Issue 14 - Hoax-Slayer Newsletter

---

This week in Hoax-Slayer:

• High Rates of Virus Activity
• Prank email targets Shadowcrew.com
• WTC Survivor Virus Hoax
• Virus Remover Information Page
• NASA and the Zero Gravity Pens

---

There have been exceptionally high rates of virus activity over the last week or so. New variants of Netsky, Beagle and MyDoom have been hitting inboxes hard.

This is a time to be especially vigilant. Some of the messages carrying the viruses are quite clever in the way they try to trick recipients into clicking on the attachments. The emails carrying the worms use a large variety of messages, subject lines and attachment names, combined in a number of different ways. Some pretend to be notification emails from companies such as Yahoo, and ask that you click on the attachment for more information. To add a patina of legitimacy, some even inform recipients that they will need a password to access the attachment. In an absurd twist, this supposed "password" is actually included in the email. An example of just one of these virus-bearing emails is included below.

These worms may spoof email addresses, which means you may think you are receiving an email from someone you know and trust, when in fact they never sent it at all. The spoofing tactic causes a lot of confusion and unnecessary finger pointing among those who don't understand how it works.

Simply put, spoofing as it relates to virus dissemination, works like this:

1. Someone who has your email address stored somewhere on her or his computer, becomes infected by a worm that uses spoofing.
   
2. The worm collects all the email addresses on the infected computer, including yours, and sends itself to them.
   
3. The worm inserts one of the email addresses it finds in the FROM: line of the virus emails it sends. In other words, it may use YOUR address in the FROM line, which tricks recipients into thinking that the virus came from YOUR computer.
   

Thus, even though you may practice safe computing and have a virus free machine, you may be unfairly accused of spreading the virus.

Right now, it is even more important to make sure your anti-virus software is up-to-date. Furthermore, treat any email with an attachment as suspect until proven otherwise.

If you don't have anti-virus software installed, then I would strongly suggest that you get some as soon as possible. You can download a quite adequate free virus scanner from Grisoft (AVG).

You can also conduct a comprehensive online virus scan at Panda Active Scan.

To read in depth information about these new worms, visit
Symantec Security Response.

Example:

---

The hapless crew at Shadowcrew.com have been the target of a variety of prank emails designed to damage their reputation and generally cause confusion. The email below was submitted by a Hoax-Slayer site visitor and claims that the recipient's credit card has been charged for the purchase of Viagra tablets. Shadowcrew.com is not in the business of selling Viagra, nor are they responsible for peddling child pornography, as implied in the second example below.

Another prank email aimed at Shadowcrew claims to be an account suspension message from eBay.

The reasons for these malicious attacks on the website are unclear. I have been unable to access the shadowcrew.com website, which may have been taken down.

Viagra Prank Email:


Child Porn Email:

---

In spite of its age, the WTC Survivor virus hoax is still one of the most widely distributed email hoaxes on the Internet. It originally began circulation not long after the tragedy of 9/11. It disgusts me that the perpetrators of this hoax could use such a profound human tragedy to add weight to their pointless nonsense.

There is not, nor has there ever been a virus like the one described in the email.

There are several, equally nonsensical, versions of this hoax, including one rendered in Spanish.

You can confirm the status of this hoax email at the Symantec Website.



A more current version of the hoax is included below:

---

Mike from MikesWhatsNews has created a very handy page that lists a variety of virus removal tools from different AV companies. This is a good page to bookmark for handy reference.

You can check out Mike's excellent Virus removers page here: http://www3.telus.net/mikebike/Virus_Removers.htm

---

This old joke/hoax has been spotted doing the rounds again. Government departments might be pretty wasteful at times, but NASA did not spend $12 billion on a pen.

---

---