I'm Your Shadow

Last Updated: 03/08/2001 04:15 PM

This hoax appeared in Italy during Jan/Feb 2001. The original hoax message was in Italian, but below is an English translation of it:

WARNING: please forward as soon as possible to every e-mail
address you know of! We must be quicker than them. In case the
contact happens, please notify legal authorities. Let's stop
them! Please translate in other languages as well....

If you receive a mail with subject "I'M YOUR SHADOW! PLEASE
PLEASE DON'T FORGET ME" do not absolutely open it!
It contains an attachment that will auto-activate when opening
the mail and inserts itself in the computer without any warning
to the user, because no window, message or anything else is
displayed.

This program allows to anyone to control your own computer,
exploiting a very dangerous bugs, typically found in almost
every chat program unbeknownst to many people, sometimes even to
the program's authors. Indeed, it contains a bug, dependent on
an operating system's file which manages internet-borne
communications (even in local intranet networks). The virus
contains some of the functions used by hackers to penetrate web
sites e by paedophiles to anonymize themselves over the
internet. Anyone who connects to the virus program will be able
to enter Web sites or download and create paedophiliac material
by using your computer. In this case, you would be held
responsible, if found out, because the commands sent to the Web
sites or the download of photos would happen via your computer
and through your internet connection.

There have already been cases of people accused of committing
paedophilia who had nothing to do with that, they were only
victims of the virus. Furthermore, the program is enabled to use
your modem for connecting to international provider, making your
telephone bills grow hugely. This happens in the same instant
when your program receives the email, even without opening it.
The virus is not detected by any antivirus and there is no
remedy so far. Formatting the hard disk doesn't solve the
problem, because the virus also installs itself in the flash
bios memory of the motherboard and at every attempt to format
it, the virus relocates in RAM memory and vice-versa.

The only solution is to substitute the flash bios and
base-formatting the hard disk, not before having uninstalled the
AM [verbatim, I suppose he/she means RAM. fab] for successive
re-installation. If you receive the email, there's nothing you
can do. It means that you've already been connected to an
international provider. The only thing to do is to disconnect,
turn off modem and computer and disconnect it from the electric
supply. In case of reboot, the program would re-connect the
modem to the provider automatically. The worst thing is that the
phone will be free during this operation, so there will be no
way to individuate the called provider. If you receive this mail
turn off computer and moden and call a technical support for
substituting the bios' flash ROM. The operation must be
performed in this order:

1.. disconnect the hard disk's,
2.. install the new flash bios,
3.. format the hard disk on another computer,
4.. re-install the hard disk.

As for the calls to the international provider, nothing can be
done. By now, the costs will have already been charged. These
are the costs for an international connection: 3000 at response,
2560 per minute for the first 2 minutes, 5000 after the first 3
minutes. During the email download, about 500 connections are
established, and a response charge for every one.

This information has been passed by Microsoft Please diffuse it
to everyone you know, because the virus auto-sends itself to
every person you have in the contacts, so if you have received
the email, they surely have it too. It is important to warn all
those people who connect to the internet often, because 500
connections per second are established for each connection to
internet. So in one hour, you would not pay the normal 2000
liras of the urban call, but 360.000 for an international call.
Therefore you're encouraged to warn them.

Please ignore any messages regarding this hoax and please do not pass on any messages regarding it. Passing on these messages only to further propagate it.