Scott Granneman

Contact | Site Map | Search
HomeWritingPresentationsTeachingWeb DevTech InfoUseful LinksPersonal
Home > Tech Info > Email > Anti-Virus Oops

An Anti-Virus Trick That Doesn't Work

I received this email recently from an acquaitance:

I learned a computer trick today that's really ingenious in its simplicity. As you may know, when/if a worm virus gets into your computer it heads straight for your email address book and sends itself to everyone in there, thus infecting all your friends and associates. This trick won't keep the virus from getting into your computer, but it will stop it from using your address book to spread further, and it will alert you to the fact that the worm has gotten into your system.

Here's what you do: First, open your address book and click on 'new contact' or 'new person' just as you would do if you were adding a new friend to your list of email addresses. In the window where you would type your friend's FIRST name, type in !000 (that's an exclamation mark followed by 3 zeros). In the window below where it prompts you to enter the new email address, type in WormAlert. Then complete everything by clicking add, enter, OK, etc.

Now, here's what you've done and why it works: the 'name' !000 will be placed at the top of your address book as entry #1. This will be where the worm will start in an effort to send itself to all your friends. But when it tries to send itself to !000, it will be undeliverable because of the phony email address you entered (WormAlert). If the first attempt fails (which it will because of the phony address), the worm goes no further and your friends will not be infected.

Here's the second great advantage of this method: if an email cannot be delivered, you will be notified of this in your InBox almost immediately. Hence, if you ever get an email telling you that an email addressed to WormAlert could not be delivered, you know right away that you have the worm virus in your system. You can then take steps to get rid of it!

Pretty slick huh?

If everybody you know does this then you needn't ever worry about opening mail from friends. Pass this on to all your friends.

In response, I wrote the following:

I hate to be the bearer of bad tidings, but the advice in the email we all got is incorrect, misleading, and potentially dangerous in that it may lead to a false sense of security.

1. It would be impossible for this trick to work with all systems & all email programs.

2. This will NOT work for the simple reason that worms do not care if email they send by taking control of your address books actually arrive or not. You'll get an email from your ISP saying that this email address is not valid, but meanwhile the virus will have propagated using the other addresses in your address book just the same.

3. What's to prevent the bad guys from programming future worms around this trick? What if the next worms skips the first email just to be sure?

4. The last sentence of this email is deeply flawed: 'If everybody you know does this then you needn't ever worry about opening mail from friends'. Even if this trick works, it only protects against one result of a certain kind of worm: the fact that certain worms send copies of themselves to everyone in your address book. This trick does NOT protect you from worms or virii that (a) erase your key files (b) rename or change files or (c) install spyware on your system that allows bad guys to control your computer or observe what you're doing. I'm probably forgetting some other nasty things that worms/virii can do.

The point is, you are most definitely NOT safe if you do this, and you STILL need to most definitely worry about opening mail ... from anyone. Anyone. Especially if there are attachments. If someone sends me an attachment I was not expecting, I delete the email immediately.

Here's a better way to avoid viruses, beyond what I've outlined above: don't use Microsoft Outlook or Outlook Express. Due to the way Microsoft has programmed them, these programs are tremendously insecure and are quite efficient at spreading viruses. I urge all of you NOT to use Outlook or Outlook Express. Instead, try Eudora (www.eudora.com) -- it's free and works well. Or better yet, download the new Netscape (www.netscape.com) and install it. Netscape was terrible a few years ago, but the new version 6 is excellent as a web browser, and the free email client it includes is phenomenal as well. It will even import all your Outlook or Outlook Express emails and your address book, quickly and easily. There are others, but these two are highly recommended.

Of course, this all assumes that you've installed and are regularly (weekly) updating an anti-virus program, like Norton Anti-Virus or the FREE Grisoft Anti-Virus (www.grisoft.com). If you're not doing that, you're a sitting duck.

And of course this also assumes that if you're connected to the Net via a cable modem or DSL, you've got a personal firewall installed. If not, you're a sitting duck. I recommend ZoneAlarm (www.zonealarm.com), or better yet Tiny Personal Firewall (www.tinysoftware.com) or Sygate Personal Firewall (www.sygate.com). All of them are free.

Finally, let me tell you the way I've managed to avoid all these problems: I don't use Microsoft products. I don't use Windows; instead, I use Linux, a free, super-powerful operating system that never crashes. I don't use Office (Microsoft Word, Excel, Powerpoint; instead, I use StarOffice, a free office suite (word processor, spreadsheet, presentation program -- and it's fully compatible with Word, Excel, and Powerpoint). I don't use Outlook or Outlook Express; instead, I use Netscape Mail. I don't use Internet Explorer; instead, I use Netscape. It IS possible to live without Microsoft, and it's a hell of a lot safer. And cheaper -- all the software I use is free!

Sorry for the length of this post, but I wanted to make sure people weren't led astray by the advice in the email.

I hope my response makes sense and helps anyone who was thinking of trying out this technique.