Tuesday, February 19, 2008

Email forwards

Okay...I have received an email from 3 different people in the last week, asking me if the virus they were being warned about was real. I am going to cover this in detail here, because there is an element of truth to it that makes it dangerous. The best scams/hoaxes usually have a little bit of truth in them.

First, here is the text of the email:

I received this from a friend that is in the loop on computer virus issues. Thought I would Forward.
I checked with Norton Anti-Virus, and they are gearing up for this virus!
I checked snopes.com, and it is for real!!
Get this E-mail message sent around to your contacts ASAP.
PLEASE FORWARD THIS WARNING AMONG FRIENDS, FAMILY AND CONTACTS!
You should be alert during the next few days. Do not open any message with an attachment entitled 'POSTCARD,' regardless of who sent it to you. It is a virus which opens A POSTCARD IMAGE, which 'burns' the whole hard disc C of your computer. This virus will be received from someone who has your e-mail address in his/her contact list. This is the reason why you need to send this e-mail to all your contacts. It is better to receive this message 25 times than to receive the virus and open it.
If you receive a mail called' POSTCARD,' even though sent to you by a friend, do not open it.! Shut down your computer immediately.
This is the worst virus announced by CNN. It has been classified by Microsoft as the most destructive virus ever. This virus was discovered by McAfee yesterday, and there is no repair yet for this kind of virus. This virus simply destroys the Zero Sector of the Hard Disc, where the vital information is kept.
COPY THIS E-MAIL, AND SEND IT TO YOUR FRIENDS. REMEMBER: IF YOU SEND IT TO THEM, YOU WILL BENEFIT ALL OF US.

There are a few elements that jump out here as a red flag. Primarily, it violates email Rule #1: the encouragement to send this to all your friends. Rule #1 says that if an email encourages you to send it to everyone you know, do not forward it. Delete it.

For the other elements, I will take them line by line:

"
I received this from a friend that is in the loop on computer virus issues. Thought I would Forward."
Yes, the ambigious reference to the "expert" friend. Your friend was such an expert, he decided to forward an email on to you about a computer virus. Remember Rule #1.

"
I checked with Norton Anti-Virus, and they are gearing up for this virus!"
Here's some news: Norton does not "gear up" for a virus. Norton has a specific procedure in which they identify a virus, discover its characteristics, create a solution based on those characteristics, and post information about it on their website. "Gearing up" is not part of the process.

"
I checked snopes.com, and it is for real!!"
It is pretty common for most hoaxes now to include this line, because snopes is where a lot of people check to see if an email forward is legitimate. So why include it in the email? Because that way people will be less likely to question it - after all, it's been verified, right?

"
Get this E-mail message sent around to your contacts ASAP."
Remember Rule #1.

"
PLEASE FORWARD THIS WARNING AMONG FRIENDS, FAMILY AND CONTACTS!"
Again, Rule #1. The fact that it is written in ALL CAPS means it is even less likely to be legitimate.

"
You should be alert during the next few days."
There are currently over 200,000 viruses in circulation. My opinion is that you should be alert every day. Even better, follow certain email practices that make it almost impossible for your computer to get a virus. More on this in a minute.

"
Do not open any message with an attachment entitled 'POSTCARD,' regardless of who sent it to you."
How about this plan: don't open any attachments, regardless of who sent it to you. The only exception is if you KNOW what the attachment is ahead of time. So if you get an email from your best friend, and the email says, "Hey, check out this cute puppy!" you DON'T open it, because you don't know ahead of time what it is. If your friend's computer has a virus, the virus could have sent that email just to get you to open it. The point is, it doesn't matter if the attachment is called Postcard or any other name - don't open attachments.

"It is a virus which opens A POSTCARD IMAGE, which 'burns' the whole hard disc C of your computer.
"
That's interesting...I wonder how, after the whole hard drive is destroyed, the virus then uses that computer to send itself to all of the email contacts?

"
It is better to receive this message 25 times than to receive the virus and open it."
That is where I disagree. I think I would rather get the virus.

"
If you receive a mail called' POSTCARD,' even though sent to you by a friend, do not open it.! Shut down your computer immediately."
Hey, there's some good technical advice on how to handle a virus: just shut down your computer. Guess what - it will still be there when you turn your computer on again.

"This is the worst virus announced by CNN. "
Not true. CNN did not announce it.

It has been classified by Microsoft as the most destructive virus ever.
Not true. Microsoft does not "classify" viruses.

This virus was discovered by McAfee yesterday
Not true. Notice how the term "yesterday" is used and no date is given - "yesterday" could be any day.

This virus simply destroys the Zero Sector of the Hard Disc, where the vital information is kept.
Wow, with that kind of technical language, this warning must have really come from someone that knows about these things - some kind of Special Expert! Didn't I read a few lines earlier that the virus "burns" the whole C drive? Why would it then have to destroy just a certain sector?

COPY THIS E-MAIL, AND SEND IT TO YOUR FRIENDS. REMEMBER: IF YOU SEND IT TO THEM, YOU WILL BENEFIT ALL OF US.
Here we go back to Rule #1 again.

Are there viruses in circulation? Of course. Should you be careful? Obviously. You should have a good antivirus program (not Norton or McAfee) that is up to date. You should not click on any links in emails, and you should not open attachments.

And if an email tells you to forward it to everyone you know, you should delete it.