Having realised that WSF files are less likely to be blocked by anti-malware programmes, ransomware campaigns using the extension type have massively jumped in recent months.
Basic emaii safety:
Turn on 'view file extensions' in the windows operating system.
Control Panel=> Folder Options/File Explorer Options (depending on Win Ver) =>View Tab - Uncheck 'Hide Extensions for known file types'
The extension of a file is a dot and usually three letters at the end of a file name. the extension tells the machine what to open the file with.
Learn executable file extensions http://fileinfo.com/filetypes/executable
(not safe, for sure)
and alternatively, those that are certainly safe:http://answers.microsoft.com/en-us/protect/forum/mse-protect_start/comprehensive-list-of-safe-file-extensions/e5098d50-f6c2-4459-87dd-4d7787659954
Everything else is at the minimum, questionable.
NEVER open an executable attachment!!! Always save to disk and run antivirus on the file, or better yet, just ignore it entirely.
Remember only the extension at the end of the LAST dot is the true extension.
filename.doc is a word document
filename.doc.exe is an executable program.
This is why you make sure you can see file extensions, otherwise the operating system is hiding the last dot and extension:
filename.doc.exe is an executable program. if your machine is hiding extensions it will look like:
filename.doc which looks like a word document.
Even a .doc or .xls (typical MSOffice document extensions) can contain script and macros. Office will ask if you want to run the script or macro after execution, upon which say, NO. cancel out of the document and go get instruction by phone as to what and whether the script.macro is safe.
If you must send office documents with script or macros in them get in the habit (along with all your friends and colleagues) of either shipping such a thing in a zipfile (with a text file included to explain the macro) or rename the file before attachment - something like filename.do_ filename.xl_ or filename.ex_ (I'm a tech, and this convention is regularly used among my colleagues to quickly ship executables)... Of course the file would have to be saved to disk and renamed to be functional... and while you are at it, a virus scan is usually just a RClick away.
Learning how to zip files is super easy and free - saves all sorts of clutter problems (multiple files can be zipped into a single container file). And you can easily pwd protect the zipfile... if your friends know the password you use, then they can readily confirm the file actually came from you, thus limiting the chance of a spoofed email containing a virulent component.
Links in emails can be spoofed super easy. Get in the habit of looking for the translated (read honest) link, hover over the supplied link and compare it to the actual link, usually supplied by your browser or email client - usually in the bottom left corner. if it is different than the supplied address in the email, chances are, it ain't good.
ANY legitimate agency or business will never send a mail requesting a reply with sensitive information, especially your bank. If you get such, do not send. call the agency or business in question (not using any number provided by the suspect mail), using a verified number, and inquire personally.
Never trust ANY mail, even if it is from your own mother. many viruses replicate by sending itself to people in the infected machine's email list.
ALWAYS, ALWAYS, ALWAYS... when in doubt, DON"T CLICK IT. Call someone on the phone and verify. The machine you save may be your own.