Tech: Postcard virus confirmed, again

Subject: Tech: Postcard virus confirmed, again
From: katlaughing
Date: 14 Feb 08 - 11:22 AM

Just a note, apparently a vicious postcard virus is making the rounds, again. Snopes has verified it and updated their files as of yesterday,though I see they first reported on it in 2007, so be aware:



    Subject: Verified by Snopes
   This time IT'S FOR REAL! http://www.snopes.com/computer/virus/postcard.asp

    You should be alert during the next few days.

    Do not open any message with an attachment entitled "POSTCARD," regardless of who sent it to you. It is a virus which opens A POSTCARD IMAGE, which 'burns' the whole hard disc C of your computer. This virus will be received from someone who has your e-mail address in his/her contact list. This is the reason why you need to send this e-mail to all your contacts. It is better to receive this message 25 times than to receive the virus and open it. If you receive a mail called" POSTCARD," even though sent to you by a friend, do not open it.!

    Shut down your computer immediately.

    This is the worst virus announced by CNN. It has been classified by Microsoft as the most destructive virus ever. This virus was discovered by McAfee yesterday, and there is no repair yet for this kind of virus. This virus simply destroys the Zero Sector of the Hard Disc, where the vital information is kept.

Subject: RE: Tech: Postcard virus confirmed, again
From: GUEST
Date: 14 Feb 08 - 11:31 AM

According to McAfee this is a hoax...

Please don't post irresponsible and inaccurate Virus warnings.

Subject: RE: Tech: Postcard virus confirmed, again
From: katlaughing
Date: 14 Feb 08 - 11:36 AM

Did you read the Snopes report? According to Snopes it is NOT a hoax. Be sure to read the very last paragraph in which they warn folks not to mistake this virus for a hoax which is very much like it.

Snopes Report.

Subject: RE: Tech: Postcard virus confirmed, again
From: Folkiedave
Date: 14 Feb 08 - 11:59 AM

Reamarkably there are two similar messags on Snopes.

http://www.snopes.com/computer/virus/virtualcard.asp
is the one about the hoax.

Usually the clue to the hoax one is when it says something like ".....says this is the most destructive virus yet" almost always confirms it as a hoax - unless you were there and heard the braodcast.

Subject: RE: Tech: Postcard virus confirmed, again
From: katlaughing
Date: 14 Feb 08 - 12:02 PM

Thanks, FolkieDave.

Subject: RE: Tech: Postcard virus confirmed, again
From: GUEST
Date: 14 Feb 08 - 12:25 PM

Any postcard that doesn't name the sender is EXTREMELY likely to be a hoax. (and the name has to be someone you know, of course)

Every real e-card I've received said who it was from.
Most viruses for the last 10 years don't wipe your hard disk, they set your computer up as another meber of a network of millions of spambots that send viagra adverts and stock scams all over the net.

Anahata

Subject: RE: Tech: Postcard virus confirmed, again
From: JohnInKansas
Date: 14 Feb 08 - 03:18 PM

It may be worth noting as well that there has been sufficient traffic in phony "greeting cards" to merit an FBI warning - especially applicable now to Valentine greetings, although this is an ongoing thing not limited just to the holiday of the day.

Red Tape Chronicles: Beware of e-valentines.

John

Subject: RE: Tech: Postcard virus confirmed, again
From: SINSULL
Date: 14 Feb 08 - 03:36 PM

Just received an email from our Tech Department warning all NOT TO OPEN any e-cards on a company computer. They suggest forwarding them to your home computer if you simply must open them - not I. Thanks for the heads up, kat.

Subject: RE: Tech: Postcard virus confirmed, again
From: Beer
Date: 14 Feb 08 - 04:35 PM

Yes Kat, thanks also.
Beer (adrien)

Subject: RE: Tech: Postcard virus confirmed, again
From: katlaughing
Date: 14 Feb 08 - 04:43 PM

You're welcome, folks.

Subject: RE: Tech: Postcard virus confirmed, again
From: Sandra in Sydney
Date: 14 Feb 08 - 08:42 PM

One of my friends occasionally sends e-cards which I usually don't open, tho I opened my birthday card last week.

It showed a pic of a birthday cake & started singing 'Happy Birthday' to me, & a Firefox message appeared saying it stopped a Popup popping up (good old Firefox!)

