Issue 20 - Hoax-Slayer Newsletter

---

This week in Hoax-Slayer:

• The Great Lottery Scam
• Another ShadowCrew Prank
• UPS Uniform Hoax
• Hotmail Hoax still Going Strong
• Virus Report: Weekly Virus Wrap-Up
• Feedback from Site Visitors
• Tip of the Week: Managing Downloads

---

Over the last few weeks I've noticed a significant increase in the amount of lottery scam emails that have been going around. A number of site visitors have submitted examples that they have received. Several have also provided copies of further correspondence they have had with the scammers, and this has been quite enlightening.

Basically, these scams work like this:

You receive an unsolicited email, which states that you have won a major prize in an international lottery. Supposedly, your email address was collected online and attached to a random number that was subsequently entered in a draw for the lottery. In order to claim your prize, you are instructed to contact the official "agent" in charge of your case. You are also advised to keep the win confidential for "security reasons". This part of the scam is basically a random phishing expedition. If you respond in any way to the email, the scammers will send further messages or even contact you by phone in an attempt to draw you deeper into the scam.

You may be asked to provide banking details, ostensibly to facilitate the transfer of your winnings. Sooner or later, the scammers will request some sort of advance fee supposedly to cover administration, legal or delivery costs. This request for money is the main purpose of the scam. At its core, this scam is just a reworking of the Nigerian loan fraud, in which scammers also eventually ask for upfront fees to facilitate the "deal". Like Nigerian scams, victims who do actually pay the requested fees will probably find that they receive continuing payment demands to cover "unexpected expenses". The requests for money will go on until the victim realizes what is happening or has no further money to send.

The details of the lottery scams vary regularly with regard to the name of the lottery itself, the country of origin, the sponsoring organization, the amount of the "prize" and other particulars. The scammers try to add a patina of legitimacy to their claims by mentioning real financial institutions, government departments or well-known companies. They may also provide links to slick looking, but fraudulent websites that are designed to back up information included in the scam emails. If the scammers are successful in establishing a dialogue with a potential victim, they may provide "proof" such as a scanned image of a supposed government official's ID and even photographs of the "winnings" in cash.

If you receive one of these scam emails, it is important that you do not respond to it in any way. The scammers are likely to act upon any response from those they see as potential victims. Although it can be educational and even entertaining to "bait" these scammers, such endeavours should only be attempted under controlled conditions. The people who run these scams are criminals and could even resort to violence and intimidation to meet their aims.

I am currently gathering together a collection of examples and other information about these lottery scams to be placed on the Hoax-Slayer website. If you have been sent one of these scam emails, I'd be glad to receive a copy.

A typical example of a lottery scam is reproduced below:


Discuss This Story

---

It appears that the Shadow Crew website is yet again the target of pranksters. The latest prank email claims to be a transaction confirmation message for three months access to child pornography. Another child porn email supposedly from Shadowcrew was circulating earlier in the year. These emails are quite similar to a prank email that targeted DarkProfits.com.

At face value the email might seem to be a crude phisher scam in that it requests recipients to send credit card information. Some phisher scammers send emails that detail a fictitious credit card charge and provide a link where recipients can supposedly cancel the transaction. The link leads to a bogus website that requests personal information from the user. However, in this case, a simple email address is provided rather than a link, and different email addresses are used in different instances of the prank email. The email addresses point to customer service webpages belonging to AT&T and I can see no obvious connection to the ShadowCrew website.

While it would certainly be very unwise to send sensitive financial information via email, history suggests that this particular email is more likely to be a hoax than a serious phisher scam. Another prank email was directed at the ShadowCrew site earlier in the year. This email also looked like a phisher scam but was in fact a prank designed to discredit Shadowcrew.com.

An example of one of the current prank emails:

An example of an earlier prank:

Discuss This Story

---

This hoax is currently enjoying a new lease on life. The hoax began circulating in early 2003 and has spawned a number of variations, all equally untrue.

Some versions, including the example below, add a signature that supposedly belongs to Kimberly Bush-Carr of the U.S. Department of Homeland Security. However, these emails did not originate from a government department. The inclusion of an official looking signature is simply a ruse to add credence to the message's spurious claims.

