Hoax Warnings


	Alphabetical Index

NAME:

I'M Your Shadow hoax

This hoax message appeared in Italy during winter 2001. We have no reports about the existance of a described malware. The original hoax message was in Italian, but here is the English translation of it:

 WARNING: please forward as soon as possible to every e-mail
 address you know of! We must be quicker than them. In case the
 contact happens, please notify legal authorities. Let's stop
 them! Please translate in other languages as well....

 If you receive a mail with subject "I'M YOUR SHADOW! PLEASE
 PLEASE DON'T FORGET ME" do not absolutely open it!

 It contains an attachment that will auto-activate when opening
 the mail and inserts itself in the computer without any warning
 to the user, because no window, message or anything else is
 displayed.

 This program allows to anyone to control your own computer,
 exploiting a very dangerous bugs, typically found in almost
 every chat program unbeknownst to many people, sometimes even to
 the program's authors. Indeed, it contains a bug, dependent on
 an operating system's file which manages internet-borne
 communications (even in local intranet networks). The virus
 contains some of the functions used by hackers to penetrate web
 sites e by paedophiles to anonymize themselves over the
 internet. Anyone who connects to the virus program will be able
 to enter Web sites or download and create paedophiliac material
 by using your computer. In this case, you would be held
 responsible, if found out, because the commands sent to the Web
 sites or the download of photos would happen via your computer
 and through your internet connection.

 There have already been cases of people accused of committing
 paedophilia who had nothing to do with that, they were only
 victims of the virus. Furthermore, the program is enabled to use
 your modem for connecting to international provider, making your
 telephone bills grow hugely. This happens in the same instant
 when your program receives the email, even without opening it.
 The virus is not detected by any antivirus and there is no
 remedy so far. Formatting the hard disk doesn't solve the
 problem, because the virus also installs itself in the flash
 bios memory of the motherboard and at every attempt to format
 it, the virus relocates in RAM memory and vice-versa.

 The only solution is to substitute the flash bios and
 base-formatting the hard disk, not before having uninstalled the
 AM [verbatim, I suppose he/she means RAM. fab] for successive
 re-installation. If you receive the email, there's nothing you
 can do. It means that you've already been connected to an
 international provider. The only thing to do is to disconnect,
 turn off modem and computer and disconnect it from the electric
 supply. In case of reboot, the program would re-connect the
 modem to the provider automatically. The worst thing is that the
 phone will be free during this operation, so there will be no
 way to individuate the called provider. If you receive this mail
 turn off computer and moden and call a technical support for
 substituting the bios' flash ROM. The operation must be
 performed in this order:

    1.. disconnect the hard disk's,
    2.. install the new flash bios,
    3.. format the hard disk on another computer,
    4.. re-install the hard disk.

 As for the calls to the international provider, nothing can be
 done. By now, the costs will have already been charged. These
 are the costs for an international connection: 3000 at response,
 2560 per minute for the first 2 minutes, 5000 after the first 3
 minutes. During the email download, about 500 connections are
 established, and a response charge for every one.

 This information has been passed by Microsoft Please diffuse it
 to everyone you know, because the virus auto-sends itself to
 every person you have in the contacts, so if you have received
 the email, they surely have it too. It is important to warn all
 those people who connect to the internet often, because 500
 connections per second are established for each connection to
 internet. So in one hour, you would not pay the normal 2000
 liras of the urban call, but 360.000 for an international call.
 Therefore you're encouraged to warn them.

Please ignore this hoax message if you receive it and don't pass it on.

[Translation from Italian: Fabrizio Cassoni; February 2001]