While it was playing I noticed a question mark icon on the bottom bar (where the secure padlock appears) so ran my curser over it & was not very surprised when it said "Turn off popup blocker"

No way mate.

So I closed the whole site, cutting off my birthday song in mid word.

I checked for cookies & deleted her email.

sandra (Mac user!!!)

Subject: RE: Tech: Postcard virus confirmed, again
From: Stilly River Sage
Date: 14 Feb 08 - 09:04 PM

I haven't opened a greeting card attachment for at least the last five years, probably longer. It just isn't worth it.

Subject: RE: Tech: Postcard virus confirmed, again
From: GUEST,uwe
Date: 15 Feb 08 - 10:07 AM

This is another HOAX even though someone claims to
have verified it is
real in the snopes website... The internet is a tricky place, therefore
please check multiple
sources!

Now there is a REAL Postcard Computer virus that surfaced during Summer
2007, but for
this one to activate you had to paste an URL link from the message
containing the virus into
your web browser and visit the given website, which claimed to have the
postcard for you. A
aggressive Malware virus would then be downloaded unto your PC and act as
a gateway for
illigal computer activities from an outside source everytime you would
connect to the internet
(No, it did not wipe out your harddrive). However, this one could attack
only UNPATCHED
windows system. (Another reason to do a regular windows update... AT LEAST
ONCE PER
WEEK!!!)

The text send to you in the virus alert email is an almost VERBATIM copy
of the "A Card for
You" virus hoax that has been floating around for a while. The name
"Postcard" was just
lately added to this hoax.

For more info goto
http://www.truthorfiction.com/rumors/a/a-card-for-you.htm

For what its worth

Subject: RE: Tech: Postcard virus confirmed, again
From: katlaughing
Date: 15 Feb 08 - 10:28 AM

Ho-hum...did you bother to read any of the above, the parts where we covered that snopes has TWO writeups, one about the real virus and one about the hoax? If one isn't careful they could mistake one for the other, but then you'd know that if you'd read the above.

Subject: RE: Tech: Postcard virus confirmed, again
From: Richard Bridge
Date: 15 Feb 08 - 11:06 AM

Look, it isn't rocket science.

There is no "Postcard" email which "burns your C Drive (!)" by merely opening the email. Information to that effect is a hoax. A dead giveaway is the panic-stricken language. Real virus warnings from real virus companies are not like that.

There are a number of email malware scams that offer you an e-card, postcard, greetings card, whatever. They all require you to click on a link or paste an address into your web-browser.

It only took me 5 minutes to find out.

Subject: RE: Tech: Postcard virus confirmed, again
From: katlaughing
Date: 15 Feb 08 - 11:15 AM

Apparently my hair is blond again this week. Even if snopes says it is real, you can be sure I will never, ever post anything about any virus here, ever again, even if snopes says it is real and compares it against a hoax which they also chronicle....I will never ever tell you about it, nor expect you to do any reading of the supporting links offered. Oh, and I am going to dye my hair back to sensible red.

Subject: RE: Tech: Postcard virus confirmed, again
From: Peace
Date: 15 Feb 08 - 01:14 PM

Thanks for the alert, kat.

I would rather be warned and have it all be a hoax than NOT warned and have it be true. Because this idiot would for-sure click it. And then bad stuff would happen.

Subject: RE: Tech: Postcard virus confirmed, again
From: Jean(eanjay)
Date: 15 Feb 08 - 02:21 PM

I delete all e-cards without opening them; it just is not worth the risk. If I actually recognised the sender that would be different - but I never do!

Any unrecognised sender is advertising, conning, trying to sell me something, malicious, etc. - so nothing is lost.

Subject: RE: Tech: Postcard virus confirmed, again
From: JohnInKansas
Date: 15 Feb 08 - 02:26 PM

THE REAL FBI WARNING

Prepared by the
Internet Crime Complaint Center (IC3)
February 11, 2008
-------------------------------------

STORM WORM VIRUS

With the Valentine's Day holiday approaching, be on the lookout for spam e-mails spreading the Storm Worm malicious software (malware). The e-mail directs the recipient to click on a link to retrieve the electronic greeting card (e-card). Once the user clicks on the link, malware is downloaded to the Internet connected device and causes it to become infected and part of the Storm Worm botnet. A botnet is a network of compromised machines under the control of a single user. Botnets are typically set up to facilitate criminal activity such as spam e-mail, identity theft, denial of service attacks, and spreading malware to other machines on the Internet.

