# Virus from Microsoft ? **URL:** \ **Category:** Factual Questions\ **Created:** [May 27, 2003, 10:55am UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736 "2003-05-27T10:55:57Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Tarantula](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Tarantula](https://boards.straightdope.com/u/Tarantula)\ **Post date:** [May 27, 2003, 10:55am UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/1 "2003-05-27T10:55:57Z")
I keep getting an email from “[support@microsoft.com](mailto:support@microsoft.com)” with something like “Cool Screensaver” in the subject line and then nothing in the email - just an attachment, which is a “.att” file. I didn’t open the file, because the whole email looked a little weird. If it is a virus, I’m pretty sure that it’s not actually coming from Microsoft, must be just going through its servers… Any ideas as to what this might be ? 😕 ---
**Author:** ![Princhester](https://avatars.discourse-cdn.com/v4/letter/p/3e96dc/32.png) [@Princhester](https://boards.straightdope.com/u/Princhester)\ **Post date:** [May 27, 2003, 11:00am UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/2 "2003-05-27T11:00:34Z")
I am not an expert in these things but I am pretty sure that the mere fact that email appears on the surface to have come from [support@microsoft.com](mailto:support@microsoft.com) means little. “Spoofing” email addresses (ie hiding the real sender and making it appear to come from someone else) is commonplace. My tip is enter the whole name of the attachment into Google, and you will have your answer as to what this really is. ---
**Author:** ![Tarantula](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Tarantula](https://boards.straightdope.com/u/Tarantula)\ **Post date:** [May 27, 2003, 11:02am UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/3 "2003-05-27T11:02:00Z")
Unfortunatly I have deleted it, but since it came 3 time in the last 24 hours, I’m sure it will come again. Thanks - I’ll try it when it does… ---
**Author:** ![Steven\_G](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steven_g/32/5080_2.png) [@Steven\_G](https://boards.straightdope.com/u/Steven_G)\ **Post date:** [May 27, 2003, 11:11am UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/4 "2003-05-27T11:11:59Z")
see [http://vil.mcafee.com/dispVirus.asp?virus\_k=100307](http://vil.mcafee.com/dispVirus.asp?virus_k=100307) amongst others ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [May 27, 2003, 11:13am UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/5 "2003-05-27T11:13:13Z")
Sounds like your ISP or some AV software on your system may have filtered out the virus attachment - I got the same message today and my AV says it removed something called Screen\_temp.pif. The ‘from’ header is indeed spoofed in an attempt to add an air of reputability to the message. ---
**Author:** ![Mort\_Furd](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Mort\_Furd](https://boards.straightdope.com/u/Mort_Furd)\ **Post date:** [May 27, 2003, 11:13am UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/6 "2003-05-27T11:13:17Z")
It is not even going through Microsoft’s servers. Faking a sender address is simplicity itself. [www.snopes.com](http://www.snopes.com) has a section on current virus problems. ---
**Author:** ![robo](https://avatars.discourse-cdn.com/v4/letter/r/bb73d2/32.png) [@robo](https://boards.straightdope.com/u/robo)\ **Post date:** [May 27, 2003, 11:48am UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/7 "2003-05-27T11:48:46Z")
email is much like normail mail in this respect. If you get a paper envelope that says that it’s from Microsoft you can’t really be certain that it is from Microsoft. Anyone can send out mail making it look like it came from someone else. ---
**Author:** ![dantheman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dantheman/32/9421_2.png) [@dantheman](https://boards.straightdope.com/u/dantheman)\ **Post date:** [May 27, 2003, 11:53am UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/8 "2003-05-27T11:53:08Z")
I get those support @ microsoft ones a lot. Norton strips the attachments, though, so I’m not sure what junk is being sent to me, but I’ve always assumed it decidedly wasn’t Microsoft. ---
**Author:** ![Tarantula](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Tarantula](https://boards.straightdope.com/u/Tarantula)\ **Post date:** [May 27, 2003, 12:05pm UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/9 "2003-05-27T12:05:24Z")
Thanks all - yeah we seem to have got it licked… This is my work email (working for a large multinational) and they have pretty much got “the shit” when it comes to firewalls & PSNs. Nothing ever gets through, that’s why it had me wondering… Thanks again… ---
**Author:** ![micco](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@micco](https://boards.straightdope.com/u/micco)\ **Post date:** [May 27, 2003, 12:16pm UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/10 "2003-05-27T12:16:19Z")
**Steven\_G** nailed it. This has been a very active worm lately. I only wanted to add that Microsoft **never** sends updates, patches, or anything else via email. If they want you to have something, they’ll link to their website. Because everyone understands the insecurity of email with regard to spoofing, this is true of pretty much anyone distributing software. ---
**Author:** ![Tarantula](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Tarantula](https://boards.straightdope.com/u/Tarantula)\ **Post date:** [May 27, 2003, 12:19pm UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/11 "2003-05-27T12:19:24Z")
Just as an aside, how do you spoof an email address ? ---
**Author:** ![Mort\_Furd](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Mort\_Furd](https://boards.straightdope.com/u/Mort_Furd)\ **Post date:** [May 27, 2003, 12:31pm UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/12 "2003-05-27T12:31:14Z")
Depends on your ISP. If they aren’t too stiff necked about things, you just change the address in your e-mail program. They’ll still know it was you, but a casual reader won’t. The ISP I use lets you have access to an SMTP relay (for a couple of bucks extra a month.) I can send email with any “from” address I want. There is still a tag in the e-mail header that says what user it actually came from, however. If I wanted to, I could rig a mail system (sendmail) on my PC, and use it to deliver the mail directly instead of going through my ISP’s servers. That wouldn’t have anything in it that I didn’t want you to know. If I all I did was allow sendmail to deliver directly but didn’t change anything else, right now you’d get mail with any “from” address I wanted, and a tag that it came from the server “Mortimer.Furd.” Which wouldn’t be real useful, since that is a private network and thus needn’t be registered anywhere. ---
**Author:** ![Tarantula](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Tarantula](https://boards.straightdope.com/u/Tarantula)\ **Post date:** [May 27, 2003, 12:48pm UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/13 "2003-05-27T12:48:26Z")
Thanks Mort. Much obliged… ---
**Author:** ![Airman\_Doors\_USAF](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@Airman\_Doors\_USAF](https://boards.straightdope.com/u/Airman_Doors_USAF)\ **Post date:** [May 27, 2003, 12:48pm UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/14 "2003-05-27T12:48:28Z")
Virus from Microsoft, you say? It’s been around for around 20 years. It’s called Windows. 😃 ---
**Author:** ![Tarantula](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@Tarantula](https://boards.straightdope.com/u/Tarantula)\ **Post date:** [May 27, 2003, 1:01pm UTC](https://boards.straightdope.com/t/virus-from-microsoft/177736/15 "2003-05-27T13:01:08Z")
\*\* Airman \*\* - that reminds me of the joke about Bill Gates in hell… A hahhaahahahahaaaa :D:D:D:D:D:D