How to open an email attachment safely
An invoice, a statement, “your parcel documents” — email attachments are the most common way computers get infected. Here is which files are dangerous, how they are disguised, and how to view a document without taking needless risks.
Which attachments are dangerous
- Programs and scripts:
.exe,.scr,.msi,.bat,.js,.vbs. Ordinary work email almost never contains them. - Archives and disk images:
.zip,.rar,.7z,.iso— there may be a program inside. - Documents with macros:
.docm,.xlsmand any Office file that asks you to click “Enable Content”. .htmland.htmfiles: often a fake sign-in page for your email or bank.
How viruses are disguised
- A double extension:
invoice.pdf.exe. Windows hides extensions by default, so you only seeinvoice.pdf. Turn them on: in File Explorer, under View, tick “File name extensions”. - A PDF or Word icon on a file that is really a program.
- Urgency in the text: “pay today”, “your parcel will be returned”, “your account is locked”.
- A sender address that only looks familiar: an extra letter, a different domain.
Before you open it
Not expecting this email? Check with the sender another way: call them or message them. Never click “Enable Content” or “Enable Editing” in a document from an email: that is the button that runs macros.
View the document in your browser
Save the attachment and drop it on OsonKit. PDF, Word, Excel, PowerPoint and other documents open right in your browser instead of in a program on your computer:
- macros do not run — a browser simply cannot run them;
- scripts inside a PDF are not run;
- external images and resources in the document are not loaded, so the sender cannot learn from them that you opened the file;
- the file is read on your device and sent nowhere.
OsonKit is not an antivirus and does not scan files for threats. It only shows the content without running it. If a document asks you to follow a link and enter a password, do not — however harmless the file looks.
If you have already opened a suspicious file
- Scan your computer with an antivirus — on Windows, the built-in Windows Security will do.
- Change your email and bank passwords from another, clean device.
- If it is a work computer, tell your IT department right away.