Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am curious -- when the ShoppyBag virus gets sent to you from a compromised "friend", inside the message is a secret one-pixel IMG unique to your email address --- and when your GMail message pulls up the message and the IMG is loaded from their server and displayed, their server knows you have read the message.

At that moment, does it then grab your Gmail address book, the Flash Cookies, and all the Local Shared Objects it can find, i.e. at the instant you READ the message with the ShoppyBag virus, is it already too late?

Do you have to Delete it to the Trash , then Delete Forever it , without reading it

to be safe?

share|improve this question

ShoppyBag is not a virus. It is a social-networking / shopping site.

They use the Google API to import your list of contacts and then send email to all of them inviting them. It's sort of like a chain letter, except that to send it out all you have to do is click 'agree' a couple of times.

As for the secret 1 pixel image, this is a known way that they can determine if you've opened the email, but ONLY if your email client loads images in emails, which Gmail does not by default. I don't know of any way they can get your cookies, though it's possible there's some javascript in the email HTML to do something along these lines. I wouldn't worry about it too much - they can't access all your cookies.

Best thing to do with shoppybag emails is ignore em. Delete em if you want, but there's no real need.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .