!0000 Hoax

Content

!0000 Hoax

Type: Hoax
SubType: E-mail
Discovery Date: 09/25/2001
Length: 0
Minimum DAT: N/A ( )
Updated DAT: N/A ( )
Minimum Engine: 5.1.00
Description Added: 09/25/2001
Description Modified: 02/20/2003 1:14 AM (PT)

Risk Assessment

Corporate User: Low
Home User: Low

Tab Navigation

Characteristics

AVERT HOAX Notice!!

McAfee AVERT Labs would like to inform you of an email HOAX.

The !0000 Hoax is mainly circulating in the Netherlands. The e-mail content contains a "trick" for stopping mass-mailing routines used by e-mail worms.

The basic idea behind the "trick" is to create a dummy e-mail contact entry which would be named so that it would be first in the address book list, without an actual associated e-mail address. In theory, this contact would come up before any valid contacts, and would fail when accessed by a mass-mailer because it has no e-mail address thus giving the user the option to stop the mass-mailing. This trick might work for some mass-mailing worms, but it wouldn't stop the majority of worms which use e-mail to spread.

We are advising users who receive the email to delete it and DO NOT pass it on as this is how an email HOAX propagates.

Below are some examples of the actual text for this message that may be received via email.

(Dutch version)

Hierbij een handigheidje dat voorkomt dat een (eenmaal bij je binnengedrongen) virus zich verspreid over alle kennissen die in je adressenboek staan. Maak, in je adressenboek, een nieuwe contactpersoon aan met de naam :!0000 en zet daar geen emailadres bij. Deze fictieve contactpersoon zal nu helemaal bovenaan in je adressenboek staan. Als nu een virus probeert zichzelf te verspreiden via jouw adressenboek, dan zal je computer de foutmelding geven: "Dit bericht kan niet verstuurd worden, omdat een of meer contactpersonen geen geldig email-adres heeft. Controleer uw adressenboek en zorg ervoor dat alle contactpersonen een geldig email-adres hebben." Je klikt dan op 'OK'. Het virus wordt dan niet verzonden en je adressenboek is nog in orde. Het virus zal opgeslagen worden in je postvak uit (of 'drafts' als je hotmail gebruikt). Ga daar naar toe en verwijder het; ga dan naar je 'prullenbak' en verwijder het daar ook. Je hebt nu wel voorkomen dat het virus zichzelf verspreidt via je adressenboek, maar je moet nu nog wel zorgen dat je zelf het virus kwijtraakt !!

(English version)

Subject: Neat Trick

HOW TO PROTECT YOUR ADDRESS BOOK!
I learned a computer trick today that's really ingenious in its simplicity. As you may know, when/if a worm virus gets into your computer it heads straight for your email address book, and sends itself to everyone in there, thus infecting all your friends and associates. This trick won't keep the virus from getting into your computer and it will stop it from using your address book to spread further, and it will alert you to the fact, that the worm has gotten into your system.

Here's what you do:
First, open your address book and click on "new contact," just as you would do if you were adding a new friend to your list of email addresses. In the window where you would type your friend's first name, type in AAAAAAA. Same in space labeled screen name.

Now, here's what you've done and why it works:
The "name" AAAAAAA will be placed at the top of your address book as entry #1. This will be where the worm will start in an effort to send itself to all your friends. But, when it tries to send itself to AAAAAAA, it will be undeliverable because of the phony email address you entered.

If the first attempt fails (which it will because of the phony address), the worm goes no further and your friends will not be infected.

Here's the second great advantage of this method:
If an email cannot be delivered, you will be notified of this in your Inbox almost immediately. Hence, if you ever get an email telling you that an email addressed to AAAAAAA could not be delivered, you know right away that you have the worm virus in your system. You can then take steps to get rid of it! Pretty slick, huh?

If everybody you know does this then you need not ever worry about opening mail from friends. Pass this on to all your friends.

Again, if you receive this email delete it and DO NOT pass it on.
McAfee AVERT

Symptoms

Method of Infection

Removal

Ignore or delete this email and do not forward it to others.

Variants

N/A

All Information

Overview -

Characteristics

Characteristics -

AVERT HOAX Notice!!

McAfee AVERT Labs would like to inform you of an email HOAX.

The !0000 Hoax is mainly circulating in the Netherlands. The e-mail content contains a "trick" for stopping mass-mailing routines used by e-mail worms.

We are advising users who receive the email to delete it and DO NOT pass it on as this is how an email HOAX propagates.

Below are some examples of the actual text for this message that may be received via email.

(Dutch version)

(English version)

Subject: Neat Trick

If the first attempt fails (which it will because of the phony address), the worm goes no further and your friends will not be infected.

If everybody you know does this then you need not ever worry about opening mail from friends. Pass this on to all your friends.

McAfee > Theat Center > Virus Detail Page

Navigation

Utility Navigation

Global Sites

Need Help?

Threat Center

Segment Navigation

Section Navigation

Content

!0000 Hoax

Risk Assessment

Tab Navigation

Overview

Characteristics

Symptoms

Method of Infection

Removal

Variants

Variants

All Information

Overview -

Characteristics

Characteristics -

Symptoms

Symptoms -

Method of Infection

Method of Infection -

Removal -

Removal -

Variants

Variants -

Threat Resources

Footer