The Storm Worm virus has capitalized on various holidays in the last year by sending millions of e-mails advertising an e-card link within the text of the spam e-mail. Valentine's Day has been identified as the next target.

Be wary of any e-mail received from an unknown sender. Do not open any unsolicited e-mail and do not click on any links provided.

If you have received this, or a similar e-mail, please file a complaint at www.ic3.gov.

Additional Current FBI/IC3 Press Releases for your information, should you be curious.

It has, in fact, been a recent observation that REAL MALWARE EXPLOITS are sometimes disguised as a "well known hoax." It is quite likely that a particular current email message can appear simultaneously in hoax and in REAL MALWARE forms.

The Snopes confirmation that REAL MALWARE has recently been passed using phony "greeting card messages" IS ACCURATE, and reflects current information that can be confirmed from various authoritative AV/MALWARE protection sites.

The Snopes confirmation that many warnings about malware being distributed via greeting cards are hoaxes is ALSO ACCURATE.

Either report must be taken in context, and there is unfortunately NO EASY WAY for anyone to determine which has appeared in a personal email inbox.

The rules are the same for both: If in doubt, DON'T CLICK.

Given the frequency with which malware is able to fake email from persons you know, the really cautious person might want to email anyone who is claimed to have sent a "card" directly, to verify that the person did indeed send a card, before clicking to open any such greeting.

John

Subject: RE: Tech: Postcard virus confirmed, again
From: katlaughing
Date: 15 Feb 08 - 03:23 PM

Why, thank you, JohninKS!

You're welcome, Bruce and thanks.

So, why can't we have those fancy, weird looking letters which one has to enter before sending a query/order/etc. to online vendors, the ones which make sure a mindless bot is not sending them something instead of a live person? If we had those on our email it would cut down on some of the crap, right? Also, if I quit using my stand-alone email program, i.e. Thunderbird, and use on online, i.e. google mail, am I much more protected or about the same?

BTW, I don't open links, esp. greeting cards, sent to me, either, at least on those days when my hair is not blond.:-)

Subject: RE: Tech: Postcard virus confirmed, again
From: Artful Codger
Date: 15 Feb 08 - 03:30 PM

Yes, better to have a warning--thanks, Kat.

However, it's a bad idea to follow ANY link in e-mail, regardless of the source. Attachments should also be viewed with suspicion. Even if the message was sent by a friend with bona fide intentions, the attachment could easily be infected. Email is an inherently unsafe mode of communication. Things would be much improved if people more commonly used email protection schemes like SSL and PGP when exchanging email.

E-cards are such an obvious means for a hacker to run stuff on your computer, to open one is a patently dumb thing to do. Besides, I'm sure that many e-card sites resell recipients' names, e-mail addresses and any other collected information to spammers. How "thoughtful" of your friends to do that for you!

In a similar vein, let me remind people to use blind copy (Bcc) when sending email to multiple recipients who are strangers to each other. Otherwise, you're handing their private email addresses around like Halloween candy, and how respectful is that?

Subject: RE: Tech: Postcard virus confirmed, again
From: JohnInKansas
Date: 15 Feb 08 - 04:14 PM

So, why can't we have those fancy, weird looking letters which one has to enter before sending a query/order/etc. to online vendors ...

Unfortunately, even that protection has been "cracked," and was defeated in a well publicised case of scalpers purchasing large numbers of "Hannah Montana"(sp?) performance tickets not long ago. The specific incident was the motivation for a newly proposed Colorado law to ban the scalping - expected to pass soon.

The contention is that some OCR programs can now extract the "hidden characters." Another method that may have been used was to copy the "glyph" into a message sent to a few thousand bot machines, with the expectation that AT LEAST ONE IDIOT would read them for you and click send, allowing the "interpreted" text to be pasted back into the ticket order before the link expires.

Whichever method (or whatever one) was used, the scalpers managed to buy nearly all the tickets.

John

Subject: RE: Tech: Postcard virus confirmed, again
From: katlaughing
Date: 15 Feb 08 - 05:31 PM

Ah, thanks, John, again. The case has been in the news here, but I didn't know that's how they managed it.

