# Is this a virus? **URL:** \ **Category:** Factual Questions\ **Created:** [March 15, 2002, 12:24am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373 "2002-03-15T00:24:12Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\ **Post date:** [March 15, 2002, 12:24am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/1 "2002-03-15T00:24:12Z")
I got an e-mail, that simply said, Re: as its subject. Thinking it could possibly something a friend sent, and when I clicked on it, it asked me if I wanted to download an image, .pif. Naturally, I’m not stupid, so I declined to do so. I’m hoping this isn’t a damn virus. ---
**Author:** ![Violet](https://avatars.discourse-cdn.com/v4/letter/v/ebca7d/32.png) [@Violet](https://boards.straightdope.com/u/Violet)\ **Post date:** [March 15, 2002, 12:46am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/2 "2002-03-15T00:46:33Z")
So many attachments contain a virus or worm or? It’s good that you deleted it. Some info.: > **[Symantec Security Center](https://www.broadcom.com/support/security-center)** > > Symantec security research centers around the world provide unparalleled analysis of and protection from IT security threats that include malware, security risks, vulnerabilities, and spam. [http://www.just1ce.freeler.nl/en/index.html](http://www.just1ce.freeler.nl/en/index.html) ---
**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\ **Post date:** [March 15, 2002, 12:52am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/3 "2002-03-15T00:52:47Z")
Since I wouldn’t download it, it couldn’t do anything just by opening, right? ---
**Author:** ![mblackwell](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@mblackwell](https://boards.straightdope.com/u/mblackwell)\ **Post date:** [March 15, 2002, 1:54am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/4 "2002-03-15T01:54:02Z")
Image files cannot contain viruses. PIF can also be Program Information File, wich is something used by DOS programs in windows. I don’t see a way that type of file could be used to spread a virus. ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [March 15, 2002, 2:02am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/5 "2002-03-15T02:02:57Z")
Based on what I read in the very helpful first link provided by **Violet** , and your description of what happened, then it likely was a virus. It is impossible to tell if some scripting component has already executed or not, based on your description, but most likely not. Get your newest scanner out, and scan. ---
**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\ **Post date:** [March 15, 2002, 2:24am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/6 "2002-03-15T02:24:46Z")
Thanks. I junked the virus software awhile back when it totally screwed up my computer. _sigh_ I’ll check it. Again, I’m extremely stupid on these sorts of things. ---
**Author:** ![Lord\_Jim](https://avatars.discourse-cdn.com/v4/letter/l/ecccb3/32.png) [@Lord\_Jim](https://boards.straightdope.com/u/Lord_Jim)\ **Post date:** [March 15, 2002, 2:31am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/7 "2002-03-15T02:31:56Z")
I will almost guarantee it is a virus. For a few reasons. First, there is NO legitimate reason to send someone a PIF file. It’s a Program Information File, so without the program itself, what would be the purpose of it. Second, there are a few file types that Windows will execute as programs. The normal ones .EXE and .COM, plus .BAT which executes as if it were a list of programs. But, Windows also executes .SCR (screen savers) and .PIF (DOS type program information files). Any of these can contain executable program code. The extension simply tells Windows that it can run it. What it does is up to the information in the file. This is typical of a few viruses like W32.Magistr. They send the virus code in a file type that Windows will execute when double-clicked. Update your anti-virus program, or get one if you don’t have one. And inform the person that sent you the file that he/she has a virus. Without telling them, the virus will continue to spread. Jim ---
**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\ **Post date:** [March 15, 2002, 2:45am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/8 "2002-03-15T02:45:33Z")
I don’t know who sent it. I thought it was an advertisement. I know, I know. I allowed ignorance to win. _please administer my punishment_ ☹ ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [March 15, 2002, 3:26am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/9 "2002-03-15T03:26:53Z")
> [@](#): > > \*Originally posted by Guinastasia \* > \*\*Thanks. I junked the virus software awhile back when it totally screwed up my computer. \*\* What virus software? The Norton Suite gave me problems on a PC I built, but worked OK on the “store bought” laptop. ---
