MCI Telecommunications 

                        internetMCI Security Group


Report Title: iMCI MIIGS Security Alert 
Report Name: "JOIN THE CREW"
Report Number: iMCISE:IMCIESTF:081297:01:P1R1
Report Date: 08/12/97
Report Format: Formal
Report Classification: MCI Informational  
Report Reference: http://www.security.mci.net
Report Distribution: iMCI Security, 
                     MCI Internal Internet Gateway Security (MIIGS), 
                     MCI Emergency Alert LiSt (MEALS)
                     (names on file)

-------------------------------------------------------------------------- 

There is a "hoax virus" message currently being circulated within
the Internet that reads as follows:

   If you ever get an e-mail titled "JOIN THE CREW", do not open it
   because it will wipe everything on your hard disk.  This is the latest
   virus not many people know about it.  So e-mail it to everyone you
   know!!!!!!

This is a "hoax" virus message.

The Internet is constantly being flooded with information about computer
viruses and Trojans. However, interspersed among real virus notices are 
computer virus hoaxes. While these hoaxes do not infect systems, they are 
still time consuming and costly to handle. 

Users are requested to please not spread unconfirmed warnings about viruses 
and Trojans. If you receive an unvalidated  warning, don't pass it to all 
your friends, pass it to your computer security  manager to validate first.

>From CIAC:

How to Identify a Hoax
======================

There are several methods to identify virus hoaxes, but first consider what 
makes a successful hoax on the Internet. There are two known factors that make
a successful virus hoax, they are: (1) technical sounding language, and 
(2) credibility by association. If the warning uses the proper technical 
jargon, most individuals, including technologically savy individuals, tend to 
believe the warning is real. For example, the Good Times hoax says that 
"...if the program is not stopped, the computer's processor will be placed in 
an nth-complexity infinite binary loop which can severely damage the 
processor...". The first time you read this, it sounds like it might be 
something real. With a little research, you find that there is no such thing 
as an nth-complexity infinite binary loop and that processors are designed 
to run loops for weeks at a time without damage.

When we say credibility by association we are referring to whom sent the 
warning. If the janitor at a large technological organization sends a warning
to someone outside of that organization, people on the outside tend to believe
the warning because the company should know about those things. Even though 
the person sending the warning may not have a clue what he is talking about, 
the prestigue of the company backs the warning, making it appear real. If a 
manager at the company sends the warning, the message is doubly backed by the
company's and the manager's reputations. 

Individuals should also be especially alert if the warning urges you to pass 
it on to your friends. This should raise a red flag that the warning may be 
a hoax. Another flag to watch for is when the warning indicates that it is a 
Federal Communication Commission (FCC) warning. According to the FCC, they 
have not and never will disseminate warnings on viruses. It is not part of 
their job.