# Ugh... A virus email that managed to confuse me... **URL:** \ **Category:** The BBQ Pit\ **Created:** [March 4, 2004, 2:36pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509 "2004-03-04T14:36:12Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Windwalker](https://avatars.discourse-cdn.com/v4/letter/w/5e9695/32.png) [@Windwalker](https://boards.straightdope.com/u/Windwalker)\ **Post date:** [March 4, 2004, 2:36pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/1 "2004-03-04T14:36:12Z")
Color me the purple-headed fool. I almost started panicking when I read this: > [@](#): > > Dear user of “[Yahoo.com](http://Yahoo.com)” mailing system, > > Our antivirus software has detected a large ammount of viruses outgoing > from your email account, you may use our free anti-virus tool to clean up > your computer software. > > Advanced details can be found in attached file. > > For security purposes the attached file is password protected. Password > is “67148”. > > Sincerely, > The [Yahoo.com](http://Yahoo.com) team > [http://www.yahoo.com](http://www.yahoo.com) Took me about 10 whole seconds to realize that yahoo mail is a web-based service, which means that any sort of virus from my comp would not be able to have direct access to it (as opposed to an email client program like Outlook or Eudora), and that installing software to get rid of stuff on my computer would not have any effect on the Yahoo server where my account resides. Now I never had any intention of actually opening the attachment, but I was legitimately concerned for those 10 seconds. I must be getting dumber. I bet those bastiches will find some hits with this attempt, though. ---
**Author:** ![Windwalker](https://avatars.discourse-cdn.com/v4/letter/w/5e9695/32.png) [@Windwalker](https://boards.straightdope.com/u/Windwalker)\ **Post date:** [March 4, 2004, 2:42pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/2 "2004-03-04T14:42:54Z")
Oh, and I forgot to mention that it was from “[support@yahoo.com](mailto:support@yahoo.com)”, which is about ten thousand times more convincing than the typical “[Alicia@hotchicks.cum.org](mailto:Alicia@hotchicks.cum.org)”. I know the From line email address can be fudged quite easily, but they sure got me, yer darn tootin’! Blargh! ---
**Author:** ![Slacker](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@Slacker](https://boards.straightdope.com/u/Slacker)\ **Post date:** [March 4, 2004, 2:51pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/3 "2004-03-04T14:51:09Z")
Yeah we’ve been seeing that one pop up around the office. Fortunately, our virus scanner catches it as soon as you put the password it to unzip it. They’re getting pretty clever - I’ll give 'em that. 😃 ---
**Author:** ![whiterabbit](https://avatars.discourse-cdn.com/v4/letter/w/cab0a1/32.png) [@whiterabbit](https://boards.straightdope.com/u/whiterabbit)\ **Post date:** [March 4, 2004, 3:18pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/4 "2004-03-04T15:18:35Z")
I’ve gotten this one supposedly from Cox twice now. This one must adapt itself depending on the email address in question. ---
**Author:** ![Homebrew](https://avatars.discourse-cdn.com/v4/letter/h/c89c15/32.png) [@Homebrew](https://boards.straightdope.com/u/Homebrew)\ **Post date:** [March 4, 2004, 3:24pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/5 "2004-03-04T15:24:26Z")
Our IT deptartment sent an email this morning warning everyone about that one. It apparently spoofs whatever mail server you’re using to fomulate the “from” line to look convincing. ---
**Author:** ![Eats\_Crayons](https://avatars.discourse-cdn.com/v4/letter/e/278dde/32.png) [@Eats\_Crayons](https://boards.straightdope.com/u/Eats_Crayons)\ **Post date:** [March 4, 2004, 3:33pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/6 "2004-03-04T15:33:23Z")
I… HAAAAAATE that virus! Our company is entirely Mac-based, so most of these worms don’t affect/infect us. However, it pisses us off nontheless. We use non-conventional usernames to cut down on general spam (so trying to send spam to “[sales@ourdomain.com](mailto:sales@ourdomain.com)” will just get you added to our spam filters.) Any e-mail coming from Management, Staff, Admin or any traditional username is laughably suspicious. As soon as a message from “[staff@ourdomain.com](mailto:staff@ourdomain.com)” showed up, everyone knew it was pure shit. It was the Bagle virus/worm/whatever that said “due to e-mail misuse, the account would be terminated, blah, blah, blah”. Yeah, right. As if. Our office is so small that if anyone abused their e-mail use, I’d just reach over and smack 'em. Everyone was indignant though because everyone thought this was a particularly scuzzy virus and were outraged on behalf of all those who could be duped. We’re putting together a voo-doo doll. We are cursing the script-kiddie that put this shit together… Every time an inbox anywhere in the world receives this shit, the virus-author will be stung by a bee. ---