Thanks, AC.:-)

Subject: RE: Tech: Postcard virus confirmed, again
From: GUEST,leeneia
Date: 16 Feb 08 - 10:39 AM

I just looked at a site (McAffee?) which pointed out that after people get used to the idea that a certain warning is a hoax, a hacker can take that warning and add vicious code to it.

What to do, what to do?

I have an idea. I have started adding a design to my Re lines so that they are unique when they appear in a friend's inbox. I hope that in time they will be conditioned to spot messages from me by the curlicues.

I started this because some of my more naive friends get so much spam they miss e-mail from real friends. I know, I know, they should change addresses or ISP's, but the naive can be hard to reason with sometimes.

Anyway, if everybody typed Re lines that were decorated somehow, it would distinguish mail composed by a friend from mail that came from 'someone' who stole the address.

Subject: RE: Tech: Postcard virus confirmed, again
From: GUEST, leeneia
Date: 16 Feb 08 - 10:50 AM

examples of unique Re lines, in case you didn't get what I meant

^*^let's play music Feb 29th^*^

{~}shall we dance{~}

breakfast = in = bed

Subject: RE: Tech: Postcard virus confirmed, again
From: John J
Date: 16 Feb 08 - 05:56 PM

Hoax or no, just be wary.

I do tend to take notice of anything JohnInKansas says regarding computers - he knows a damn sight more than I do!

JJ

Subject: RE: Tech: Postcard virus confirmed, again
From: Jean(eanjay)
Date: 16 Feb 08 - 06:00 PM

Sometimes hoaxes are good - they make me more aware, more alert and more careful. I've had some phishing emails recently from what is supposed to be my bank. I've had loads in the past from other banks so I take no notice. I did report these and deleted them as quickly as possible!

Subject: RE: Tech: Postcard virus confirmed, again
From: treewind
Date: 16 Feb 08 - 06:07 PM

As far as email goes, get a decent spam filter.
I manage it with spamassassin on home and work networks; Windows users can use mailwasher or do all their email with Thunderbird which has a very good user-controllable "junk" (i.e. spam) filter built in and is free.

Changing ISP or email addresses is just running away from the problem instead of dealing with it. I've had the same email address for about 10 years. Lots of spam comes in but I rarely see it.

Anahata

Subject: RE: Tech: Postcard virus confirmed, again
From: GUEST,Guestavo Chacin
Date: 02 May 08 - 06:54 PM

give any programmer 10 minutes and they could create a virus that does this, name it 'postcard' and send it in an email. there, story confirmed.

i never open e-cards from people anyway, even if i know they're real. waste of time.

Subject: RE: Tech: Postcard virus confirmed, again
From: JohnInKansas
Date: 03 May 08 - 06:42 AM

Don't 'Click here to protect your computer'

A brief, and not really very informative report on a "surge" in Trojans is at the link. Apparently written by a reporter who knows little about malware, he missed the opportunity to explain that the Trojans under discussion were those spread by "phishing" inducements to get people to "Click Something."

From the report:

Trojans can log keystrokes to gather passwords, send spam from private computers or harvest email addresses or personal information for criminal purposes.

The most common family of trojans last year was "Win32/Zlob," a piece of malicious software, or malware, that people unwittingly download from the Internet.

Its designers [may] trick people into saving it by telling them they need a new piece of software to watch video online. Once installed, it bombards people with pop-up messages and bogus flashing warnings that their computer is infected.

The messages [may] say: "Your computer is infected! Windows has detected spyware infection. Click here to protect your computer."

The trojan then sends adverts offering to sell rogue anti-spyware on sites that could expose customers to credit card fraud. Microsoft said the problem is global and linked to organized criminal gangs.

"The majority (of trojans) come from the (United) States, China, Russia and South America," Gullotto said on the fringes of the Infosecurity Europe trade conference on Tuesday.

Microsoft said the number of computers around the world that were made safe after being infected with trojans rose from one million in the second half of 2006 to 19 million in the second half of 2007.

/quote

Microsoft is apparently referring to malware removals made by "Microsoft Guardian." Guardian is a regular scan, updated monthly, for people signed up for automatic updates of WinXP or Vista. It is not a complete antivirus/antimalware scan, but only looks for a few of the "currently common" and most destructive pests. The increase from one million to nineteen million "infections" per 6 months largely indicates that there are increasing numbers of IDIOTS who refuse to believe the warning:

DON'T CLICK IT IF YOU DON'T KNOW WHAT IT IS.

John