suffix question ?
 

Hi Folks.
I received an email today from somebody I don't know, with an attachement labeled 'LUCRECE.DOC.LNK'
Now I'm not quite stupid enough to open this, but I am curious to know what it is!!
I've searched the McAfee.com site and can find no current virus that fits the description, but then I'm no computer buff, and someone could just be renaming something nasty before sending it to me.
When I click on 'properties' for this email in MS Outlook Express (V.5), it lists the route, but also tells me that there are in fact 3 attachements on this email ( although only 1 is visable)
Am I being paranoid ??? and can anyone tell me what the suffix '.DOC.LNK' is about.
P.S. the attachement(s) are 196K big !!
Thanks....
Iona.

Sounds very much like the sircam virus. Delete it at once. http://www.symantec.com/avcenter/[email protected]

Wow - thanks Paper Tiger. I've just read the link you kindly provided, and yes, Sircam is exactly what I've been sent.
I've just deleted it (without having opened it), but wonder if I could have been infected anyway ?
Thanks again....
If only I could email you a pint.....

If you haven't opened it, no damage can occur. It has to be an executable (.exe, .bat, .com, .lnk, or .pif) and it must be executed to cause you pain. Opening one of the above types will convince Windoze to execute, therefore do damage if it is virulent. Virus writers go to some lengths to disguise the fact that an attachment is executable - .lnk and .pif being favorites (because they sound harmless).

In your case, the .DOC part is irrelevant - always look at the last suffix - this is another way they attempt to make attachments seem harmless. For example, I could send you a file called "747-400.LHR.mpg.lnk" - sounds tempting, but the key is to always check the final file extension. This part is all Windoze will use to decide whether to execute it!

Basically never open an attachment that is executable, unless you are absolutely sure you know where it came from (like you ordered it!)

[ 01 November 2001: Message edited by: sanjosebaz ]