Spotting a hoax virus alert

Hoax Virus Alerts

We've all received them: e-mail something along the lines of:

From: someone@somewhere.com To: you@yourplace.net Subject: VIRUS ALERT!! In the last 3 hours AOL and Microsoft have announced that a new virus called "Attila" is destroying computers worldwide and spreading like wildfire. They say this is the most destructive virus they have ever seen. It arrives as an e-mail message titled either "Meeting Minutes" or "Meeting request" but if you read the e-mail it will spread to every computer you have sent e-mail to and then DELETE ALL the data on your own computer. To stop this happening you must IMMEDIATELY DELETE all e-mail you receive with that title. Send this warning to all your contacts now, before they are affected.

The truth is that the message is a big fat lie: intended to cause a moment of anxiety and make people send it on. Hoax virus warnings have been going around for almost as long as viruses. In fact some hoax messages have been circulating for years, like those chain letters which claim that some Canadian guy who broke the chain was quickly blinded in a freak canoeing accident (whereas the man who mailed out 50 copies miraculously discovered Ł100,000 credited to his bank account. Honest).

How to spot a hoax

Hoaxes share 3 common features. They are alarmist, unsubstantiated and encourage the recipient to spread them. Real warnings share 3 common features which are the very opposites of the hoax. They contain a turgid technical description of what the virus is and what it can do, they back up the message by providing a checkable source for their claim, and they do not encourage the recipient to spread them.

It may be difficult to judge whether the claims the warning makes are "alarmist" or "turgid", but the hoax warning still has two clear features:

An unattributed claim by an authority, such as "IBM says..." or "Microsoft and Norton have announced..." without any actual source for the claim, such as a link to a press release or security alert on the company's website.
An appeal to pass the warning on to everyone you know, such as "Forward this warning to all your friends". So urgent is this instruction it will often be written in block capitals and/or followed by exclamation marks, such as "SEND THIS TO EVERYBODY IN YOUR ADDRESS BOOK!!!"

A giveaway for alarmist language is any claim that the virus will cause physical damage to the infected computer, such as "your monitor will explode!" or "it will cause your computer to overheat and catch fire". These claims are utter nonsense. A computer virus is just a piece of software. Software cannot cause physical damage to your computer.

Samples of common hoax messages can be found at http://www.symantec.com/avcenter/hoax.html

A simple rule

Try employing the following rule of thumb. Start with a score of zero points and award the warning points on the following scale...

If the warning mentions a well-known computer manufacturer, software company or service provider without providing a link to a page on their website which backs it up, add 5 points.
If the warning instructs you to forward a copy to everyone you know, add 10 points.
If the warning claims the virus will "trash" or "annihalate" the victim's computer, add 6 points. These are not words that a genuine warning would use.
If the warning makes alarming claims that the virus will cause physical damage to the victim's computer, add 15 points.
Add as many points as there are exclamation marks in the message.
Add as many points as there are words written entirely in block capitals.

If the resulting score is 10 or greater then it is certainly a hoax.

An update

Tom emails about physical damage:

Having read on your website that 'Software cannot cause physical damage to your computer', I feel moved, nay, compelled to write in protest. Whilst it is unusual for a virus to cause physical damage to hardware, it is by no means unknown. Indeed, there are several precedents in computing history : - One of the first viruses to infect the ZX spectrum wrote repeatedly to a largely redundant peripheral register, causing overheating, which after an hour or so would lead to said peripheral burning out. - A particularly ridiculous virus for the Commodore Amiga moved the screen raster to the top left of the screen and turned all electron guns on full beam. If you were using one of the first generation of Amiga monitors, which had a design flaw in the CRTs, then after about a week the screen would implode. - I had a computer game called 'Vyrus' which made me very frustrated. So frustrated, in fact, that I threw my computer across the room, slightly damaging the keyboard. In the interests of objective reporting, I feel you should update your website accordingly.

Yes, yes, yes, alright. But in my defence I point out that the ZX Spectrum (and what sort of a stupid register overheats when it's written to anyway?) & Commodore Amiga are back in the days when computers were made of wood and string so tricks like that involving setting the cogwheel_drive_belt_speed register to infinity and causing the machine to saw itself in half don't really apply anymore. Mind you, writing bad firmware into an FPGA can cause contentions and lead to overheating (I've done that myself before by mistake on prototypes at work). But I don't think PCs normally have FPGA components so for practical everyday purposes software can't cause physical damage.

Miscellaneous Index. Front page