Another Friggin' Web Scam

[John Tapscott]

Just received the following from info@bestbuy.com. Interestingly it didn't come to my personal email, but to my generic business email address. It had an attachment which I didn't dare open. It went into the spam file which I then emptied. Man, I hate these things.

Dear Customer,

Thank you for ordering from our internet shop. If you paid with a credit card, the charge on your statement will be from name of our shop.

This email is to confirm the receipt of your order. Please do not reply as this email was sent from our automated confirmation system.

Date : 08 Oct 2006 - 12:40

Order ID : 37679041

Payment by Credit card

Product : Quantity : Price

WJM-PSP - Sony VAIO SZ370 C2D T7200 : 1 : 2,449.99

Subtotal : 2,449.99

Shipping : 32.88

TOTAL : 2,482.87

Your Order Summary located in the attachment file ( self-extracting archive with "37679041.pdf" file ).

PDF (Portable Document Format) files are created by Adobe Acrobat software and can be viewed with Adobe Acrobat Reader.

If you do not already have this viewer configured on a local drive, you may download it for free from Adobe's Web site.

We will ship your order from the warehouse nearest to you that has your items in stock (NY, TN, UT & CA). We strive to ship all orders the same day, but please allow 24hrs for processing.

You will receive another email with tracking information soon.

We hope you enjoy your order! Thank you for shopping with us!

[Dan Gould]

Have you ever purchased from their website? If you have, I wouldn't write this off as another attempt to launch some sort of virus on your PC.

In a related, general queery, I know you can mask the URL of a link, but is it possible to mask the file type of an attachment? If it was a PDF file - is that a typical way of delivering a virus or a worm?

[John Tapscott]

No, I have never ordered anything from their website. I have bought very little at bestbuy stores, really - a few CD's and DVD's, and have always paid cash. It's obviously someone fishing around.

But it really bugs me that reputable companies seem so nonchalant about having their names used in these kinds of scams. They ought to go after some of these scam artists, or at least one, as a sign that they won't put up with this stuff.

Can't answer the other question. I don't open files of any kind anymore unless I know the sender personally.

[Kevin Bresnahan]

In a related, general queery, I know you can mask the URL of a link, but is it possible to mask the file type of an attachment? If it was a PDF file - is that a typical way of delivering a virus or a worm?

A .pdf cannot infect your computer (as far as I know) but the term "self-extracting" is scary, scary. That means the file is an .exe file.

NEVER click ANY .exe files!

Definitely a nasty spammer. I shudder to think what that attachment would install. It's probably a keylogger. Keyloggers are getting more & more prevalent. These applications record everything you type and send it to the thieves, who go through it looking for usernames and passwords.

FWIW, I was very upset when my Mom decided to get off the web when my father died. Now, given how poor her PC skills are, and how prevalent these scams are getting, I am so glad she made this decision. One less PC mess I have to fix.

Later,

Kevin

[Kevin Bresnahan]

But it really bugs me that reputable companies seem so nonchalant about having their names used in these kinds of scams. They ought to go after some of these scam artists, or at least one, as a sign that they won't put up with this stuff.

But John, they most certainly do! All you have to do is forward that e-mail to spoof@bestbuy.com. Believe me, they will shut down any websites linked to that e-mail. They will likely send you a nice "Thank you" e-mail as well.

Can't answer the other question. I don't open files of any kind anymore unless I know the sender personally.

NO! Even if you KNOW the sender, do not open ANY .exe attachments unless you speak with the person over the phone to find out what they sent.

Many viruses send themselves out via E-mails to everyone on the infected person's address book. The E-mail from a "friend" may be from the virus.

Later,

Kevin

Edited November 1, 2006 by Kevin Bresnahan

[Dan Gould]

Can't answer the other question. I don't open files of any kind anymore unless I know the sender personally.

NO! Even if you KNOW the sender, do not open ANY .exe attachments unless you speak with the person over the phone to find out what they sent.

Many viruses send themselves out via E-mails to everyone on the infected person's address book. The E-mail from a "friend" may be from the virus.

Later,

Kevin

A very good point, Kevin. The idea that keyloggers are becoming common is especially scary to me as I have only a few passwords I use and have not gotten into the habit of changing them.

[Uncle Skid]

A .pdf cannot infect your computer (as far as I know) but the term "self-extracting" is scary, scary. That means the file is an .exe file.

The risks of opening pdf files are certainly much less than self-extracting exe files, but... being infected by a pdf is possible.

Edited November 1, 2006 by Uncle Skid

[Dan Gould]

A .pdf cannot infect your computer (as far as I know) but the term "self-extracting" is scary, scary. That means the file is an .exe file.

The risks of opening pdf files are certainly much less than self-extracting exe files, but... being infected by a pdf is possible.

I'm sorry but since I don't know where that link goes to, I am not going to click on it.

[Uncle Skid]

I'm sorry but since I don't know where that link goes to, I am not going to click on it.

[Noj]

I had a very similar one using PayPal's name. That one freaked me out for a second!

[Son-of-a-Weizen]

In a related, general queery, I know you can mask the URL of a link, but is it possible to mask the file type of an attachment? If it was a PDF file - is that a typical way of delivering a virus or a worm?

A .pdf cannot infect your computer (as far as I know) but the term "self-extracting" is scary, scary. That means the file is an .exe file.

NEVER click ANY .exe files!

All .exe files? I think my Nikon View shortcut desk icon is an .exe -- that's a bad thing?

[Kevin Bresnahan]

In a related, general queery, I know you can mask the URL of a link, but is it possible to mask the file type of an attachment? If it was a PDF file - is that a typical way of delivering a virus or a worm?

A .pdf cannot infect your computer (as far as I know) but the term "self-extracting" is scary, scary. That means the file is an .exe file.

NEVER click ANY .exe files!

All .exe files? I think my Nikon View shortcut desk icon is an .exe -- that's a bad thing?

Never click any .exe files in E-mails. There are other extensions that can do damage as well, but .exe is easy to spot. About the only file that I open in E-mails is .jpg files.

[Claude]

Be careful with that Vaio. Sony laptop batteries are more dangerous than exe email attachments