Client sent a virus

[khurram_sh44]

The client firstly texted me on Upwork about the project that he needs NodeJS developer (I had submitted him my proposal before). When he texted me I saw his proposals ratio was more than 50+ proposals and when I refreshed the job post after a while it were less than 5 and interviewing 0 although he had been in chat with me.

He sent me the link to download the file and check the requirements. He sent .rar file via external link. I downloaded the file to check job description. The file had .SCR extension file wih name written as requirements.SCR. I had no idea that it is a malware I clicked it as it was showing PDF format icon. Nothing happened but after sometime the system responded the file is either corrupt or damaged but I could see the file was 750+ MB. I got worried that how a PDF can be of this much size. I googled how to open .SCR and google responded "How to get rid of .SCR virus". I instantly deleted the file and has been running antivirus scans throughout. But I think my device has been compromised because it's speed has suddenly fallen down. However, please block such people on Upwork as they are real damage to someone's hard earned profile and money.

[NikolaS]

Hi Khurram,

Thank you for reaching out to us. I shared your report with our team and one of our agents already reached out to you directly via a support ticket to assist you further. You can access your ticket on this page.

[harsar]

Hey, I just got a similar message from the client. Luckily I am using Linux and the requirements.scr file didn't open in my system 🙂

here is what the user sent

**Edited for Community Guidelines**

Actually, I am new to Upwork, and it requested me to pass even Identity verification with my Passport, so I never thought that such issues may exist here, when some not verified user will send the link with the virus.

Could you please block/remove the user who sent me that message from Upwork?

Thanks,
Harut

[NikolaS]

Hi Harut,

Thank you for reaching out to us. Could you please click on my name and send me a PM with more information about the client and the messages you are referring to? I will be sure to look into your report and escalate it accordingly.

[harsar]

Hi Nikola,

Sent you a private message with more details.

Thanks,
Harut

[25005175]

You're not the first to get hit by this kind of thing. Search "virus" in the community and you'll find a depressingly large number of posts.

In the future, practice good data/security hygiene by running any downloaded file through an anti-malware program before opening it. Upwork's built-in scanning software can't detect/deactivate stuff that's condensed/encrypted in the compressed folder formats like .7z, .rar, and .zip

[c4e453ac]

How many clients send compressed files? IMO, it's safer to ban particular file extensions as mitigation in preventing this kind of thing happening. By not doing this, it encourages scammers because they can send any filetype. 

[25005175]

In my line of work (CAD/Engineering), people regularly send packets of files that are compressible. Especially image files, which are data-heavy. Lots of sketches, screenshots, photos of prototypes and existing products.

ETA: plus, compressed/zipped folders are the only way to nicely send a group of files so that the recipient doesn't need to download each file individually.

[the-right-writer]

Agreed. The problem isn't the files, it is that people blindly click on anything.

[williamtcooper]

Khurram,

Never click on anything that a Prospect sends. It's against Upwork's Terms of Service and it's there to protect you. Have a great day!

[25005175]

William, that's not against the ToS. If it was, Upwork wouldn't even allow them to attach documents to the job posting.

[fb2b30a4]

Hello, the same thing just happened to me now. A client just sent me a file which I extracted and it has

requirement.scr. I just tried to open it but it failed. My pc has been running slow. How do I get rid of this trojan?

[ducnm2]

**Edited for Community Guidelines**

Same, but I'm using linux and only use windows VM to check.
Their scam job post link: **Edited for Community Guidelines**

[ArjayM]

Hi Duc,

Thank you for reaching out and reporting this here in the Community. Some content of your post needs to be removed because any content (which includes downloadable links, third-party apps, and extensions) is deemed to be inappropriate for this forum. 

I've shared your report with the appropriate team for further review. They will surely look into this and take action accordingly to ensure that your account information stays secure. For an overview of online safety and security best practices, please visit our Security Center or check out our complete online security series below.

1. General Electronic Security
2. Staying Safe on Upwork
3. Detect Malware
4. Getting Rid of Malware — You are here
5. Secure a Compromised Account

We also encourage you to let us know if you find anything suspicious has happened by using the Flag as Inappropriate option throughout the platform. You can learn more about user reporting here. I hope this helps. 

[b01a827d]

Hi,
I had exact experience today with a cliend messaged me and asked for facebook ad and asked my email to send me the project files and he said it's a windows desktop winnar file, I use Mac OS the file didn’t show anything for me on my computer so I tried to open the file in a windows computer and the files was exe and the computer doesn’t open the file and erorred with the text that said virus action.

[4ca3158c]

The client sent a virus

The client first sends an offer to me for Social Media Marketing service. She also texted me I saw his proposals and accepted but she sent me an email that attached a .rar file for the project details through an external link which contains a .exe file along with a PPP file. I subconsciously clicked and opened both files but after a second while I understood that those files contained viruses by that time I also checked her profile I saw she had been a Member since Aug 25, 2023 This time she hired 9 and all 9 were active but she spent nothing. I instantly deleted the file and has been running antivirus scans throughout and notifying me for viruses. But I think my device has been compromised because its speed has suddenly fallen down. However, please block such people on Upwork as they are real damage to someone's hard-earned profile and money.

**Edited for Community Guidelines**

[759e32fa]

Hi Sarkar,

I'm sorry to hear about your experience. We understand how important it is to keep your account and any information in your computer safe. We recommend checking the resources here for more information on how you can stay safe on Upwork.

Also, we highly suggest reviewing our ToS, reading these tips on how to avoid questionable jobs, and this post from our Community member, Wes, about top red flags for scams for you to keep yourself safe in the marketplace. Should you also encounter any suspicious user activity again in the future, please send us a flag so the dedicated team can review it and take action as soon as possible.

[the-right-writer]

In addition to what Annie Jane told you, get a virus and malware program. No one should be online without one, and certainly for people who are opening random files from strangers on the Internet.

You will still need to check the file thoroughly, but then you scan the file before opening it. There is no substitute for caution and a good quality virus/malware program.

[46568c33]

This happened today to me as well. The client sent a .rar file consisting a screen saver (.scr) file. Upon opening the file a pdf opened up from the User folder in C: drive. That's when I knew it was a scam. I'm literally new to this platform and freelancing and this would be the first freelance experience to have. Kinda disappointed. Now the whole system will need to be reinstalled with everything to be started from scratch.

[imrana_jabeen]

I also had a simillar experience right now. Luckily i did not open the scr file. I hope everything will be okay. But please upwork should filter out such clients.

this the link they sent me 

**Edited for community guidelines**

[e335db43]

I received the same .scr file today. Not sure what to do next. 

[spectralua]

Delete file. Report scamer. Block his.

[tjmisny]

Another reason why we need clients to be vetted on Upwork.  I'm sorry you had to deal with this scumbag!

[5411a4b5]

I just received a similar file containing .scr within a .rar file. Thankfully I did research before opening the files. I have flagged the job post as inappropriate but still I would share Job Post and client name here so that he can be removed from Upwork Immediately.

Job Post:

**Edited for Community Guidelines**

Client Name:

**Edited for Community Guidelines**

**Edited for Community Guidelines**

Please help him remove at once.

Thanks.

[f2a0ea15]

The exact same thing happened to me. It was a job posting for an iOS mobile developer and they sent me a rar file. Inside was a .src file which I couldn't open somehow. I think it was a virus.

How can I tell if my device is infected?

Can UpWork officials help with this?

[NikolaS]

Hi Eray,

I’ve escalated your community post to a support ticket. One of our agents will be in touch with you soon to assist.