Advice needed

nozzmoking · #1 (**permalink**) 02-01-2006, 09:54 AM

Hi Guys,

I just received this email:
=================================
Hello,

I noticed whilst browsing your site that there were problems with some of your links, when I tried again with Internet Explorer the problems were not there so I assume that they were caused by me using the Mozilla browser.

As more people are turning to alternative browsers now it may be of help for you to know this. I have enclosed a screen capture of the problem so your team can get it fixed if you deem it an issue.

Kind regards,

<Name of sender>
Dept. Research
=================================

I checked the msg. source in the email header, and it seems ok. I also visited the guy's site, and it also seems legit.

What I'm worried about is he sent 2 files:

1. Screen Capture of Website.scr
2. Part 1.3 (This file is not recognised by WinXP and if I right click and do properties it says it is a '3file', whatever that is.

I right clicked on the .scr file and selected 'Test' and immediately a window opened saying there would be a change to the registry, which I immediately disallowed. (From memory it looked something like scrvrs.exe, or similar).

I'm pretty much on the ball when it comes to spotting viruses (aided by AVG) but this one has me foxed, especially as the email seemed sincere.

If the guy was sending a screenshot wouldn't this be saved to his clipboard and he would need to save the file as a jpeg or gif or similar?

I don't want to reply to the guy, yet, but I'd also like to know if there IS a problem with the site in Firefox that I haven't come across.

Do you think I'm being paranoid or does this seem a bit 'scammy' to you guys?

Much obliged for any feedback.

**mike** · #2 (**permalink**) 02-01-2006, 09:57 AM

I wouldn't open either one of those files for a million bucks.

**dharrison** · #3 (**permalink**) 02-01-2006, 10:12 AM

Hi Paul

Having said that I have had a couple of emails in the past from a legitimate person who must run a link check on random websites and then proceeds to sell his service/software.

But there was no such screenshot involved. Your one sounds dodgy. Don't even give it the time of day.

BTW Mike, thats a good trick keep changing your photo, but we still know its you. ;)

nozzmoking · #4 (**permalink**) 02-01-2006, 10:12 AM

That'll do for me Mike.

The email's going in the bin!

Cheers, just wanted to make sure before I did anything stupid.

MuNKyonline · #5 (**permalink**) 02-01-2006, 10:17 AM

.scr is used as a screen saver extention. It's extremely easy to attach trojan viruses to them so you were right to not allow it to run. I would delete the e-mail and run a full scan of your pc just to be on the safe side. AVG is good software so you should have no problem =)

**ctabuk** · #6 (**permalink**) 02-01-2006, 10:36 AM

Do a back up first, just in case.

nozzmoking · #7 (**permalink**) 02-01-2006, 10:51 AM

Hi Debbie,

I know the guy you mean. He sends an email reporting a broken link and then tries to flog you the service.

I've actually found his service quite useful at times.

Re: my query. I've just received the same email from the same guy, but from a different account.

This nearly caught me out, as the email is quite professional looking, not the normal 'spot-it-from-a-mile' type we normally see.

I'm just glad I took the time to come and ask here first!

Paul

MuNKyonline · #8 (**permalink**) 02-01-2006, 11:28 AM

I've just checked my mail and i've got one too from D Adams @ f-secure.com. Mines a zip file though.

nozzmoking · #9 (**permalink**) 02-01-2006, 11:33 AM

Darren / David, many thanks, I've just let AVG loose on my pc and thankfully, no viruses.

Quote:

Originally Posted by MuNKy

I've just checked my mail and i've got one too from D Adams @ f-secure.com. Mines a zip file though.

Interesting, my one was also from D Adams, press@ development.com

Thanks again all!

MuNKyonline · #10 (**permalink**) 02-01-2006, 12:37 PM

I think that these are genuine websites that have nothing to do with these e-mails. It's a clever script that might be taking advantage of a flaw in their websites.

I'll open the file and see what it does later =)

Tim · #11 (**permalink**) 02-01-2006, 04:27 PM

I'm getting them too and my clients are forwarding them to me! Most likely a trojan. I've reported them to SpamCop but tracing the sh*t is going to be difficult. I traced one to South Africa.

greeneagle · #12 (**permalink**) 02-01-2006, 04:50 PM

Don't know if it is related or not...

Be aware of "Blackworm" set to break out on Feb 3.

Ken

ADAM Web Design · #13 (**permalink**) 02-01-2006, 05:05 PM

Totally illegitimate.

If the links were causing problems, as suggested, then why would anyone send an SCR file as opposed to say a GIF or JPG?

And more importantly...what are the links?

JKomp · #14 (**permalink**) 02-01-2006, 05:12 PM

Yeah if you are worried enough about how your site looks in different browsers to risk getting a virus, then why not simply download firefox for free?

DrTandem1 · #15 (**permalink**) 02-01-2006, 07:17 PM

Firstly, I always delete any unsolicited emails with attachments, if they even make it that far. Then, with other emails that appear legit, I still scan the attachment with an anti-virus program.

Yes, .scr is a screen saver extension and those are very typical of carrying unwanted spyware and such.

Now, onto your issue of cross-browser compatibility. I would first be sure that the page(s) validate. Beyond that, links are links and should work with either browser. Sometimes, I have seen people that create file names with spaces that are not readable by some browsers. So, as a matter of practice, your file and directory names should not use spaces.

The emails I have received occasionally regarding a broken link are generally straight forward and have no attachments. So, I would be wary of this one. If someone wants to show you a screen shot, I would expect it to be a JPEG or GIF, not a screen saver.

TheGarty · #16 (**permalink**) 02-01-2006, 07:31 PM

That is definatley a virus, DO NOT OPEN IT!!!

Its how Viral Email Viruses work... they send to legitimate people, when they put them on their computers it send to you (exponential virus distribution)... so on, so on!

Its simple stupid to mask where the email came from

DO NOT OPEN ANY FILE with .SCR in the attachments!

If you do, you are just asking for trouble... you have to ask the question... why would some random person send you a screen saver file ;-)

Cheers

Tom

Kangawallahop · #17 (**permalink**) 02-02-2006, 12:44 AM

Hi..
if you would like to test your site in a variety of browsers..
theres a thing on the net somewhere called "browsercam", ( I dont think I can drop the link here..?), but I have it for the asking..
it is a free trial, and the results were comfirmed pretty much spot on.

I just did a quick google and came up with something called "anybrowser" I havnt checked this out out yet..

N30 · #18 (**permalink**) 02-02-2006, 10:01 AM

Personally, I won't even download emails unless they come from my enquiry forms or I'm expecting a reply.

I look at the message headers & I delete ALL the virus laden spam off the server before it even hits my system >(

I never open .scr .exe .doc .xls either unless I run a virus checker over it first ;)