Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'Try this instead' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Try this instead
Authored by: whatev on Aug 20, '03 03:28:38PM

I think this rule is useful but perhaps too overarching.

Instead, look for attachments which end in .pif or .scr - since these are Windows-specific and CANNOT work on Macs, AND since they are much more likely to be viruses anyway, they're probably safe to delete. (Unless you're a Windows developer reading mail on a Mac...I know, riiiight.)

For the curious: .pif are DOS commands, and .scr are scripts.



[ Reply to This | # ]
Try this instead
Authored by: filburt1 on Aug 20, '03 07:00:43PM

.scr files are screen savers, not scripts. Screen savers in Windows are really normal programs with a different extension and that take different command-line arguments.



[ Reply to This | # ]
Try this instead
Authored by: mprewitt on Aug 22, '03 09:25:34AM

Indeed the viruses do come with .scr (screen saver) and .pif (program information file) extensions. It just so happens that both of these are common containers for viruses -- they are both executible, although I am not sure how the .pif one works, since it usually redirects to a DOS program. But unquestionably they are both very common in virus messages, not just the current SoBig variety.



[ Reply to This | # ]
Try this instead
Authored by: GaelicWizard on Aug 21, '03 02:03:25AM

and .pif files are "program information files" they contain information about dos commands (and can contain scripts, afaik) but are not actually dos commands...

---
Pell



[ Reply to This | # ]
Try this instead
Authored by: mprewitt on Aug 22, '03 09:26:43AM

Ditto to what I said to the previous post in the thread.



[ Reply to This | # ]
Try this instead
Authored by: JHromadka on Aug 21, '03 10:22:39AM

How do you do this in mail? I can't figure out how to tell it to mark messages with a particular attachment (i.e. .PIF) as Junk and delete it.



[ Reply to This | # ]