**Author:** ![Bob\_Scene](https://avatars.discourse-cdn.com/v4/letter/b/e19adc/32.png) [@Bob\_Scene](https://boards.straightdope.com/u/Bob_Scene)\ **Post date:** [March 15, 2002, 4:08am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/10 "2002-03-15T04:08:58Z")
According to my Yahoo mail virus scanning software, I have been mailed lots and lots of viruses that had the subject line “Re:” and a file with a .pif extension. It was almost certainly a virus. ---
**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\ **Post date:** [March 15, 2002, 4:45am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/11 "2002-03-15T04:45:39Z")
Yep, it was Norton. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [March 15, 2002, 9:58am UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/12 "2002-03-15T09:58:34Z")
I have had NBT (Nothing But Trouble) with antivirus software so I have gone without it for years and have never, ever, had a virus infection and I am quite certain I will not get infected in the future. The most important prvention tool is between keyboard and chair. If only _you_ use the computer you can be the most effective antivirus. This is what I do: - The immediately obvious: Do NOT open anything you are not certain about. In the rare event that I need to scan some file for virus I emeil it to myself at Hotmail who scans every file - In Outlook Express set the Security internet zone to “restricted” and configure “restricted” to not run any scripts. Remember that OE is just part of IE. - Configure your network settings to remove all unneeded bindings as explained in [http://grc.com/default.htm](http://grc.com/default.htm) - After 4 years without a problem I have just recently decided to add another layer of safety and installed Zonealarm. I doubt anything can get past those simple measures. I have friends who use antivirus and their computers are full of virus. A bit of knowledge is better than the best tools and no knowledge. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [March 15, 2002, 1:48pm UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/13 "2002-03-15T13:48:13Z")
> [@](#): > > \*Originally posted by sailor \* > \*\* > I doubt anything can get past those simple measures. \*\* Young people in a dorm with a T1, AOL and a virus labeled “Britney Spears Naked”. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [March 15, 2002, 1:51pm UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/14 "2002-03-15T13:51:30Z")
> [@](#): > > \*Originally posted by Guinastasia \* > \*\*Yep, it was Norton. \*\* It was the rest of the suite that I had problems with; Disk Dcotor, Reg Thingie and Something Else. Crashed regularly. They had a virus update out a day before McAfee though, so you pay your money and take your chances. ---
**Author:** ![CurtC](https://avatars.discourse-cdn.com/v4/letter/c/ce73a5/32.png) [@CurtC](https://boards.straightdope.com/u/CurtC)\ **Post date:** [March 15, 2002, 2:54pm UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/15 "2002-03-15T14:54:26Z")
The reason that there was confusion in your mail reader about whether it was an image or an executable is that Internet Explorer (and therefore Outlook Express) had a bug which was exploited by these e-mails. The e-mail standard, since the dawn MIME, was for a program to depend on the “content-type” header to decide what to do with an attachment. However, Microsoft came in with no regard for existing standards and decided that _their_ programs would look at the file’s name extension instead. So this attachment was an executable program, but had a MIME content-type header of “image”. This then allowed IE and OE to run the attachments without warning you that it was a program. This bug has been corrected in the last nine months or so, and there is an update available from Microsoft. Better yet, use a non-MS mail program and you’ll avoid many of these worms (other programs have bugs, too, but nogoodniks usually target MS clients, plus MS is pretty casual about security risks). It also helps to have Windows _not_ suppress showing you the file extensions for known file types (which you can set in the options menu of Windows Explorer). Most computer security threats for the past couple of years have been of this type, which is a worm, not a virus, and they tend to spread like wildfire for a few days when they’re released. For this reason, anti-virus software isn’t effective because when you get these e-mails, the worm might be only a few hours old. ---
**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\ **Post date:** [March 15, 2002, 4:06pm UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/16 "2002-03-15T16:06:58Z")
How about Netscape Messenger? Is that any better? ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [March 15, 2002, 4:23pm UTC](https://boards.straightdope.com/t/is-this-a-virus/98373/17 "2002-03-15T16:23:40Z")
Yes, apparently most viruses exploit Outlook.