Help, pls, with *.txt.pif file... 
Author Message
 Help, pls, with *.txt.pif file...

I received 2 emails from a buddy who I hadn't heard from in some time...
both came up as follows:

Subject: Joseph E (which is his first name and middle initial)..

The message body contained something like:... Hi, I wanted your advice, read
and let me know what you think...

Attached was a text file... readme.txt.pif.... about 59 bytes..I opened it,
nothing in it.... but, should have known better...

Nothing has happened, (anything from a previous post is nowhere to be found
re: badtrans worm, etc...) , my InoculateIT is totally up to date, caught
nothing when I opened this file..... I then deleted these emails, restarted
in Safe Mode.. complete scan... again, nothing... am I missing something, or
am I very very lucky?

As always, thanks for your help!

--
B'rgds,
Vinnie



Fri, 06 Feb 2004 22:53:06 GMT  
 Help, pls, with *.txt.pif file...
The text is classic SirCam.  Your AV should have caught it.  To verify that
you are infected you could email someone in your MS email address book and
ask them if they recently received an email attachment from you. Also ask
your buddy if he intended to send the mails.  If you don't use MS (or use
their address book) then you may have prevented it from spreading but are
still susceptible to internal damage.  You could also do a registry search
(if you're comfortable with it): Start*Run "regedit", under edit*find put in
"SirCam" (all 3 -look at- are checked.).  If it finds a key then close the
window and go to

tml
or http://www.invircible.com/news/news_details.php?id=39 for removal
instructions.

Good Luck
--

~~~~~~~~~~~~~~~~~
Dave McAuliffe
<Central Mass.>  USA
Remove X from address
~~~~~~~~~~~~~~~~~
==========================================================

Quote:
> I received 2 emails from a buddy who I hadn't heard from in some time...
> both came up as follows:

> Subject: Joseph E (which is his first name and middle initial)..

> The message body contained something like:... Hi, I wanted your advice,
read
> and let me know what you think...

> Attached was a text file... readme.txt.pif.... about 59 bytes..I opened
it,
> nothing in it.... but, should have known better...

> Nothing has happened, (anything from a previous post is nowhere to be
found
> re: badtrans worm, etc...) , my InoculateIT is totally up to date, caught
> nothing when I opened this file..... I then deleted these emails,
restarted
> in Safe Mode.. complete scan... again, nothing... am I missing something,
or
> am I very very lucky?

> As always, thanks for your help!

> --
> B'rgds,
> Vinnie



Sat, 07 Feb 2004 02:03:57 GMT  
 Help, pls, with *.txt.pif file...
Thanks Gail- Thanks Dave...

I downloaded, scanned, and ran the SirCam 'fix'... it found nothing.... I
searched thru the Registry... nothing...in addition, no emails went out from
me, I checked/asked around... I also have an AOL address, which is listed in
my Address Book... nothing...

And, as I said, InnoculateIT found nothing when it arrived, and with an
additional scan...nothing...

Is it safe to say I'm lucky??????

--
B'rgds,
Vinnie

Quote:
> The text is classic SirCam.  Your AV should have caught it.  To verify
that
> you are infected you could email someone in your MS email address book and
> ask them if they recently received an email attachment from you. Also ask
> your buddy if he intended to send the mails.  If you don't use MS (or use
> their address book) then you may have prevented it from spreading but are
> still susceptible to internal damage.  You could also do a registry search
> (if you're comfortable with it): Start*Run "regedit", under edit*find put
in
> "SirCam" (all 3 -look at- are checked.).  If it finds a key then close the
> window and go to


Quote:
> tml
> or http://www.invircible.com/news/news_details.php?id=39 for removal
> instructions.

> Good Luck
> --

> ~~~~~~~~~~~~~~~~~
> Dave McAuliffe
> <Central Mass.>  USA
> Remove X from address
> ~~~~~~~~~~~~~~~~~
> ==========================================================


> > I received 2 emails from a buddy who I hadn't heard from in some time...
> > both came up as follows:

> > Subject: Joseph E (which is his first name and middle initial)..

> > The message body contained something like:... Hi, I wanted your advice,
> read
> > and let me know what you think...

> > Attached was a text file... readme.txt.pif.... about 59 bytes..I opened
> it,
> > nothing in it.... but, should have known better...

