AW Linked Virus

[vegita1220]

I've gotten quite a few emails from total strangers today, most carrying some sort of military identifier, and one civilian address I've DEFINITELY seen on AW as someone's username. They all have a .pif attachment file reading something like "your attachment" or "your file", etc. I'm sure most ppl know better than to open those but since some of them could be from someone you know at AW I'm putting out this warning just in case.

 

[webmaster]

I've gotten quite a few emails from total strangers today, most carrying some sort of military identifier, and one civilian address I've DEFINITELY seen on AW as someone's username. They all have a .pif attachment file reading something like "your attachment" or "your file", etc. I'm sure most ppl know better than to open those but since some of them could be from someone you know at AW I'm putting out this warning just in case.

This definintely concerns me, I have double checked my settings on the new forum, and reconfirmed that everyone's email addresses aren't publicly viewable. The only feature that is turned on is the ability to email someone THROUGH the forum itself, without giving out the recipients email address. (you can opt of that in your control panel options) How were you recieving those emails? Any more details would be appreciated.

John

 

[JKD]

also keep in mind that most viruses "spoof" the From: email addresses.
Viruses use the address book on the infected computer for the To: addresses of the emails. They also use a different address from the address book for the From: address. This makes it harder to track where the virus came from.

This is why people sometimes receive a "virus found" message from someone they never sent the message. The virus used their email as a From: address.

The recent variants are not using the whole address for the From: address, but only use the domain name and generates a random name for the domain.

(clear as mud?)

 

[stevew]

I can confirm what JKD is saying. I currently work for an ISP and out mail servers are being flooded with these viruses. Part of the virus is that it sends you a small mail server app so it can spoof any address it wants to.

 

[vegita1220]

Well I've listed my commercial email address as my email on this site and got a few through there. I also got a few through my school email; this could be from other NROTC mids or people I've sent things in the past, not necessarily AW.
I think the problem is if you've already had correspondence with a person on this site they may put your email into their private address book. And if it's someone you know from this site you might be more likely to open the mystery file.

Also the things JKD and stevew said sound good although I have no idea what they mean.