I'm your shadow

Categoria: Virus hoax Scoperto il: 20 mar 2001
Tipo: hoaxAggiornato il: 08 giu 2006


Text of the hoax reads as follows:

WARNING: please forward as soon as possible to every e-mail address you know of! We must be quicker than them. In case the contact happens, please notify legal authorities. Let's stop them! Please translate in other languages as well....

If you receive a mail with subject "I'M YOUR SHADOW! PLEASE PLEASE DON'T FORGET ME" do not absolutely open it!

It contains an attachment that will auto-activate when opening the mail and inserts itself in the computer without any warning to the user, because no window, message or anything else is displayed.

This program allows to anyone to control your own computer, exploiting a very dangerous bugs, typically found in almost every chat program unbeknownst to many people, sometimes even to the program's authors. Indeed, it contains a bug, dependent on an operating system's file which manages internet-borne communications (even in local intranet networks). The virus contains some of the functions used by hackers to penetrate web sites e by paedophiles to anonymize themselves over the internet. Anyone who connects to the virus program will be able to enter Web sites or download and create paedophiliac material by using your computer. In this case, you would be held responsible, if found out, because the commands sent to the Web sites or the download of photos would happen via your computer and through your internet connection.

There have already been cases of people accused of committing paedophilia who had nothing to do with that, they were only victims of the virus. Furthermore, the program is enabled to use your modem for connecting to international provider, making your telephone bills grow hugely. This happens in the same instant when your program receives the email, even without opening it. The virus is not detected by any antivirus and there is no remedy so far. Formatting the hard disk doesn't solve the problem, because the virus also installs itself in the flash bios memory of the motherboard and at every attempt to format it, the virus relocates in RAM memory and vice-versa.

The only solution is to substitute the flash bios and base-formatting the hard disk, not before having uninstalled the AM for successive re-installation. If you receive the email, there's nothing you can do. It means that you've already been connected to an international provider. The only thing to do is to disconnect, turn off modem and computer and disconnect it from the electric supply. In case of reboot, the program would re-connect the modem to the provider automatically. The worst thing is that the phone will be free during this operation, so there will be no way to individuate the called provider. If you receive this mail turn off computer and moden and call a technical support for substituting the bios' flash ROM. The operation must be performed in this order:

1.. disconnect the hard disk's,
2.. install the new flash bios,
3.. format the hard disk on another computer,
4.. re-install the hard disk.

As for the calls to the international provider, nothing can be done. By now, the costs will have already been charged. These are the costs for an international connection: 3000 at response, 2560 per minute for the first 2 minutes, 5000 after the first 3 minutes. During the email download, about 500 connections are established, and a response charge for every one.

This information has been passed by Microsoft Please diffuse it to everyone you know, because the virus auto-sends itself to every person you have in the contacts, so if you have received the email, they surely have it too. It is important to warn all those people who connect to the internet often, because 500 connections per second are established for each connection to internet. So in one hour, you would not pay the normal 2000 liras of the urban call, but 360.000 for an international call. Therefore you're encouraged to warn them.

Threat Level

Threat Level:

Learn more