Man, this one is gonna snag a *TON* of people, although I hope the bastard sending it out burns in hell. He sent out an email disguised as an official mcafee virus warning. I didn't install the "installer.exe" at the bottom, but it looks like it's spyware, not a virus (since my virus software didn't scream about it)
here is a link to an image capture of the email:

http://www.villagephotos.com/viewpubimage....selected=386271

I haven't seen a (.pif) file since the old days. That's pretty weird though.

it actually isn't a pif file, all that crap is just bogus to get you to believe that this is a legitimate antivirus message. BTW, a lot of virii do infect or create pif files, as well as scr and exe's... but that's an entirely different subject

what email address was it sent from?

Here is the info. The return path is support@McAfee.com, but that is bs.


Return-path: <support@McAfee.com>
Received: from ms-mta-02 (ms-mta-02-smtp [10.10.4.6])
by ms-mss-04.tampabay.rr.com
(iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003))
with ESMTP id <0HII00JGRNOSAJ@ms-mss-04.tampabay.rr.com> for
(omitted by deleted23)@ims-ms-daemon; Thu, 24 Jul 2003 02:36:29 -0400 (EDT)
Received: from flmx03.mgw.rr.com (flmx03.mgw.rr.com [65.32.1.49])
by ms-mta-02.tampabay.rr.com
(iPlanet Messaging Server 5.2 HotFix 1.12 (built Feb 13 2003))
with ESMTP id <0HII009MKNOSRK@ms-mta-02.tampabay.rr.com> for
(ommitted by deleted23)@tampabay.rr.com (ORCPT (omitted by deleted23)@tampabay.rr.com); Thu,
24 Jul 2003 02:36:28 -0400 (EDT)
Received: from vmmr8.verisignmail.com
(vmmrnat.verisignmail.com [216.168.230.187])
by flmx03.mgw.rr.com (8.12.8p1/8.12.8) with ESMTP id h6O6aQgW000199; Thu,
24 Jul 2003 02:36:26 -0400 (EDT)
Received: from ms2.verisignmail.com
(ms2.verisignmail.com [216.168.230.175] (may be forged))
by vmmr8.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA)
with ESMTP id AOF78046; Thu, 24 Jul 2003 01:43:04 -0400 (EDT)
Received: from bvcncn (12-223-198-157.client.insightbb.com [12.223.198.157])
by ms2.verisignmail.com (Mirapoint Messaging Server MOS 3.2.2-GA)
with SMTP id AMD54400; Thu, 24 Jul 2003 01:38:51 -0400 (EDT)
Date: Thu, 24 Jul 2003 01:36:10 -0700
From: McAfee Team <support@McAfee.com>
Subject: Download and run Installer.exe !
To: <Undisclosed-Recipient:@ms2.verisignmail.com;>
Message-id: <001a01c351bf$18307c60$41829ad5@bvcncn>
MIME-version: 1.0
X-MIMEOLE: Produced By MS MimeOLE V6.00.2800.1165
X-Mailer: MS Outlook Express 6.00.2800.1158
Content-type: multipart/related; type="multipart/alternative";
boundary="----=_NextPart_000_0011_01C35183.F60CB760"
X-Priority: 3
X-MSMail-priority: Normal
X-Virus-Scanned: Symantec AntiVirus Scan Engine
Original-recipient: rfc822;(omitted by deleted23)@tampabay.rr.com

lol I wouldn't of even opened it with the subject, "Download and run Installer.exe !"

but you should probably forward the message with the headers to abuse@tampabay.rr.com that should probably work