Originally Published 03 March 2004

Starting on Monday 1 March, many people in the University received electronic mail messages containing a few words such as "Please read the attached file" along with an attached file with a name ending in .PIF

These files contain a computer worm (like a virus). If the file is opened on computers in the University running MS Windows, the worm uses the computer to send copies of itself to other people.

The virus causes some computers to play tunes through the computer's internal speaker.

Even if you don't think that your PC has been affected please do a basic virus check of the computer's C: drive anyway. This worm is identified by Antiviral Toolkit Pro/Kaspersky Anti Virus as "I-Worm.Netsky.d".

If you think your office computer has been affected by this worm, ring the IT Services helpdesk on ext.73737 and someone will can talk you through the procedure for removing it.

The IT Services department has arranged for McAfee's "Stinger" application, which is useful in removing this worm, to be made available in the "delivered applications" window under "Virus Checking/Cleaners". Note however that this application detects only a few viruses out of the tens of thousands that exist, so it is not a substitute for a proper virus check. Anyone unfamiliar with Stinger should consult the help desk before using the programme.

It is highly unlikely that a file received by electronic mail whose name ends in .PIF is going to be useful. Do not open any files with the extension .PIF

Jim Hicks, Information Technology Services
J.Hicks@warwick.ac.uk