oct 2002 14:37:24 +0530 (IST) with message id 20021007090724.249F65F446@mmb5.vsnl.net.in had a stock-obc.xls.pif file attached to it!!! Do you know anything about it?
Are you sure it came from me? There is a worm around that sends mails to people after changing the From address. Send me the full headers.
It's unlikely that the message came from me since... - I don't have windows - I use only pine - which has no scripting ability - I have never (in my life) sent a .xls or a .pif file via email
That attachment is a virus. As a rule, avoid opening any file that has a .pif extension when attached with an email. I have had them coming from various sources in the past.
Generally, it is a virus that is spoofing someone's id. It probably came from someone else who has Philip's email id in the address box. In a previous case which we had investigated (out of curiosity), the virus had actually picked up email ids from saved messages, saved html pages and even text files and word files saved on the hdd of the infected pc.
Of course, if you dont use ms-windows, I dont think you get affected.
Regards Saswata
----- Original Message ----- From: "q u a s i" quasar@vsnl.net To: linuxers@mm.ilug-bom.org.in Sent: Thursday, October 10, 2002 11:21 AM Subject: IMP -- RE:[ILUG-BOM] Not so Random
Philip, Your email on Mon, 7 Oct 2002 14:37:24 +0530 (IST) with message id 20021007090724.249F65F446@mmb5.vsnl.net.in had a stock-obc.xls.pif file attached to it!!! Do you know anything about it?
!
At 03:12 even 10/10/02 +0530, SSB wrote:
That attachment is a virus. As a rule, avoid opening any file that has a .pif extension when attached with an email.
thank your for that hint. I will add that to my err... multicolored book of heuristics.
Generally, it is a virus that is spoofing someone's id. It probably came from someone else who has Philip's email id in the address box.
no. I would not have bothered the LUG for such a trivial thing. The email I received also has a message by PT in reply to yours. But it did not come via the LUG. I wrote here that others, if they too got it, may be aware.
Of course, if you dont use ms-windows, I dont think you get affected.
I do use M$-Windows also. One still need not be affected.
quasi
-
Philip S Tellis -
q u a s i -
Saswata Banerjee & Associates