Don’t Trust E-mail

I spent two hours Monday on the phone with an out-of-state client, cleaning up the mess left by the latest Windows virus, Swen. He had received an infected e-mail that appeared to be from Microsoft and appeared to contain an important security update. So he dutifully ran the attached file. At which point, of course, all hell broke loose.

I was able to walk him through the process of removing the virus, restoring his antivirus software to proper working order, and deleting the 15,000-plus infected messages that had accumulated in his Inbox. Along the way, he asked, several times, “How could I have been so stupid?” Actually, he was taken in by a relatively clever trickster. Here’s the moral of the story:

Don’t trust anything you receive in e-mail. It’s easy to “spoof” the sender field of an e-mail message so that it appears to be from anyone – from Microsoft, or from your best friend, or even from me. Just because you read it in an e-mail, that doesn’t mean it’s true.

Bookmark the security pages for the companies that make the software you use regularly. I’ve got the Microsoft Security and Privacy page in my Favorites folder, along with Symantec’s Security Response page. If you get an e-mail pretending to offer information from either one, don’t ignore it, but don’t assume it’s for real, either. Check it out for yourself before you make any decisions that you might later regret.

If you still can’t figure it out, send me an e-mail. My address isn’t published here (for security reasons), but the Send Me a Note link on this page will let you fill in a Web form that is guaranteed to get to me.