Page 1 of 1

computer virii/!!0000

Posted: Tue Jan 22, 2002 10:23 pm
by ForumGal
From the Urban Legends site regarding the !!0000 virus stop-gap:

(http://www.snopes2.com/computer/virus/quickfix.htm)

-------------
This "helpful" bit of advice first appeared on the Internet in mid-August
2001. It purports to offer an easy-to-implement solution to counter the
ongoing travails visited upon those foolish enough to have opened virus-laden
e-mails by disarming the virus' ability to spread to others disguised as
legitimate mail from the duped user. According to the advice, netizens need
only add a bogus !0000, 0000, or 10000 entry in their e-mail address books to
create an effective "shark account" that will gobble up unauthorized mailings
to the full book.

This trick will work somewhat, but it's not the panacea it's presented to be.
Although the recommended action will help derail the spread of viruses
designed to do a "send all," it will not counter the many that randomly
select individual addresses from a user's address book or supplement
addresses harvested from that location with those found cached elsewhere on
the system. (This method also assumes that if the first entry in a list of
recipients is invalid, the message won't be sent to any of the recipients --
this is not necessarily true of all e-mail programs.) Faked entry or not,
those who correspond with users infected with those sorts of viruses will be
just as vulnerable as they ever were.

Moreover, even those viruses whose spread has been halted via the ruse of a
fake address book entry can still be doing damage to the infected user's
system. Once an executable file has been opened and run, any virus it
contains begins doing its dirty work. Part of that dirty work may amount to
mailing itself to others, but if the virus is programmed to do more than just
replicate itself via e-mail, it will still be present to wreak havoc on the
infected computer. Deleting the infection-carrying e-mail will not halt
whatever else may be underway.
-------------------

More info at the site. Best, Margaret