Family post card virus -- a hoax?

[Paul Brady]

A few days ago, I received email from a friend who had forward a
message to her whole mailing list. This message said that there is a
new deadly virus, discovered by McAfee, that sends you email with the
title:
You have received a post card from a family member.
If you open this email, your sector zero will be destroyed and
your computer will be useless.

Well, I haven't received this message. I am on AOL, perhaps it gets
filtered out. But what interests me is that I have seen no mention of
it in this newsgroup. Is this a hoax?
Thanks. Pete

 

[Gabriele Neukam]

You have received a post card from a family member.
If you open this email, your sector zero will be destroyed and
your computer will be useless.

Your machine will not be destroyed, but brought under external control.
It is questionable whether this is much better.

This mail subject is very probably a message from the Storm Worm, see
http://isc.sans.org/diary.html?storyid=3117 and
http://isc.sans.org/diary.html?storyid=3298

You should at least not click on the link (always an IP number), else
the page (when active) will try to exploit vulnerabilities and tell you
that your message must be downloaded. The click on the next link
(actually an executable file) will run it, and the exe will download
and install trojans on your computer and turn it into a "zombie" ie
something that waits for commands from outside and fulfil whatever the
machine is asked for.


Gabriele Neukam

(e-mail address removed)

--

Is there such a thing as a Honeymoon period in a new newsgroup?

(Roger Hunt in uk.comp.vintage)
In a want it now instantly straight away world - no
(Krustov in ucv)

 

[FredW]

Paul Brady explained on 26-8-2007 :

A few days ago, I received email from a friend who had forward a
message to her whole mailing list.

That is typical of a hoax (sending to a whole mailing list).

This message said that there is a
new deadly virus, discovered by McAfee, that sends you email with the

Words about a "new deadly virus" will *never* be spread by
an email (and not at all to someone like your friend).
Of course this is a hoax.

Did her email tell you to forward this message to everyone
in your mailing list?
That is also typical of a hoax.

Is this a hoax?

I rest my case.
;-)

 

[Paul Brady]

That is typical of a hoax (sending to a whole mailing list).



Words about a "new deadly virus" will *never* be spread by
an email (and not at all to someone like your friend).
Of course this is a hoax.

Did her email tell you to forward this message to everyone
in your mailing list?
That is also typical of a hoax.


I rest my case.

Thanks for your reply. This reminds me of the "teddy bear" hoax a few
years back when message said that you may be infected if you have
some sort of file in the system directory with a teddy bear as a icon,
and urged you to delete it, as many people did. Of course it was
there, it came with Windows. I recall that it was a relatively unused
file involving Java scripts.

 

[FredW]

Thanks for your reply. This reminds me of the "teddy bear" hoax a few
years back when message said that you may be infected if you have
some sort of file in the system directory with a teddy bear as a icon,
and urged you to delete it, as many people did. Of course it was
there, it came with Windows. I recall that it was a relatively unused
file involving Java scripts.

Yes, that was the "Bugbear/Jdbgmgr.exe" hoax.
:-D

 

[Beauregard T. Shagnasty]

Paul Brady explained on 26-8-2007 :

That is typical of a hoax (sending to a whole mailing list).

[restore snipped text]
title:
You have received a post card from a family member.

Words about a "new deadly virus" will *never* be spread by an email
(and not at all to someone like your friend). Of course this is a
hoax.

Did her email tell you to forward this message to everyone in your
mailing list? That is also typical of a hoax.


I rest my case.
;-)

Apparently, Fred, you haven't received any of the "greeting card" emails
yet.

It is not a hoax. If you click on the proffered link to get your
"greeting card", and if you are running an insecure computer (using an
insecure operating system component that pretends to be a browser), your
computer will soon become a zombie.

There are variations of the subject and text:

"You have received a post card from a family member."
"You have received a post card from a classmate."
"You have received a greeting card from a friend."
etc.

All have a link consisting of an IP address and a subdirectory. Probably
the IP of the *last* person who clicked to get *his* greeting card.

 

[Duh_OZ]

On Aug 26, 4:58 pm, "Beauregard T. Shagnasty"

Apparently, Fred, you haven't received any of the "greeting card" emails
yet.

It is not a hoax. If you click on the proffered link to get your
"greeting card", and if you are running an insecure computer (using an
insecure operating system component that pretends to be a browser), your
computer will soon become a zombie.

There are variations of the subject and text:

"You have received a post card from a family member."
"You have received a post card from a classmate."
"You have received a greeting card from a friend."
etc.

The "hook" has seem to have switched to a "morphed" youtube clip.
Not really a clip, but a download, the same as the greeting card
ones. I have been getting about 2x youtube e-mails over the greeting
card ones.

 

[Fenton]

A few days ago, I received email from a friend who had forward a
message to her whole mailing list. This message said that there is a
new deadly virus, discovered by McAfee, that sends you email with the
title:
You have received a post card from a family member.
If you open this email, your sector zero will be destroyed and
your computer will be useless.

Well, I haven't received this message. I am on AOL, perhaps it gets
filtered out. But what interests me is that I have seen no mention of
it in this newsgroup. Is this a hoax?
Thanks. Pete

These kinds of things are both hoaxes and real at the same time.

Typically any and all malware whose warnings circulate via e-mail between
friends, will destroy your computer, and was "just discovered this morning",
is a hoax, insofar as it's not a specific problem.

HOWEVER, greeting card and otherwise socially friendly e-mails are not
uncommon forms of distribution of invitations to click a link and thereby
become infected by something nefarious.

 

[Offbreed]

Well, I haven't received this message. I am on AOL, perhaps it gets
filtered out. But what interests me is that I have seen no mention of
it in this newsgroup. Is this a hoax?

Covered very well by someone else. Mass mailings of something exciting
or terrible are usually a hoax, no matter what the subject. A real PITA
as the addresses pile up and eventually reach a compromised machine
where all those addresses get harvested and sold to spammers and malware
distributors.

On the other hand, people here and in other groups discussing malware
have discussed email asking you to click on a link. From what they say,
it can be anything, from simple spam, through a phishing scheme, to a
compromised site that will dump malware in your computer if you are
vulnerable.

If you figure you just have to click on it, try to verify with the
person who was supposed to have sent it. Otherwise, do a google search
on the subject line, in quotes so you are searching on the phrase.

Most here just delete the email. The odds are overwhelming that it's
something bad or useless.

 

[FredW]

Beauregard T. Shagnasty formulated the question :

Paul Brady explained on 26-8-2007 :

That is typical of a hoax (sending to a whole mailing list).

[restore snipped text]
title:
You have received a post card from a family member.

Words about a "new deadly virus" will *never* be spread by an email
(and not at all to someone like your friend). Of course this is a
hoax.

Did her email tell you to forward this message to everyone in your
mailing list? That is also typical of a hoax.


I rest my case.
;-)

Apparently, Fred, you haven't received any of the "greeting card" emails
yet.

It is not a hoax.

Yes, the message from the friend is a hoax.

"This message said that there is a new deadly virus, discovered by
"McAfee, that sends you email with the ...."

McAfee (and any other company) never sends warnings by email
about a "new deadly virus".

So the message of OP is a hoax.

However ......... at the same time!!
"Greeting card" emails are sent with malware.
And yes, these emails are to be handled very carefully.

So, someone is sending a hoax, referring to the real
greeting card emails with malware.

If an email contains something about "a new deadly virus",
and mentions "McAfee/Norton/[any av supplier] ....."
chances are 99% the message is a hoax.

;-)