# Virus in disguise? **URL:** \ **Category:** Factual Questions\ **Created:** [January 18, 2005, 6:56pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403 "2005-01-18T18:56:01Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![ccwaterback](https://avatars.discourse-cdn.com/v4/letter/c/df705f/32.png) [@ccwaterback](https://boards.straightdope.com/u/ccwaterback)\ **Post date:** [January 18, 2005, 6:56pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/1 "2005-01-18T18:56:01Z")
I received an e-mail daemon e-mail today, saying some e-mail I sent couldn’t be delivered. I looked at the destination of the original message and it wasn’t familiar to me. This e-mail contained an attachment (document.doc.pif). The message in the e-mail I received says the original message is contained in the attachment. I suspect this is a virus. Isn’t a .pif file basically and “executable”? ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 18, 2005, 6:58pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/2 "2005-01-18T18:58:46Z")
It’s definately not legitimate. In my understanding a PIF file is the old style of shortcut. So in a way it is executable and should not be opened. ---
**Author:** ![Yllaria](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/yllaria/32/3452_2.png) [@Yllaria](https://boards.straightdope.com/u/Yllaria)\ **Post date:** [January 18, 2005, 7:00pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/3 "2005-01-18T19:00:15Z")
Someone else will come with a good explaination, but yes this is probably a virus and you shouldn’t open it. We’ve had a rash of these emails at work. Someone who has your address has a computer virus and their machine is sending you these misleading messages. As you suspected: Do not open! ---
**Author:** ![SavageNarce](https://avatars.discourse-cdn.com/v4/letter/s/b5e925/32.png) [@SavageNarce](https://boards.straightdope.com/u/SavageNarce)\ **Post date:** [January 18, 2005, 7:30pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/4 "2005-01-18T19:30:28Z")
> [@Yllaria](#): > > Someone who has your address has a computer virus and their machine is sending you these misleading messages. Worse than that. Someone who wants to send viruses to other people is doing so using **your** e-mail address, so that it looks like the virus is coming from you. Unfortunately, there’s not reaaly much you can do about this “address spoofing” unless you are prepared to abandon your e-mail address and set up a brand new one. ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 18, 2005, 7:34pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/5 "2005-01-18T19:34:55Z")
> [@SavageNarce](#): > > Worse than that. Someone who wants to send viruses to other people is doing so using **your** e-mail address That might not be the case here. It could be that the OP’s computer is recieving the e-mails but hasn’t been compromised by them to become a sender. The OP could find out by asking people on his/her address book. I recieved these type of e-mails on an old isp and old computer, it simply died down to nothing after a few weeks. ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [January 18, 2005, 7:53pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/6 "2005-01-18T19:53:31Z")
> [@Lobsang](#): > > That might not be the case here. It could be that the OP’s computer is recieving the e-mails but hasn’t been compromised by them to become a sender. The OP could find out by asking people on his/her address book. No, you misunderstand. Someone is sending out emails containing the virus attachement (actually, it’s more likely a program is doing the mailing from some innocent person’s infected computer), and is changing the _email header_ to use the OP’s email address in the FROM field. Thus any such mail sent to a bad address will bounce back to the OP’s email account, because SMTP servers only look at the FROM field in the header when routing bounced mails. It’s likely that someone who has the OP in his/her address book is infected and doesn’t even know it. There are a number of known viruses that spread this way. ---
**Author:** ![ccwaterback](https://avatars.discourse-cdn.com/v4/letter/c/df705f/32.png) [@ccwaterback](https://boards.straightdope.com/u/ccwaterback)\ **Post date:** [January 18, 2005, 7:54pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/7 "2005-01-18T19:54:50Z")
I believe I am virus free, so I think it’s a matter of someone spoofing my e-mail address. I’m thinking perhaps the virus has a list of e-mail addresses it is spoofing, thereby causing the spoofed addresses to receive a copy of virus. WAG. ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 18, 2005, 8:01pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/8 "2005-01-18T20:01:15Z")
> [@Q.E.D.](#): > > No, you misunderstand. Someone is sending out emails containing the virus attachement (actually, it’s more likely a program is doing the mailing from some innocent person’s infected computer), and is changing the _email header_ to use the OP’s email address in the FROM field. Thus any such mail sent to a bad address will bounce back to the OP’s email account, because SMTP servers only look at the FROM field in the header when routing bounced mails. It’s likely that someone who has the OP in his/her address book is infected and doesn’t even know it. There are a number of known viruses that spread this way. Q.E.D. as far as I can tell that’s more or less what I said. Maybe I misunderstood _again_ but the above doesn’t suggest the OP’s computer has a virus, which is what I was saying. ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [January 18, 2005, 8:04pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/9 "2005-01-18T20:04:06Z")
> [@Lobsang](#): > > Q.E.D. as far as I can tell that’s more or less what I said. Maybe I misunderstood _again_ but the above doesn’t suggest the OP’s computer has a virus, which is what I was saying. _Mea culpa_. I think I read your post too quickly. Consider my reply an expansion on your post, rather than a corrrection. :o ---
**Author:** ![Lobsang](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lobsang/32/4067_2.png) [@Lobsang](https://boards.straightdope.com/u/Lobsang)\ **Post date:** [January 18, 2005, 8:13pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/10 "2005-01-18T20:13:01Z")
No problem. I’m usually wrong so I sometimes catch people out by being right 😃 ---
**Author:** ![ccwaterback](https://avatars.discourse-cdn.com/v4/letter/c/df705f/32.png) [@ccwaterback](https://boards.straightdope.com/u/ccwaterback)\ **Post date:** [January 18, 2005, 8:46pm UTC](https://boards.straightdope.com/t/virus-in-disguise/285403/11 "2005-01-18T20:46:14Z")
So, instead of receiving an e-mail with a virus attached, the virus is bouncing an e-mail back to me by spoofing my address and sending to an unknown destination, causing me to receive a bounced e-mail (that I never sent to begin with) and telling me the contents of my original e-mail is in the attachment (which is actually the virus). Vewy twicky wabbit.