Strange Google E-mail

[DEP/dodo]

Hi, All.  This e-mail is different from any I've ever submitted to this group.

Today I received an e-mail, with an attachment, supposedly from Google, thanking me for submitting my resume (which I didn't).  I admit I was tempted for a second to open the attachment because I was so curious but didn't!  I also remember seeing, in the main message, the colorful letters that spell GOOGLE.  While I didn't mark it as spam, I did send it to the Trash.  Has this happened to any of you, or have you heard of any similar experiences?  Just now I was going to take another look at the main message, but now I can't find the e-mail.  That, too, is strange.  How can I find out from Google if the message was legit and, more important since I am so skeptical about it, how do I report it?
~Dodo the Doubter

[Elihu]

I don't think its something to dwell on. Everyone gets numerous spam / phishing attempts everyday, and sometimes they get past gmail's excellent spam filters.

--
You received this message because you are subscribed to the Google Groups "Gmail-Users" group.
To post to this group, send email to gmail...@googlegroups.com.
To unsubscribe from this group, send email to gmail-users...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/gmail-users?hl=en.

[Somnath Banerjee]

I got a similar message from pi...@google.com. asking for submission of resume.

That too I got it on my official email address.

--

[Marko Vukovic]

On 1 July 2010 07:29, DEP/dodo <depf...@gmail.com> wrote:

Hi, All.  This e-mail is different from any I've ever submitted to this group.

Today I received an e-mail, with an attachment, supposedly from Google, thanking me for submitting my resume (which I didn't).  I admit I was tempted for a second to open the attachment because I was so curious but didn't!  I also remember seeing, in the main message, the colorful letters that spell GOOGLE.  While I didn't mark it as spam, I did send it to the Trash.  Has this happened to any of you, or have you heard of any similar experiences?  Just now I was going to take another look at the main message, but now I can't find the e-mail.  That, too, is strange.  How can I find out from Google if the message was legit and, more important since I am so skeptical about it, how do I report it?

Hi Dodo

What was the attachment? If you do indeed find it again, click the little down arrow next to the Reply button and select 'Show original' to see the message in it's raw form. Select all the text from the top down to the text of the message, this is what's called the headers. Copy that and post it here so we can see where the message originated.

Ciao

--
Marko

[Andy]

> How can I find out from Google if the message was legit ...

You already know that it wasn't legit.  You never sent them your
resume. The chances of it being mistakenly sent to your email address
are minuscule.

Since it might be an example of Pfishing (pronounced like "fishing"),
one way to report it, is to use the "Report Pfishing" item in the
drop-down menu next to the Reply button in the upper right corner of
the message.  It probably doesn't actually report it to Google
executives or lawyers, but I think it helps train Gmail to recognize
such emails as pfishing attempts.

It might not be pfishing; it might be just a "trojan horse" trying to
infect your computer.

I suspect most or all of us here don't know how to actually contact a
live person at Google to pass it on to their legal department, if
that's what you had in mind.

The attachment itself is probably encoded in "base-64" form (as most
email attachments are), making it a bit harder to see what it is when
you use "Show original" to view it.  It is USUALLY safe to save an
attachment to your local disk ... where you could run a virus checker
on it or view it with a simple text editor or something ... as long as
you don't do something that might attempt to either execute/run the
file, or open it in a Microsoft Office product (Word, Excel, etc.).

The original message still ought to be in your Trash, unless you had
found it in your Spam and clicked "Delete Forever" instead.  So maybe
you could find it again if you tried harder.  (Not that there is any
reason to do that.)

Regards,
Andy

[Andy]

Oh, and by the way ...

> Has this happened to any of you, or have you heard of any similar experiences?

I get junk like that all the time (not from Google but from other
companies, mostly banks), complete with the company's real logo, links
to their homepage and their privacy policy, etc. It's one way the
pfishers and spammers make their emails look legitimate.

Andy

[Marko Vukovic]

On 1 July 2010 15:05, Andy <AI.e...@gmail.com> wrote:

> How can I find out from Google if the message was legit ...

You already know that it wasn't legit.  You never sent them your
resume.  The chances of it being mistakenly sent to your email address
are minuscule.

Since it might be an example of Pfishing (pronounced like "fishing"),

That would be 'phishing'.  

--
Marko

[Andy]

>> Since it might be an example of Pfishing (pronounced like "fishing"),
>
> That would be 'phishing'.

Arrgh! Brain not working yet!

Many thanks for the correction.

[Sarah Hill]

Report of virus/malware masquerading as google resume thanks:
http://community.ca.com/blogs/securityadvisor/archive/2010/02/11/fruspam-thank-you-from-google.aspx

Quote:

This Win32/Fruspam variant drops a copy of itself as "GoogleUpdte.exe"<sic> and "googleup.exe" in the Windows system folder.

