The document discusses email viruses and how to identify hoax warnings about viruses. It provides the following key points: 1. Email viruses spread when users click on infected attachments, not just by opening the email itself. The "I Love You" virus spread this way. 2. Hoax warnings about viruses can be identified by ALL CAPS words, excessive exclamation points, and messages telling users to forward the email. Legitimate virus alerts do not ask users to forward warnings. 3. Resources like Symantec and Stiller Research can be used to look up virus warnings and identify hoaxes. Hoaxes outnumber actual new viruses in warnings users receive.

1. E-mail viruses: When Love Kills
With the news about the I Love You worm spreading through the world and forcing mothers to bring their children in off the
streets, we thought you’d like to know one or two things about e-mailed viruses. By Nick Selby.
How Viruses Spread By Email
As the "I Love You" virus which struck at the beginning of May 2000 showed once again, the threat of a virus in
the form of an attachment to an email is very real, and a big pain in the kiester. However, note that it is clicking
on the attachment that creates the problem, not the email itself.
I personally have no clue why it is that people just go ahead and click on something called ILOVEYOU in an
email from an editor - a position uniformly filled by people with a demonstrated inability to love anyone. I
would indeed find the idea of an editor telling me to "click here to see how much I love you" menacing enough
to shut down my computer and proceed to the nearest bar.
But even if the file had been attached to a message from my sainted sister I would have viewed it with suspicion
and virus checked it before opening.
As a colleague, Ed Hasbrouck, points out: "Most security attacks and viruses are directed at - and depend on
interactions between - the most common combinations of software; Windows 9X OS, MSIE 4 or 5 browser, MS
Outlook or Eudora e-mail, and MS Office word processing, spreadsheet, etc. applications.
"The fewer components of this bundle you use, the less vulnerable to the most common attacks and viruses there
are. Viruses that propagate by getting MS-Outlook to launch an MS-Word macro can thrive. No one writes
viruses that depend on using Pegasus Mail to launch a WordPerfect macro, since too small a percentage of
recipients would have that combination, and they wouldn't succeed in spreading."
Note, though, that viruses don’t spread through an email message. You can't "destroy your hard drive" or have
your hard drive eaten by monsters just because you open a message that came with an infected attachment (I
myself opened the message saying "I love you", saw the file and immediately deleted the attachment - easy
peasy).
Some simple steps can prevent your getting infected by a virus.
1. Use a non-standard mail program. Ed and I use Pegasus Mail, a free program that makes Eudora's new 4.3
release look positively clunky. It's free on the web at www.pegasus.usa.com.
2. Be suspicious of any attachments, even from people you trust.
3. Be highly suspicious of attachments that are an executable program (that is, the document ends in ".exe").
4. Be suspicious of and never fail to virus-scan attachments of Microsoft Office documents (Word, Excel, Power
Point, etc) for macro viruses.
5. Be highly suspicious of any attachments that have an unfamiliar extension (the last three characters of the file
name). "I Love You" was attached to a file with a ".vbs" extension. If you've never seen a file extension before,
do one of two things:
a) If it's from someone you know and trust, virus check it using the latest version of your favorite virus scanning
software - and update the virus scanner monthly from the company's website.
b) If it's from someone you don't know or someone you know casually, delete the sucker. Send a message to the
sender saying you did, and if it was something important, ask them to send it again, then repeat step A.
6. Use Macintosh or Linux machines instead of Windows. Okay, okay, that's asking a bit much. But because so
relatively few people use those platforms, virus scares for them are far fewer.
Eaten By Snakes:
Virus Hoaxes and How To Tell What's Real
Every year businesses worldwide spend more money soothing the nerves of employees who’ve received hoax virus warnings
than they do on actual viruses. So before you pass on the note your friend Ned sent you about a new virus that will make
snakes eat your hard drive, give it a little thought.
At the U.S. Department of Energy, a group called the Computer Incident Advisory Capability monitors and debunks phony
virus alerts and chain letters as an integral part of its overall security program - check their site
at http://ciac.llnl.gov/ciac/CIACHoaxes.html.
Rule Number 1: If you see request in an email warning to "Pass it on," you should immediately be highly suspicious of the

2. message.
The fastest way to prove a virus warning is to look it up in Symantec's online hoax and virus
encyclopedia, www.symantec.com/avcenter/vinfodb.html. I entered 'Nokia' at the beginning of May and got three hoax alerts
and no virus alerts (though when I checked they had nothing on I Love You).
Another excellent resource is from Stiller Research, http://www.stiller.com/hoaxes.htm, which lists the top five hoaxes of the
month including, in April 2000, a hoax regarding asbestos being used in tampon production.
Spotting a Hoax
Hoaxes usually include sentences in ALL CAPITAL LETTERS in the subject line and lots of exclamation points!!!!!! They
also have, almost universally, this syntax:
"If you receive an email with a file called ‘Such-and-such’, do not open it. It contains the email virus ‘This and that’ which will
‘do this or that’ your hard drive."
Tosh.
Another type of hoax involves having you forward chain letters on the theory that if you send the email to 1,400 of your closest
email buddies you'll win a free phone, Microsoft stock, Disney tickets, yadda yadda yadda. No one gives you something to
email someone. No one. Not even Nokia.
What to send someone who sends you a "Forward this message and get a free cigar" message? An excellent sample is up
at www.netsquirrel.com/combatkit/emailforward.html