This had me wondering for about 10 seconds.

I got an email that looked like a paypal email.

Date: Tue, 06 Jan 2004 23:29:07 +0000
Subject: IMPORTANT vozvshas
1 Shown 13 lines Text
2 14 KB Application

Dear PayPal member,

We regret to inform you that your account is about to be expired in next five
business days. To avoid suspension of your account you have to reactivate it by
providing us with your personal information.

To update your personal profile and continue using PayPal services you have to
run the attached application to this email. Just run it and follow the

IMPORTANT! If you ignore this alert, your account will be suspended in next
five business days and you will not be able to use PayPal anymore.

Thank you for using PayPal.


This was good, but not that good. It has an application attached called It is probably hoping that I am first of all reading the email on a windows box, second that I don’t have view file extentions switch on. This would make it the attachment appear as, so a user might click on it to update.
Second it has a whole load of spaces then vozvshas at the end. This is sign of junkmail. They use this to track who replies to the email. That would be hard in this case since the from address is
Third if you look at the headers you will see

Received: from [] (helo=localhost)
by with smtp id 1Ae0dE-0003og-4Y
for; Tue, 06 Jan 2004 23:29:07 +0000

I know that is my isp’s email server so I know the email came from, it also said it’s name was localhost. If this was a real email server on the internet it would have said its real name not localhost.
Forth. I have never used this email address for a paypal account.

I am curious to see what virus is in the attachment but I won’t see that till I get home.
Moral of the story don’t trust anything that is asking anything relating to money.