**Author:** ![Jenaroph](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@Jenaroph](https://boards.straightdope.com/u/Jenaroph)\ **Post date:** [March 4, 2004, 3:35pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/7 "2004-03-04T15:35:45Z")
They misspell “ammount” and it’s clever and convincing? ---
**Author:** ![Aslan\_of\_Narnia](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@Aslan\_of\_Narnia](https://boards.straightdope.com/u/Aslan_of_Narnia)\ **Post date:** [March 4, 2004, 3:38pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/8 "2004-03-04T15:38:09Z")
Now I’m going to have to worry that my mother will open this because the ‘adress was official’ or something like that. All her emails come from her friends sending her those ‘fwd. fwd. fwd.’ glurge crap, and she opens ALL her attachments. It’ll be likely she’ll download it unknowingly. When I told her not to open any attachmens except for images(please correct me if I’m wrong, but images cannot propogate viruses/worms/trojans?) and she replied, rather puzzled at such a concept, “My friends would never send me viruses!”. Sigh. ---
**Author:** ![Eats\_Crayons](https://avatars.discourse-cdn.com/v4/letter/e/278dde/32.png) [@Eats\_Crayons](https://boards.straightdope.com/u/Eats_Crayons)\ **Post date:** [March 4, 2004, 4:42pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/9 "2004-03-04T16:42:11Z")
> [@Aslan of Narnia](#): > > All her emails come from her friends sending her those ‘fwd. fwd. fwd.’ glurge crap, and she opens ALL her attachments. > \ > When I told her not to open any attachmens except for images(please correct me if I’m wrong, but images cannot propogate viruses/worms/trojans?) and she replied, rather puzzled at such a concept, “My friends would never send me viruses!”. The only problem is that some virus attachments look like this: funny.jpg.exe And some folks get confused. My mom also gets horrible glurge. Luckily, my mom thinks it’s all perfectly awful and just deletes it. She knows not to download anything that she has not specifically requested (she does need the occasional Word doc or PDF). And, being proactive, I got her a Mac and made sure she uses only web-based e-mail like Yahoo for extra screening. ---
**Author:** ![The\_Face](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@The\_Face](https://boards.straightdope.com/u/The_Face)\ **Post date:** [March 4, 2004, 5:02pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/10 "2004-03-04T17:02:51Z")
Question- I ‘ve gotten an E-mail sent to my bulk folder on yahoo with an attachment. I’m not sure(might be a FoF) who its from and I’ wanna open it but I should probably just delete it. Does Yahoo scan for viruses, when I get stuff sent from friends the attachments open on their own would a virus also? ---
**Author:** ![Podkayne](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@Podkayne](https://boards.straightdope.com/u/Podkayne)\ **Post date:** [March 4, 2004, 7:34pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/11 "2004-03-04T19:34:24Z")
> [@Jenaroph](#): > > They misspell “ammount” and it’s clever and convincing? Your IT people apparently have a better grasp of English than ours. 🙂 It’s not at all unusual to get an e-mail from them with more than a few typos and misspellings. From Yahoo, yes, I’d expect the spelling to be right, but note that it will spoof the addy of your ISP or company, too. I admit, when I got a copy of this, I stared at that e-mail hard for about two seconds before realizing it was bogus . . . which makes it about ten times more convincing than most virus pitches. ---
**Author:** ![WaryEri](https://avatars.discourse-cdn.com/v4/letter/w/ea666f/32.png) [@WaryEri](https://boards.straightdope.com/u/WaryEri)\ **Post date:** [March 4, 2004, 9:18pm UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/12 "2004-03-04T21:18:19Z")
Ooohh… I got this little bugger on a couple of my accounts from a website I work for. I had a moment of confusion where I wondered if it might be from our server owner, but they lost me with the signature. I head the [suchandsuch.com](http://suchandsuch.com) team, I don’t get emails from it. The fact that the attachment is _tiny_ cinched it. This is one of the more clever viruses I’ve seen, though. A far cry from the “this is my game. I expect you would like it” and “teapot hammer orangutan swimming desklamp” crap I’m used to deleting on sight. ---
**Author:** ![Sublight](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@Sublight](https://boards.straightdope.com/u/Sublight)\ **Post date:** [March 5, 2004, 2:04am UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/13 "2004-03-05T02:04:35Z")
Yeah, this nasty little fucker actually had me wondering for a few seconds. I’d just received a legit email from the AIR mailing list saying “a virus-infected email was just sent out from this address [which was true]. Don’t open the attachment! We apologize for the inconvenience,” when this one arrived with the same address in the header. ---
