Home Office: Stop E-Mail Hoaxes in Their Tracks

Steve Bass

Last week I was kvetching about receiving way too many e-mail hoaxes. Friends forward them to either keep me informed (yeah, right, Bill Gates is going to send me $100 if I say something nice about him), or ask me if it's a true story. Talk about gullible: One guy, a member of the users group, actually sent me that silly one from the Nigerian king who's itching to deposit 5 million bucks in my bank account. (Although after the deposit, I'll bet I'd get a little bit more respect from my bank.)

This week I'll tell you about hoaxes that can harm your PC--never mind your ego--and a few ways to sidestep being duped.

Want to feel a little dazed and confused? A bunch of unhinged kids are sending e-mails that pretend to help you remove a worm or virus, or provide a terrific hack, but actually plant a virus or worm on your system. On top of that, there's one virus that may--or may not--really be able to infect you.

Klez.E Worm Immunity Hoax

You've heard of the Klez worm, right? (Well, you should have--it seems millions of computers have been infected with Klez...) Just in case, read "Klez Worm Continues to Spread."

What's happening now is some miscreant created an antivirus scam--an alleged immunity for the Klez worm. The message (see it below) has "Class.bat" attached to it, which isn't a batch file at all. It's a Visual Basic program with the Klez Worm built in. Click on "Class.bat" and zap, you're infected with Klez.

I want to make sure you understand what's happening. So, folks, read this carefully: The "free immunity tool" is the scam because the free tool actually contains the Klez worm. The message is made to look authentic, which is why I said it's an antivirus scam.

---------start of antivirus scam message---------

Subject: Worm Klez.E immunity

Date: Thu, 09 May 2002 05:17:17-0700

Klez.E is the most common world-wide spreading worm. It's very dangerous by corrupting your files. Because of its very smart stealth and anti-anti-virus technic [sic], most common AV software can't detect or clean it.

We developed this free immunity tool to defeat the malicious virus. You only need to run this tool once, and then Klez will never come into your PC. NOTE: Because this tool acts as a fake Klez to fool the real worm, some AV monitor maybe cry when you run it. If so, Ignore the warning, and select 'continue'. If you have any question, please mail to me.

---------end of antivirus scam message---------

The above message is a scam. If you get it, don't follow the advice. Just delete the message and its attachment.

If you do happen to pick up Klez, it's not all that difficult to disinfect your computer. Grab a copy of Symantec's W32.Klez Removal Tool.

Cool Spot

You know how much I like Google, right? (You say you don't? Read my raves, "Tips for Super Smart Web Searches" and "Home Office: The Skinny on Web Searching.")

Google is opening new search doors with a variety of cool tools. A Google "set" lets you type two or three related words, say, lettuce, cucumber, and tomato, and Google's Set feature gives you a list of predicted items--a long list of vegetables. Click any item to begin a traditional Google search. There's also a voice search that lets you call Google by phone (really), and a series of keyboard shortcuts. Check out the new features at Google Labs.

Dig this: I love a good conspiracy theory. I ran across a neat one--a site that found on the new $20 bills (otherwise known as Yuppie food stamps) hidden pictures of the World Trade Center and Pentagon attacks.

More Hoaxes. Or Not

W32.Perrun virus: It's a virus. It's not. No, it is. Well, uh, maybe it might be. McAfee said the virus was embedded in JPEGs--image files--but there's been lots of controversy. My take? Even with about 5000 people on assorted private lists I moderate, I haven't had one report of it. Read the hullabaloo in "Veracity of JPEG Virus Questioned" on Symantec's Web site.

EMU_xbox.exe: Want a way to emulate an Xbox game on your PC? Easy enough-just download the emulator and you're good to go. Oops, wait, nothing happened when you tried loading the emulator! Read "Fake Xbox Emulator Hid Trojan Horse" for the whole story.

Hoax Protection

Over the years, I've doled out advice to help keep user group members from falling for hoaxes. Here are a few of my best tips.

• Watch for forwarded messages with warnings, proclamations, dreadfully worrisome stories, or financial giveaways.
• If a message has lots of words in capital letters and you see more than one or two exclamation points, it's a sure sign the message is a hoax.
• It's as inevitable as a Win 98 crash that you'll receive a message warning you of a virus or worm. Some of these warnings sound so plausible--especially with so many new viruses popping up--that'll you'll be tempted to act on the message's instructions. Or you'll forward it to EVERYONE YOU KNOW!!! (Forward the one you saved for me directly to my editor. Thanks.)

If you suspect that a message is a hoax, the best thing to do is to check any antivirus site--or one of the sites listed below--to see if your message is mentioned.

• Sophos Virus Info: Hoaxes and Scares
• TruthOrFiction.com
• About.com: Urban Legends and Folklore
• Snopes.com: Urban Legends Reference Page

You could also take one or two key words from the message and search on Google. Chances are good that Google may find that it's a hoax or urban myth. For instance, enter "Christopher John Mineo" (with the quotes), or "nigerian government official" in the search field. Really, try it--you'll be surprised.

Dig this: Did you like that last conspiracy site? I have another, and it's a doozy. Basically, the site provides an amazing display of how powerful people appear to run the country. Check it out... unless you're already experiencing paranoid delusions, in which case avoid the site, okay?

Sign up to have Steve Bass's Home Office Newsletter e-mailed to you each week.