Beware virus hoaxes

Thanks for clicking on this story.

If you’re reading this, it’s already too late. A self-extracting virus has been transferred to your computer, and even as you ponder what to do next, the bug is indiscriminately munching your hard drive data and rewriting your modem script. But not before sending me all of your credit card information.

Just kidding.

There’s no virus. But messages like this one, true or not, make business travelers like Andrea Seebaum do a double-take.

The San Francisco consultant works for what she describes as a “completely virtual” company operating across four time zones. She takes every warning seriously because her company relies so much on e-mail for communication and the transfer of files and attachments, and a single virus could shut down the entire operation.

That includes the ridiculous assertions made by online columnists like me, the far-fetched spinnings about the Budweiser screen-saver frogs crashing computers, and the well-circulated cautionary notes about cyber-infections called “Good Times”, “Free Money” or “Win a Vacation!”

You can’t blame her. A few months ago, a virus found its way on to one of her laptops.

“We don’t know who it was, but someone had turned off their virus protection software,” she remembers. It invaded copies of Microsoft Excel, disabling some of the program’s “save” functions.

“We didn’t have the option of calling up the corporate anti-virus center because we didn’t have a corporate anti-virus center. We don’t even have a network. It’s just all of us on the Internet,” she says.

Her solution was to disinfect her computer online with a free service called HouseCall, a Web-based applet that scanned her hard drive and purged any harmful bugs from it. Even with a slow 28.8 bps modem connection, Seebaum says one scan took just a few minutes.

Trend Micro Inc., the Cupertino, Calif., antivirus software developer that runs HouseCall, also offers OfficeScan Corporate Edition, an industrial-strength virus package which zaps bugs across a network. Chances are that if you’re working for a bigger company, you’ll be protected by something that’s centrally administered, like OfficeScan or Ontrack’s Vet antivirus software.

But what if, like Seebaum, you’re alone? How do you tell if your computer is in danger or if the e-mail you just got was a hoax?

The stakes are pretty high. With more than 18,000 known viruses bouncing around the Internet, and each infection costing an average of $8,300 in lost data, time and productivity, according to the International Computer Security Association, you can’t afford to be wrong.

What’s more, the virus warnings look so deceptively believable. Granted, my lead-in about bugs eating your hard drive and credit card numbers being sent to yours truly wouldn’t leave an experience user scrambling to unplug the machine, but I was exaggerating to make a point. The tall tales making the rounds online are usually far more subtle.

Sarah Gordon, an antivirus researcher at IBM, says bogus warnings can play mind games with you. “For example,” she says, “one warns of a virus contained in an e-mail with the header ‘returned or unable to deliver.’ Well, that’s what you get when a message is bounced back to you, so of course people will get worried.”

She advises travelers to check the lists of known viruses, such as The WildList Organization International’s regional virus report. Also, click on the Computer Virus Myths Web site to see if the posting is a fake.

But that doesn’t take into account the emotional response which a virus warning often triggers. I’ve gotten urgent messages from family, colleagues, and even one from a friend with a Ph.D., all assuring me of untold destruction if I didn’t take their faux warnings seriously. I’ll be darned if one or two of them didn’t send me running to the store to look for the latest copy of Norton Antivirus or Command Antivirus.

Make no mistake — the antivirus programs that are out there today protect your laptop against practically every bug. However, the virus programmers try to stay one step ahead of the antivirus programmers. It’s just the way this game is played. In other words, users like you and me can’t ignore the digital flare guns when they go off. Particularly if we travel a lot, leaving us miles from the closest electronic inoculation, we need to remain extra vigilant.

How can you tell if you’re dealing with a hoax?

First, consider the source. If it’s from a friend or a government agency, then it’s probably wrong. Uncle Sam doesn’t issue virus alerts, and your friends (unless they’re programmers) are just being misled by their friends. A note from an antivirus vendor or a security consultant, on the other hand, should deserve a hard look.

Tall tales make believable but exaggerated statements, like “your monitor will EXPLODE if you don’t delete the message IMMEDIATELY.” There’s also a “too-good-to-be-true” element to most virus hoaxes – the promise of money for nothing or a free vacation topping the list. Bogus virus warnings urge you to tell all of your friends about the terrible contagion, too.

Don’t get sucked into someone else’s idea of a practical joke. If the computer ailment in question isn’t on any authoritative lists then do yourself a favor: delete the spam from your hard drive and get on with your business.

Now if you’ll excuse me, I’ve got some shopping to do.

Christopher Elliott is the author of Scammed: How to Save Your Money and Find Better Service in a World of Schemes, Swindles, and Shady Deals. Critics have called it “eye-opening” and “inspiring” — it’ll “grab your attention and won’t let go.” Order your copy now on Amazon, Barnes & Noble or iTunes.

Be the first to comment