The Celcom/Sandman Email Warning Is A Hoax

Last significant update: 29 February 2000

This information can be freely reproduced in any medium, as long as the information is unmodified.

This collection of four hoaxes almost always travel together. When we first saw them, only the first two hoaxes were included, but after just days, the third and fourth "warning" were added.

Thanks to Maury Friedman for sending us the original 2-hoax version on 19 July, 1999 and to Ron Schudel for bringing the 4-hoax version to our attention on 11 August, 1999.

WARNING No. 1
   If you receive any CELCOM Screen Saver Pls. do not install it!!!!!! This
screensaver is very cool. It shows a NOKIA handphone, with time messages.  
After it is activated, the PC cannot boot up at all. It goes very slow.  It
destroys your hard disk. The filename is CELLSAVER.EXE

First of all, there has never been a validated report of such a a screensaver, let alone a malicious one. Next, even if there were such a beast, it would be easy for the bad guys to rename it, so such a warning is next to useless, even when the supposedly dangerous file exists. Finally, there could be a completely innocent file with this name.

Such a warning makes sense only if a LOT more information is included. For example, the size of the file, as well as mathematical checksums like those in a CRC (cyclical redundancy check) or, better yet, the checksum generated by PKZIP.

But that's not the case here, nor is it in in 999 of 1000 cases.

WARNING No. 2
   Beware! if someone named  asks you to check out his page. DO 
NOT! It is at  www.geocities.com/vienna/6318
   This page hacks into your C:\drive. DO NOT GO THERE... FOWARD THIS MAIL TO 
EVERYONE YOU KNOW.

Fiddlesticks. This is as innocuous a web page as they come. Totally harmless. Moreover, I suspect that it always was harmless. Yes, I've looked at the document source. Squeaky clean.

Warning No. 3
   SEND THIS TO EVERYONE IN YOUR CONTACT LIST! THIS IS NO JOKE,OK?
   WARNING: If you get an E-mail titled : "Win A Holiday" DO NOT open it.  
Delete it immediately. Microsoft just announced yesterday. It is a malicious
virus that WILL ERASE YOUR HARD DRIVE . At this time there is no remedy .  
Forward this to everyone IMMEDIATELY!!

An old hoax. See our Win A Holiday debunk hoax.

Warning No. 4
   W A R N I N G ! ! ! ! ! ! ! If you receive an e-mail titled JOIN THE CREW
or PENPALS, DO NOT open it!!!!!  

Two hoaxes we've documented since forever: see our Join The Crew and Penpal Greetings hoax debunks.

It will erase EVERYTHING on your hard drive!
PENPAL appears to be a friendly letter asking you if you are interested in a
penpal.....but by the time you read this letter it is TOO late.  The Trojan
horse virus will have already infected the boot sector of your harddrive,
destroying all the data present. It is a self-replicating virus, and once the
message is read it will AUTOMATICALLY forward itself to anyone who's e-mail
address is present in your box!!!  This virus will destroy your hard drive and
holds the potential to DESTROY the hard drive of anyone whose mail is in your
box and whose mail is in their box and so on and on!!!!!!MA So delete any
message titled PENPAL or JOIN THE CREW this virus can do major DAMAGE to
worldwide networks!!!!

Ho hum.

    
   PLEASE PASS THIS ALONG TO ALL YOUR FRIENDS AND PEOPLE IN YOUR MAILBOXES.  
AOL HAS SAID THIS IS A VERY DANGEROUS VIRUS AND THERE IS NO REMEDY FOR THIS
YET.
    
   FORWARD IT TO ALL YOUR ON-LINE FRIENDS A.S.A.P.!

Please do not forward this -- or any other hoax -- to all your friends.

Instead, you should reply to the sender -- and as far back up the email chain as you have energy -- informing the originators that this is a hoax. For this particular hoax, I suggest that you provide a pointer to this URL (http://www.umich.edu/~virus-busters/hoaxes/cel-sand.html)
For virus or hoax info, please see our main page (http://www.umich.edu/~virus-busters/) or go to another reputable site, like The Urban Legends Reference Pages (leaving our site).

   -BPB

visits to this page since 10 February 2000 21:35 EST