"is that u?"

[Sang]

I don't know if any of you guys have come across this, anyway I've had several people on my MSN saying "is that u? http://oliphotos.ol.funpic.org/index.php?pic2038.jpg" and then going offline. Now the link goes to a spyware-program called pic20238[1].exe - just a little heads-up. Also a question, does anyone have any more info about this file? I did a Google for it and found a few pages about the file, but no useful info.

[mon2908]

www.filext.com is a good source of information.

After puting your link in my browser it wants to download pic2038.pif from oliphotos.ol.funpic.org

http://filext.com/detaillist.php?extdetail=pif&Search=Search warns about pif files.

but it could also be an picture format created by IBM.

here is another link to understand what pif files can be

http://www.cryer.co.uk/filetypes/p/pif.htm

[Sang]

After puting your link in my browser it wants to download pic2038.pif from oliphotos.ol.funpic.org

Yes I know that, and I know what it does - I've downloaded it myself but I had good security and took care of the problem quickly. However I want to know how to get rid of it in case you don't have scanners and stuff equipped - Like some people on my MSN list telling me "HOW DO I GET RID OF THIS VIRUS"

Also mon, you should use more common sense, I said that the link I posted linked to a dangerous file - and what do you do? You paste it in your browser! :o

[mon2908]

Did you execute the file on your machine already?

I mean if you only downloaded it, delete it and everything is fine if you executed the file and it didn't show some kind of error message it is best to find out what that pif file does. Gosh, it's a long time I worked with a pif editor and I do not even know if they still exist for some other Windows operating systems, newer than 3.11.

I am still looking for a vector program that allows me to view this content. I tell you more if I find out.

[Sang]

Narh I hadn't opened it.

[mon2908]

So,

I've searched a lot of forums now and can say that this is a virus.

It should be a kind of browser virus that redirects your browser requests or opens unwanted browser popup windows.

I have read that a good antivirus program, Spybot S&D or LSPFix from Cexx.org can help, but it needed to be run in safemode (you know rebooting windows hitting F8 key and run safe mode) to stop some of the background processes.

By the way if you are looking for a good Windows Antivirus program have a look at AVIRA Antivir, it is free to use for one year.
If you like it they ask for a fee.

Hope I could help.

[Sang]

I'm already using Antivir (I'm not having this "trial period" though) but thanks for the info :)

[Ivan]

Thank God it's easy for me to spot those virus 'cause no one on my list speaks like that.

[Rellik66]

.pif files are basically DOS program shortcuts, much like a windows program .lnk shortcut. Windows will execute the .pif file blindly without checking to see if it is actually a .pif file. Also, windows will hide the .pif extension, even if "show file exensions" is enabled, so example.jpg.pif will show up as example.jpg on the desktop, the only tipoff being the MS-DOS shortcut icon.

[Dopefish7590]

kinda sounds like an automated troll :o

then again i could be wrong

[Odin]

.pif files are basically DOS program shortcuts, much like a windows program .lnk shortcut. Windows will execute the .pif file blindly without checking to see if it is actually a .pif file. Also, windows will hide the .pif extension, even if "show file exensions" is enabled, so example.jpg.pif will show up as example.jpg on the desktop, the only tipoff being the MS-DOS shortcut icon.

And you could cover the icon by editing the icon properties. Therefore the only way to tell would be to right click on the file and check the properties. Scary. :insomnia:

[mon2908]

And you could cover the icon by editing the icon properties. Therefore the only way to tell would be to right click on the file and check the properties. Scary. :insomnia:

The problem with this file is that it isn't a Microsoft pif file. It uses the ending pif to show up as executeable and act like an executeable file, but it isn't a plain scriptfile. It really is a binary file (And it needed some VBrun60.dll to execute correctly :D). I do not have it in wine, so it didn't do anything on my linux machine.

If you edit this file with a plain texteditor you'll learn that it is a Windows binary file. There is a line in file that explains that it won't run in DOS Mode. So what astouned me most is the fact that pif files are stil executeable under modern Windows flavours.