There are several slightly different versions of the UPS Uniform hoax, all referring to large purchases of United Parcel Service uniforms on eBay. However, there have been no reports of large eBay purchases of UPS uniforms, nor have large quantities of uniforms been reported stolen. According to a Washington Post article both eBay and UPS deny the rumour. Investigations by the FBI have debunked the stories of stolen uniforms as nothing more than urban legends. The article also notes that eBay "has barred sales listings of UPS or any other contemporary delivery service uniforms, including airline uniforms".

In a world increasingly concerned with the threat of terrorism, it is not surprising that false alerts like this one are taken seriously and spread so widely.



Discuss This Story

---

Variations of this email have been circulating since 1999 but it is still a common visitor to in-boxes across the world. The information in these messages is completely untrue. Like a lot of hoax emails, this one banks on the fact that many people will hit the "forward" button without analysing the information very deeply. Even if Hotmail was "running out of resources", it would be highly improbable for them to attempt to remedy the problem by asking customers to forward an email. Why would Hotmail employ such a vague, hit and miss method of checking on the status of account holders? If Hotmail really wanted to find out if users still had an active account they would be more likely to send an email that asked for a *reply* within a given time frame rather than request that the message be forwarded. Besides, I'm sure that Hotmail has sophisticated and precise methods of checking the activity levels of a given account that do not require the account holder to reply to *or* forward a specific message.

Although the example below is aimed at Hotmail, variations on the hoax have also targeted Yahoo and AIM instant messaging customers.

Regardless of the version, the best place for these messages is the "Deleted Items" folder.


A Yahoo Example:

Discuss This Story

---

The list below represents some of the most significant new virus threats identified by Symantec Security Response over the last few days.

W32.Netsky.X@mm is yet another Netsky variant and has been afforded a category of 3 out of 5 by Symantec Security Response. The worm searches the infected computer for email addresses and sends itself to them using its own SMTP engine. The subject and attachment names vary, as does the message itself. From lines of the emails are spoofed.

W32.Netsky.Y@mm is a variant of the worm discussed above and has similar characteristics. The subject line of the email will be:
Delivery failure notice (ID-(random number))

There is a new variant of the Blaster worm that can attack unpatched Windows 2000 and XP systems. Ensure that your system is updated as soon as possible.

Discuss This Story

---

Each week a growing number of site visitors have been good enough to submit examples of hoax or scam emails they have received. If you receive a hoax or scam email, I would appreciate it if you would send me a copy.

A reader submitted a copy of the email forward below which she reports has been circulating around various email discussion groups. This sounds very much like a hoax to me. There is nothing on any of the major anti-virus sites about a worm that comes with Incredimail. If it were true, I think it would have been well documented on various AV sites. Also, the message doesn't name the alleged worm, nor does it back up the claim with any checkable reference.

I have contacted Incredimail for a comment on this issue, but they have not as yet replied. If you have received one of these emails, or have some further information to add about them, please let me know.


A lot of submissions this week involve lottery scams, the UPS uniform hoax, and the Hotmail hoax. These are discussed in detail above.

A number of submissions and page views were once again for that classic among virus hoaxes, the Teddy Bear Virus Hoax.

The article about Camel Spiders in Iraq also proved to be a popular page with site visitors.

Discuss This Story

---

For a while now I've been using a system of managing downloads that I feel is quite effective, especially if you download a lot of software.

First of all, I have a parent folder on my C drive that I call "AAADownloads" so that it stays at the top in Windows Explorer for easy access.

Every time I download a program, I create a new sub-folder within this parent folder that has the same name as the software I'm downloading.

Normally I store all the files and folders associated with the software in this sub-folder. I also create a plain text software log for each download that records the following information.

**Name:
**Source:
**Download Date:
**Install Date:
**Installation Report:
**Eula:
**Review:

To save time, I have a template file set up so I can just fill in the blanks and save the resulting file to the new program's sub-folder.

I find that it can be really useful to have all the information and files you need for a program in an easily accessible and well-organized location.

Discuss This Story

---