.pif - malicious email ?

sde · 04-01-2003, 06:39 AM

process interchange format

what is a .pif file exactly?

i get emails from the same addy almost everyday. in it contains an attachment with something like movie.mpg.pif or many other attempts which would make someone want to open it.

any insight on this one?

alpha · 04-01-2003, 06:53 AM

it is actually program information file. it contains info for certain programs. it could contain the info of running a program without your knowledge. it could contain dangerous payloads, so I wouldn't open it if I were you. And if it continuous with the emails, pretty much spam, then it is highly likely that it isn't a good file. The file extension .pif would not show under windows, so if d/led, it would look like a .mpg file for example.

So, don't open it. And try to block the email addy.

joe_bruin · 04-01-2003, 10:13 AM

this is a windows virus.
pif's are an old style configuration script for windows. it's just a text file, so you can open it up and read what it does. there is very little legitimate reason for anyone to ever send you a pif, and you should probably block the address you're getting it from.

Epsilon · 04-01-2003, 05:11 PM

My understanding is it's similar to a .bat (batch) file, capable of executing code and not in any way safe if it was e-mailed to you. Chances are good that a .pif e-mail to you from a stranger is malicious.

JeC · 04-02-2003, 01:59 PM

Open the .pif file in a text editor and show us all what it was going to do to you

Hrqls · 04-02-2003, 10:52 PM

where there are files attached with double extensions (.mpeg.pif / .doc.vbs / ...) then you can be 99% to have soemthing bad ...

they trust the user to have set their windows not to show known extensions ... so you in your example it would show the .pif and just show a .mpeg file .. some users might then think they have a movie and get curious ...

just have windows show known extension as well .. and immedeately (sp?) delete files with double extensions

another bad thing about most graphics type (and i believe .pif is one of those ???) is that some people set the outlook to show those types directly ... thereby opening the file automatically