The spammed email contains the following:

From field: resume...@google.com

Subject: Thank you from Google!

Attachment: CV-20100120-112.zip"

****

And some more info here on how it spoofs the address:
http://blog.onlymyemail.com/thank-you-from-google-virus-trojan/

On Thu, Jul 1, 2010 at 11:09 PM, Sarah Hill <mail...@gmail.com> wrote:

Follow Marko's advice BUT Do not open the atttachment unless you know exactly what you are doing!

If you have a look here you will find (among the results)  other people's experiences with this situation: http://www.google.co.uk/search?hl=&q=google+spam+thanks+for+resume&sourceid=navclient-ff&rlz=1B2GGIC_enGB366GB207&ie=UTF-8

Or do the search yourself ( I used "google spam thanks for resume")

The attachment is often reported to be  a (.exe) executable file, and in some cases a virus, win32cryptor is mentioned.

--

[Sarah Hill]

Follow Marko's advice BUT Do not open the atttachment unless you know exactly what you are doing!

If you have a look here you will find (among the results)  other people's experiences with this situation: http://www.google.co.uk/search?hl=&q=google+spam+thanks+for+resume&sourceid=navclient-ff&rlz=1B2GGIC_enGB366GB207&ie=UTF-8

Or do the search yourself ( I used "google spam thanks for resume")

The attachment is often reported to be  a (.exe) executable file, and in some cases a virus, win32cryptor is mentioned.

On Thu, Jul 1, 2010 at 6:29 AM, DEP/dodo <depf...@gmail.com> wrote:

--

[DEP/dodo]

Interesting.  Mine didn't ask for submission but, instead, acknowledged receipt of my (nonexistent) resume.  ~Dodo

[DEP/dodo]

I wondered about that, too, Elihu.  I guess I thought Gmail would recognize a "fake" Google message.  ~Dodo

[DEP/dodo]

I am fairly vigilant about such pfishing and spamming from banks and such.  This one from "Google" took me by surprise---obviously.  ~Dodo

[DEP/dodo]

Hi, Marko--

Thank you for your instructions, which I will save  and hope not to need again.
~Dodo

[DEP/dodo]

As I indicated, Sarah, I did not open the attachment.  I know better than to do that.  Thanks for the research info.  ~Dodo

[DEP/dodo]

Subsequently, I was unable to access the link I provided in my reply to Sarah.  I searched again and found another, but related, link (hope this one works):

http://www.spamfighter.com/News-13876-Fake-E-mail-Scam-Targets-Google-Job-Applicants.htm
~Diane

On Sat, Jul 3, 2010 at 6:06 PM, DEP/dodo <depf...@gmail.com> wrote:

I followed Sarah's suggestion, did some research, and found the following, which is precisely what I had received:

https://mail.google.com/mail/?hl=en&zx=oorwxcom1l2z&shva=1#inbox/1298c7affb69352d

On Thu, Jul 1, 2010 at 3:09 PM, Sarah Hill <mail...@gmail.com> wrote:

[Dodo]

This wasn't operational.

On Jul 1, 3:23 pm, Sarah Hill <mailh...@gmail.com> wrote:

And some more info here on how it spoofs the address:http://

blog.onlymyemail.com/thank-you-from-google-virus-trojan/*

[Marko Vukovic]

On 4 July 2010 04:42, DEP/dodo <depf...@gmail.com> wrote:

Subsequently, I was unable to access the link I provided in my reply to Sarah.  --8<--

We couldn't either, because it was a link to an object related to *your* inbox.

It's phishing people, PHISHING ;)

Lol, cheers!

--
Marko

[Sarah Hill]

There's a lot of variants of this "Google, thanks for your resume" spam/virus/trojan atttack circulating...I had already heard of it.r

Dodo, I included the "don't open unless..."  caution as much for the benefit of any other people, who may come across this thread when looking for information. I (personally) know many less experienced users who would not understand the difference between viewing the original, using a text editor, to open the attachment (to find out more about it) and just opening it.

Sarah

[DEP/dodo]

I'm one of 'em!  ~Diane/Dodo

[DEP/dodo]

Hi, Marko--

I discovered right after I sent my post where that link led.  Don't know how that happened, but I immediately deleted my message from the Group's interface.  Of course, I realized I could do nothing about those who read these posts via Gmail.  Sarah has assured me that I haven't opened myself up to all kinds of problems.

Yes, I saw your original comment correcting the spelling of "phishing."  However, since my surname begins with the letters "Pf," I let it slide pfor pfun, because sometimes when I e-mail with friends or family, I will purposely spell those words as "pfriends"/"pfamily"  So, why not "pfishing"?  But your correction as to the actual spelling is duly noted.

Glad to see you (and my husband) have come up for air from soccer.  ~Dodo