MSN Messenger FAQ > What are those files ending with .pif that people send me over Messenger?

A whole breed of viruses (worms named Bropia, Kelvir, Serflog and Crog among other names) is trying to propagate through MSN Messenger and Windows Messenger by automatically initiating file transfers from infected users to possible future victims. A few are SCR-files but most files have a PIF extension (Program Information File). That's a data file in Windows 3.x and NT that stores window settings for DOS applications (In Windows 9x, 2000 and XP, PIF was replaced by the Properties attributes about the file).

Depending on your system configuration and file associations, the transfer shows the classic MS-DOS windows icon (pictured to the right) or an unknown file icon (screenshot below). The PIF extension doesn't always show in the MSN Messenger file transfer dialog, as you can see in the screenshot.

If you receive a file transfer request for such a file, press ALT-D or click Decline. Don't ever execute the file. If you did, delete the file immediately and permanently from your system (My Received Files and C drive) and take necessary security measures starting with an update of the virus definitions of your antivirus software and performing a full scan/clean. Symantec offers a free W32.Bropia Removal Tool which you can download here, but it's designed only to remove a limited number of Bropia variants. The same company has also released the W32.Kelvir Removal Tool (get it here) which removes the infections of W32.Kelvir.D, R, S, T and W.

Sometimes when executing the virus-infected file an image is shown in your browser window. Here are a couple of MSN Display Picture versions of images that have been linked to MSN Messenger worms:

bropia f chicken with tanlines bropia l sexy bropia p pic msn messenger virus msn messenger worm bropia r img