ORPWebmail and your Safety.

[Cadogan Trahem]

It seems some evil person/s are spaming the administrators with suspicious emails with even more suspicious attachments. The files are always 17.02kb and they always carry the .pif extension. Twice now we've recieved the email and twice now its come from a @Yahoo email address (though its quite possible both were different as it is a free-webmail service).

The email is usually titled something like "My Details" or "Your Product" and the attached file is equally flagged as such with the short and to the point message indicating that the attached file holds all the answers. Though we do not know the nature of the file itself, or the reasons behind someone sending them a though did cross our mind that quite possibly someone was targeting ORP's Webmail specifically and as such we've deliberated to deliver this stern warning to ORPUsers who make frequent use of the Webmail service to be extra cautious of strange or unexpected mail, if at all you believe your computer's security could be compromised please bounce the email and delete it without looking at the attached files. <More>

[Cadogan Trahem]

To bounce an email simply open it and click on the Bounce Message option, this sends an automatice message to the sender resulting in something of a mail-daemon error message stating that the mail could not be delivered because the email address does not exist. This will not effect future emails you recieve but quite possibly fool whoever sent you that particular email into believing that your addy is a dead end.

As always we would like to know if anyone else has experienced something similar to this to enable the administration to draw a coherent conclusion on the subject matter. Thanks for your time.

Cadogan.

Now for your amusement the log of the chat which eventuated in this post:

LeeCHeSSS says:
delete that email, it is again, spam

Cadogan - Keywords: Chosen, Hopeless, Nothingness. says:

same person?

LeeCHeSSS says:

dunno

Cadogan - Keywords: Chosen, Hopeless, Nothingness. says:

same file?

LeeCHeSSS says:

dunno

LeeCHeSSS says:

I just bounce and delete it (you don't need to bounce it, cos that'd look odd (bouncing twice)

Cadogan - Keywords: Chosen, Hopeless, Nothingness. says:

I bounce email all the time

Cadogan - Keywords: Chosen, Hopeless, Nothingness. says:

mostly stuff from people wanting to advertise the site

Cadogan - Keywords: Chosen, Hopeless, Nothingness. says:

yep same file

Cadogan - Keywords: Chosen, Hopeless, Nothingness. says:

17.02 kb

Cadogan - Keywords: Chosen, Hopeless, Nothingness. says:

.pif

Cadogan - Keywords: Chosen, Hopeless, Nothingness. says:

maybe we should make a post about it

LeeCHeSSS says:

?

Cadogan - Keywords: Chosen, Hopeless, Nothingness. says:

could be that they're targeting ORP webmail specifically

LeeCHeSSS says:

You mean, warn others to bounce it and delete it?

LeeCHeSSS says:

That's a good idea

LeeCHeSSS says:

you do that!

[Epengar]

As always we would like to know if anyone else has experienced something similar to this to enable the administration to draw a coherent conclusion on the subject matter. Thanks for your time.

Cadogan.


This just sounds like ordinary virusmail to me. Many of the currently circulating Windows viruses send copies of themselves to all the addresses they can find on their infected system and forge the "From:" field on the infected messages by pasting in one of the other addresses they find on that system. I doubt anyone is "targeting" you, it's just that someone you have corresponded with has an infected system, or (just as likely), your correspondent has in turn corresponded with someone whose system is infected.

There's not much you can do except delete the messages without reading opening the attachment, and making sure you and everyone you have influence over is running updated anti-virus software and cleans their systems.

You can find more virus information here:

http://www.itd.umich.edu/virusbusters/
and here:
http://www.networkassociates.com/us/security/home.asp

[TheDruid20]

Yeah well there are more tech geeks then are needed around here, you can be sure we are well briefed in viri, I wouldn't be surprised if we have some who write them around here ::cough cough ITCHES::