From the HelpCenter

E-Mail Hoaxes
What threats are real

Jane DelFavero and Tracey Losco

E-mail hoaxes of this type have been around for quite a while. They usually contain a warning message that tells you not to open any message with a certain subject line because if you open it, a virus will be unleashed that will destroy your hard-drive and your life. The viruses are named after the supposedly tainted subjects, with names like "Irina," "Good Times," "Join the Crew" and "Returned or Unable to Deliver." Once we could advise you to just ignore and delete these messages and go on with your life. It was impossible for viruses to be carried via e-mail because viruses are programs and e-mail messages are plain text (see vil.nai.com/VIL/hoaxes.asp for a list of known hoaxes).

If the threat is so small, then why do people forward these messages? To some degree, they are fearful that computers can do things that they have no control over and they want to protect their friends from this threat. Partly, they believe that people in authority know more than they do, even if that person is not a virus expert (see www.vmyths.com/fas/fas1.cfm for an interesting discussion of "False Authority Syndrome"). This fear and misinformation, however, prevents them from seeing the real threat and handling it effectively.

With the increased use of attachments, the threat of viruses spread through e-mail has become real. Like any other program file, viruses can be transmitted as an attachment to an e-mail message. However, you would still have to open or run the file in order for it to do anything to your hard drive. This could happen quite easily: A friend of yours creates a document in Word (which unbeknownst to him is infected with a macro virus), then attaches the infected document to an e-mail message he sends to you. If you do nothing with the attachment (even if your e-mail software automatically decodes it), the virus will have no effect. If, however, you open the file with Word, or copy that file to a disk and open it with Word on another machine, that machine will be infected. This unintentional infection is much more common than the malicious virus described in the typical hoax message. It is therefore a good idea to scan all attachments that you get before opening them. Never run a program file that you receive without first checking it. (See the next section for information on virus checking.)

Another variety of e-mail hoax is the all-purpose chain letter. Below is an example:

Be suspicious of any e-mail that instructs you to forward it to everyone you know. This is usually the first sign of a hoax and is reminiscent of the chain letters that used to be propagated through snail mail. Forwarding hoax messages such as these only serves to waste bandwidth and annoy your friends.

Real virus and security warnings come from places such as the CIAC (the Computer Incident Advisory Capability arm of the US Department of Energy). Their web site, HoaxBusters.ciac.org , has a great compendium of hoaxes past and present. Be careful of any warning that purports to come from the FCC (Federal Communications Commission). They do not issue virus warnings and never have. Also beware of any message that has been forwarded so many times that there is no way of verifying who originally sent it. There should always be a name and phone number that you can use to check the truth of the message. Many valid messages also use security features such as PGP signatures so that the sender can be verified.

Among the flurry of e-mail hoaxes there lies the real possibility of contracting a virus through an e-mail attachment. Most times this is not done intentionally or maliciously, as the hoaxes would have you believe. What is important is that you break the cycle of transmission by being aware of how viruses affect your computer and common signals of infection.

How to Handle a Real Virus

Another typical trait of a computer virus would be the mysterious disappearance of your C: drive. Everything was fine the last time you used your computer, but one day you turn it on and you get a message telling you that it can't find its C: drive. Freezing and crashing for no reason at all is cause to worry, as are documents that suddenly increase in size daily without your having changed anything in them.

If strange things start happening on your computer, but you're not sure whether you have a virus or not, don't panic. The first thing that you should do is run virus software on the questionable document or machine. If you don't have virus software, you can take a bad disk to an ACF lab and ask someone there to check it.

There are many ways to protect yourself from contracting a virus, so that you can hope to never experience any of these problems. The first thing that you can do is purchase a virus protection application and update it regularly. Remember, a virus checking program is only as good as it is current. New viruses appear all the time, so be sure to find out how to receive any updates. If you're extremely worried about contracting a virus, do not share disks with other people. If you have to share disks with someone else, always scan that disk before using it on your machine. Make sure that you don't open applications or files that are e-mailed to you, unless you are expecting them and you scan them first.

Even though you take all of these precautions, you may still end up with a virus. As new anti-virus software is created, new viruses emerge which have never been encountered before, thereby creating new waves of viruses necessitating the creation of new software. This is indeed a vicious circle, and you may find yourself in the middle of it.

If you do find that you have a virus, don't use the infected disk on any other machines. Immediately run a virus application on the infected information. If you find that the virus has damaged any of your files, you can try data file reconstitution with virus software. If the virus has damaged any of your software, you may have to reinstall the software. And, in the worst of all possible situations, if you have run anti-virus software and you are still having problems with your machine, you may have to reinstall your operating system. If you have done this and you are still having problems, your final option would be to reformat your drive and reinstall all your software.

For those of you without anti-virus software, some good tools to know about are Virex and McAfee's VirusScan for the Mac; and McAfee's VirusScan and ScanPM, F-Prot and Norton AntiVirus for the PC.

Norton Disk Doctor (available for all platforms) can be used to scan for errors in files and directory structures and to scan the hard drive for physical errors. Norton can fix many of the problems it finds, and can also be used to unerase files that were deleted by a virus. Norton may be a good place to start if your operating system cannot recognize the normal startup disk, since most versions include an emergency startup disk or CD. Scandisk for Windows95 and Fdisk can also check to see if there are any problems on your hard disk.

Disk First Aid, part of the MacOS, can be found on the system CD or on a floppy called "Disk Tools." It can be used like Norton to repair disk problems or to start the machine when the normal startup disk does not work. Another good Mac tool is the shareware product Tech Tool. This can perform basic system maintenance, such as resetting ("zapping") PRAM and rebuilding the desktop. BBedit, a text editor, can open almost any formatted file on a Mac or PC, even files with formatting information that has been damaged by a virus. Or, you can use the Notepad or other simple text editors to try and open any problematic documents.

As always, the best defense is preparation. Back up your important documents regularly, preferably in more than one place. Buy virus checking and disk maintenance utilities and use them regularly.

Safe computing, everyone!

Posted May 18,1998