**Author:** ![angelicate](https://avatars.discourse-cdn.com/v4/letter/a/d6d6ee/32.png) [@angelicate](https://boards.straightdope.com/u/angelicate)\ **Post date:** [March 5, 2004, 2:23am UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/14 "2004-03-05T02:23:57Z")
I got the same thing, but realized it was fake pretty quickly. Any “official” mail about anything regarding that account goes to the email address - a hotmail address - that I used when registering the domain. It’s still really sneaky, though. ---
**Author:** ![artemis](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@artemis](https://boards.straightdope.com/u/artemis)\ **Post date:** [March 5, 2004, 2:29am UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/15 "2004-03-05T02:29:50Z")
> [@Eats\_Crayons](#): > > The only problem is that some virus attachments look like this: > > funny.jpg.exe > > And some folks get confused. Especially when the second (real) extension is hidden, and all you see is the first (false) one! That’s how I got hit by this damned new virus a couple of days ago. I received an email in my work inbox (which I only use for work purposes, so it never gets spammed); the “From” address was from a collegue at a local hopsital, and when I open the email in Eudora I saw an attachment was labeled summary.txt. I wasn’t expecting an attachment, but this person was someone who might have had a good reason to send me one, and .txt files almost never carry anything… so I clicked on it. The damed thing was really a .exe file camoflagued as a .txt file! Thank heavens my hospital’s IT department had just updated the antivirus software; McAffee quarentined the nasty little bugger before it could do any harm. You don’t have to be an utter moron to fall for some of these viruses these days; a momentary lapse of suspicion is all it takes. ---
**Author:** ![wonky](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wonky/32/393_2.png) [@wonky](https://boards.straightdope.com/u/wonky)\ **Post date:** [March 5, 2004, 2:33am UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/16 "2004-03-05T02:33:25Z")
Yep. Got one, too. It’s funny because I _am_ “[administration@mydomain.com](mailto:administration@mydomain.com)”. I yam! ---
**Author:** ![Richard\_Pearse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/richard_pearse/32/13144_2.png) [@Richard\_Pearse](https://boards.straightdope.com/u/Richard_Pearse)\ **Post date:** [March 5, 2004, 2:33am UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/17 "2004-03-05T02:33:34Z")
> [@Eats\_Crayons](#): > > The only problem is that some virus attachments look like this: > > funny.jpg.exe > > And some folks get confused. Yes and I believe it’s possible to set windows up so that the file extensions aren’t displayed. In that case the above file would look like this: funny.jpg Easily confused. ---
**Author:** ![Oat1957](https://avatars.discourse-cdn.com/v4/letter/o/bbe5ce/32.png) [@Oat1957](https://boards.straightdope.com/u/Oat1957)\ **Post date:** [March 5, 2004, 2:55am UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/18 "2004-03-05T02:55:29Z")
I got one too but spoofed as my ISP. Deleted that and the next one was the good ol’ standby from “eBay”. That one was simple. eBay doesn’t have that particular email address. I can’t tell you how many folks that have tried to send me the Nesky and Beagle virus in the last week. ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [March 5, 2004, 2:56am UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/19 "2004-03-05T02:56:33Z")
I almost fell for an eBay phishing scheme about a week ago because Snopes didn’t have an updated version of it. Fortunately, I was able to track down the proper address at eBay ([spoof@ebay.com](mailto:spoof@ebay.com)) for them to verify it. I wonder how many successful bites the phishers get by people who don’t bother to check on 'em. ---
**Author:** ![Cat\_Whisperer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cat_whisperer/32/4839_2.png) [@Cat\_Whisperer](https://boards.straightdope.com/u/Cat_Whisperer)\ **Post date:** [March 5, 2004, 4:02am UTC](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509/20 "2004-03-05T04:02:43Z")
It sounds like I was sent a similar email scam - I got an email purportedly from Yahoo Support telling me that Yahoo email would be down for the next couple of days, and I should download some crap because of it. I just deleted it - I didn’t even look at what I was supposed to be downloading. If it was legit, too bad - I’ve never had to download anything from Yahoo in the eight years I’ve been using their service. [Next page](https://boards.straightdope.com/t/ugh-a-virus-email-that-managed-to-confuse-me/232509.md?page=2)