> > Nothing has happened, (anything from a previous post is nowhere to be
> found
> > re: badtrans worm, etc...) , my InoculateIT is totally up to date,
caught
> > nothing when I opened this file..... I then deleted these emails,
> restarted
> > in Safe Mode.. complete scan... again, nothing... am I missing
something,
> or
> > am I very very lucky?

> > As always, thanks for your help!

> > --
> > B'rgds,
> > Vinnie



Sat, 07 Feb 2004 04:35:52 GMT  
 Help, pls, with *.txt.pif file...


Quote:
> Thanks Gail- Thanks Dave...
> I downloaded, scanned, and ran the SirCam 'fix'... it found nothing.... I
> searched thru the Registry... nothing...in addition, no emails went out
from
> me, I checked/asked around... I also have an AOL address, which is listed
in
> my Address Book... nothing...
> And, as I said, InnoculateIT found nothing when it arrived, and with an
> additional scan...nothing...
> Is it safe to say I'm lucky??????

    If you are running Windows NT or 2000, you are probably OK.  If not,
click "Start", "Run", type "command" and click "OK".  Then type
"dir \recycled\sirc32.exe" and press "Enter".  If the file exists, the
computer may be infected.

Ben



Sat, 07 Feb 2004 09:49:26 GMT  
 Help, pls, with *.txt.pif file...
Ben, file not found!!  thanks!

--
B'rgds,
Vinnie

Quote:


> > Thanks Gail- Thanks Dave...
> > I downloaded, scanned, and ran the SirCam 'fix'... it found nothing....
I
> > searched thru the Registry... nothing...in addition, no emails went out
> from
> > me, I checked/asked around... I also have an AOL address, which is
listed
> in
> > my Address Book... nothing...
> > And, as I said, InnoculateIT found nothing when it arrived, and with an
> > additional scan...nothing...
> > Is it safe to say I'm lucky??????

>     If you are running Windows NT or 2000, you are probably OK.  If not,
> click "Start", "Run", type "command" and click "OK".  Then type
> "dir \recycled\sirc32.exe" and press "Enter".  If the file exists, the
> computer may be infected.

> Ben



Sat, 07 Feb 2004 17:37:44 GMT  
 Help, pls, with *.txt.pif file...
Hi,

this is a common way of viruses, using visible second extensions ( despite
they can use invisible second extensions or embedded codes too ) to be able
to propagate themselves. if you also calculate virus code creation kits /
tools, and thus any one can create a virus with them, it may varies. For
this reason you may configure your AV as Scan All Files ( with no
exclusion ) and Scan All Directories ( to include "Recycle Bin" either.)  Do
not forget that you can also create a file like that.

in your status, if nothing has happened as you said, it may not be a virus
as well !! Or maybe crashed while running; did you checked for strange
registry keys ?

anyway it sound like MTX (
http://vil.nai.com/VIL/virusSummary.asp?virus_k=98797 ) but not for sure,
since you have no actual symptoms...


Quote:
> I received 2 emails from a buddy who I hadn't heard from in some time...
> both came up as follows:

> Subject: Joseph E (which is his first name and middle initial)..

> The message body contained something like:... Hi, I wanted your advice,
read
> and let me know what you think...

> Attached was a text file... readme.txt.pif.... about 59 bytes..I opened
it,
> nothing in it.... but, should have known better...

> Nothing has happened, (anything from a previous post is nowhere to be
found
> re: badtrans worm, etc...) , my InoculateIT is totally up to date, caught
> nothing when I opened this file..... I then deleted these emails,
restarted
> in Safe Mode.. complete scan... again, nothing... am I missing something,
or
> am I very very lucky?

> As always, thanks for your help!

> --
> B'rgds,
> Vinnie



Fri, 13 Feb 2004 20:38:06 GMT  
 
 [ 6 post ] 

 Relevant Pages 

1. Virus readme.txt.pif

2. reader_digest_letter.txt.pif

3. Readers_Digest_Letter.txt.pif

4. File Conversion: UNIX.txt to DOS.txt and trim trailing blanks

5. (PCVT) Pls Help Converting Clarion Data files to DBF

6. WIN32 FILE SEARCHING, PLS HELP!

7. make file problems, help pls.

8. Shared EXE and PIF Files

9. Create a .pif file

10. Wanted: pkg to read/write windows .lnk/.pif files

11. Help - fast routine for find and replace in Txt file

12. Urgent help needed reading txt file

 

 
Powered by phpBB® Forum Software