# jpg.vbs **URL:** \ **Category:** Factual Questions\ **Created:** [August 21, 2001, 5:18pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369 "2001-08-21T17:18:08Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [August 21, 2001, 5:18pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/1 "2001-08-21T17:18:08Z")
Is that a legitimate file name for Printshop, or is it Lovebug? McAfee says it’s ok. ---
**Author:** ![Wonko\_The\_Sane](https://avatars.discourse-cdn.com/v4/letter/w/258eb7/32.png) [@Wonko\_The\_Sane](https://boards.straightdope.com/u/Wonko_The_Sane)\ **Post date:** [August 21, 2001, 5:22pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/2 "2001-08-21T17:22:37Z")
It’s a .vbs file. I would not open it. Probably from someone you know, in an email I suspect. Upgrade your virus scanning software, and rescan it. Let us know what happens. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [August 21, 2001, 5:24pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/3 "2001-08-21T17:24:43Z")
It’s a virus. There’s no legitimate reason to use a double extension on a Windows computer. ---
**Author:** ![evilhanz](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@evilhanz](https://boards.straightdope.com/u/evilhanz)\ **Post date:** [August 21, 2001, 5:25pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/4 "2001-08-21T17:25:30Z")
No, it is not legitimate. Just because it has “jpg” in the file name, doesn’t mean it’s an image. The important characters occur in the extension. These days, “vbs” might as well be the generic file extension for script virus. Delete the file. Also, just because McAfee doesnt recognize the file as a virus, doesn’t mean it’s clean either. They’re always playing a game of catch-up. Update your virus definitions while you’re thinking about this stuff. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [August 21, 2001, 5:25pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/5 "2001-08-21T17:25:52Z")
There’s a bunch in the printshop install directory, filename.jpg.vbs. We update McAfee daily. This is goofy. ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [August 21, 2001, 5:26pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/6 "2001-08-21T17:26:22Z")
I concurr with the above. It is a virus. Delete it. ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [August 21, 2001, 5:27pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/7 "2001-08-21T17:27:38Z")
Or, if you want, e-mail one to me and I will confirm if it is a virus or not personally by editing it. [una\_persson@hotmail.com](mailto:una_persson@hotmail.com) ---
**Author:** ![NotMrKnowItAll](https://avatars.discourse-cdn.com/v4/letter/n/6bbea6/32.png) [@NotMrKnowItAll](https://boards.straightdope.com/u/NotMrKnowItAll)\ **Post date:** [August 21, 2001, 5:28pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/8 "2001-08-21T17:28:00Z")
FYI It’s best to think that vbs stands for “virus bearing software.” I originally wrote something that included the words “bum,” “violent,” and one other. ---
**Author:** ![Syzygy](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@Syzygy](https://boards.straightdope.com/u/Syzygy)\ **Post date:** [August 21, 2001, 5:29pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/9 "2001-08-21T17:29:41Z")
I read on the Norton site that double file extensions can be an indicator of the Sircam worm. ---
**Author:** ![evilhanz](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@evilhanz](https://boards.straightdope.com/u/evilhanz)\ **Post date:** [August 21, 2001, 5:35pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/10 "2001-08-21T17:35:26Z")
> [@](#): > > \*Originally posted by Scott \* > \*\*I read on the Norton site that double file extensions can be an indicator of the Sircam worm. \*\* Actually, a characteristic of the W32.Sircam worm is a “pif”,“bat”, or “com” extension. A “jpg.vbs” extension qualifies it as a more generic virus like Anna Kournikova. ---
**Author:** ![NotMrKnowItAll](https://avatars.discourse-cdn.com/v4/letter/n/6bbea6/32.png) [@NotMrKnowItAll](https://boards.straightdope.com/u/NotMrKnowItAll)\ **Post date:** [August 21, 2001, 5:38pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/11 "2001-08-21T17:38:04Z")
Please email me a copy as well at [persiphonus@yahoo.com](mailto:persiphonus@yahoo.com) That’s my virus email addy ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [August 21, 2001, 5:51pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/12 "2001-08-21T17:51:27Z")
I have to send from my work account, [asd.k12.ar.us](http://asd.k12.ar.us). Thanks ---
**Author:** ![slortar](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@slortar](https://boards.straightdope.com/u/slortar)\ **Post date:** [August 21, 2001, 5:59pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/13 "2001-08-21T17:59:26Z")
McAfee is absolutely worthless as a virus scanner. Trust me. Get Norton or Innoculate. ---
**Author:** ![NotMrKnowItAll](https://avatars.discourse-cdn.com/v4/letter/n/6bbea6/32.png) [@NotMrKnowItAll](https://boards.straightdope.com/u/NotMrKnowItAll)\ **Post date:** [August 21, 2001, 6:10pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/14 "2001-08-21T18:10:11Z")
Norton is ok with this as well. It a jpg(Photoshop 3.0 8 bit image) of a pretty (IMHO)female chef sauteing some squash, tomatoes and zuchinni. I didn’t see anything when I dumped the file. Do you know a female chef with the initials VBS? I’ll wait for Antracite’s opine of course. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [August 21, 2001, 6:21pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/15 "2001-08-21T18:21:10Z")
It makes files from exisitingfilename.jpg to existingfilename.vbs.jpg, like Lovebug. Hmmm. I deleted them all and these were created. Our McAfee license expires in December and we’ll go for Norton. CP ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [August 21, 2001, 6:42pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/16 "2001-08-21T18:42:18Z")
I retract my off-the cuff statement earlier. I do not know that there is anything odd with this file, other than the very dangerous-sounding name. It appears to be just what it says - a jpg. I am not 100% confident, as Hotmail will not let me dump it directly like I want, and I can’t forward it to any other mail account I have, as they all strip it out due to the “vbs” extention. So, I was likely wrong in my snap judgement. But I am not 100% certain what the deal is. ---
**Author:** ![xash](https://avatars.discourse-cdn.com/v4/letter/x/c6cbf5/32.png) [@xash](https://boards.straightdope.com/u/xash)\ **Post date:** [August 21, 2001, 8:01pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/17 "2001-08-21T20:01:58Z")
.vbs stands for Visual Basic Script. basically it could be a malicious script, and possibly is, because it’s trying to trick you into believing it’s a .jpg image instead. a .jpg is non-executable whereas a .vbs can and does execute some code on your computer and could be potentially dangerous. ---
**Author:** ![Una\_Persson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/una_persson/32/346_2.png) [@Una\_Persson](https://boards.straightdope.com/u/Una_Persson)\ **Post date:** [August 21, 2001, 8:09pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/18 "2001-08-21T20:09:43Z")
We understand that, **xash**. The problem is that the file appears to actually be a jpeg, and not a script. But like I said, Hotmail’s stupid-ass new attachment “feature” absolutely refuses to let me dump the file as-is to disk to confirm. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [August 21, 2001, 8:24pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/19 "2001-08-21T20:24:35Z")
> [@](#): > > \*Originally posted by Anthracite \* > \*\*dump the file as-is to disk to confirm. \*\* What’s involved in that? Editing shows ASCCI code, not a script file. ---
**Author:** ![evilhanz](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@evilhanz](https://boards.straightdope.com/u/evilhanz)\ **Post date:** [August 21, 2001, 8:28pm UTC](https://boards.straightdope.com/t/jpg-vbs/77369/20 "2001-08-21T20:28:35Z")
I would appreciate it if someone could send me a copy of this file so I can perform my own autopsy. hmmm… let’s use: faramir at mediaone dot net. [Next page](https://boards.straightdope.com/t/jpg-vbs/77369.md?page=2)