The Hoax

Newsgroups: alt.crackz,alt.games,alt.bbs.ads,fido.ger.mailbox,alt.bbs,rec.arts.anime,alt.bbs .lists,rec.games.programmer,comp.bbs.misc,comp.sys.ibm.pc.games.strategic,comp.b bs.tbbs,tw.bbs.soc.green-earth,rec.games.computer.doom.playing,comp.sys.ibm.pc.g ames.action,comp.sys.ibm.pc.games.rpg,rec.games.trading-cards.magic.misc,rec.gam es.video.marketplace,alt.bbs.internet,rec.games.video.classic,rec.games.mecha,co mp.sys.ibm.pc.games.flight-sim,comp.bbs.majorbbs,rec.games.video.sega
Posted to multiple newsgroups, none of them virus related.

Subject: Fwd: Virus Warning Message!!!!!!!!!!!!!!!!!!!!
Multiple exclamation marks. Forwarded, probably from a "friend of a friend".

Please read the following message and forward it to ANYONE you know!!!
A request to spread the hoax further. An sure sign of a virus hoax. Multiple exclamation marks.

FCC Virus Warning!!!
The FCC does not send out virus warnings and there is no reference to any other source. Multiple exclamation marks.

The FCC has just released a new virus warning of a email virus named "Hackingburgh". This virus is spread throughout networks and email servers.
It claims there is an email virus when no such thing exists.

The infected message has random titles with one attachment and one Java applet. When the person reads the message, the virus would be evoked automatically by the commands of the suspicious Java applet.
The author is mixed up about the difference between reading an email and surfing the web.

However, since the virus is so small, executing it would be undetectable.
Another sign of a hoax is claims that it is undetectable.

"Hackingburgh" is a Multi-Partite, memory resident virus.
Some legitimate terms incorrectly used as technobabble. The proper term is multipartite.

Once the virus has been executed by the commmands of the Java applet, it would overwrite the MBR and place the original MBR in sector 7, cylinder 1 of the disk.
Sector 7, cylinder 1 is in the middle of the FAT(File Allocation Table). A real virus alert wouldn't put in such irrelevant technical details and then get it wrong. Notice also that commands is spelled wrong. A real virus alert wouldn't have such obvious spelling errors.

It would become memory resident everytime the computer has boot up and would infect any removable media, including floppies and Zip disks, that was inserted into the drives by placing itself at the end of the disk and altering the boot sector to point to this code. After the computer has boot up on the 13th of every month, the virus would reformat all visible hard drive partitions. Also, it might also corrupt program files slowly and cause illegal operations. This virus attacks MS-DOS based computers. Under Windows 95 and NT, the files Explorer.exe & System.dat has a 3-in-5 chance of being corrupted. However, since the virus is a stealth virus, detection of the virus would be very difficult.
So it overwrites the FAT, formats disks, corrupts programs, causes illegal operations, and attacks Explorer.exe and System.dat. And then the message says detection of the virus is very difficult. Doesn't that seem a little contradictory?

In order to prevent infection by the virus, switch off the capability of reading Java applets in your Java-enabled browser like Netscape Navigator and Internet Explorer(both browser together counts for 98% of all browsers) before reading ANY email messages.
Another attempt to make it sound legitimate by preying on people's fear of Java.

PLEASE FORWARD THIS WARNING MESSAGE TO ANYONE YOU KNOW!!
Definite sign of a hoax. The request to forward it and the multiple exclamation marks.

Summary

  1. Posted to newsgroup(s) that have nothing to do with viruses. YES
  2. Multiple exclamation marks. YES
  3. Forwarded from somewhere else. YES
  4. A request to spread the warning further. YES
  5. Reference to the FCC or other place that has nothing to do with viruses. YES
  6. Claims you get it from reading email. YES
  7. Claims that it is undetectable or that there is no cure. YES
  8. Overly technical details that don't make sense. YES
  9. Spelling and grammar mistakes. YES
  10. Being self-contradictory. YES
This hoax displayed 10 out of the 10 warning signs. Definitely a hoax.

Hoax Page
Virus Page
1