The "Elf Bowling" Virus Email Warning Is A Hoax

Last significant update: 12 December 1999

This information can be freely reproduced in any medium, as long as the information is unmodified.

Thanks to Pamela for being the first to bring this to our attention, on 8 December 1999.

There is a warning that has been spreading like wildfire recently, concerning a couple of harmless programs. The basic text of the warning (there are already variants) goes like this:

   If you have received any of the following games:

   Frogapult.exe
   Elfbowl.exe (Frog game and elf bowling)

   Delete them completely out of your system, as they both have a delayed
   virus attached to them that will be activated on Christmas Day and will
   wipe out your system, boot sector, master boot record etc!!!

   If you know of anyone else who has these games, let them know.

First of all, these programs have been analyzed by several antivirus companies, and they have no virus that triggers on 25 December, or any other day. See e.g., e.g., DataFellows (leaving our site) and Sophos (leaving our site) debunks of this hoax. Such warnings are, of course, next to useless even when they are true:

• One needs more than just a file name to identify a piece of software -- additional information like the size and date help, and some sort of checksum is necessary before one can have any degree of certainty that what was being sescribed and what is at hand have any correlation with each other.

  In this case, ELFBOWL.EXE as distributed from its creator has a size of 1130496 bytes, and PKZIP shows a CRC-32 checksum of ae35e713. Similarly, FROGPULT.EXE is 1021952 bytes long and has a CRC-32 checksum of 0b827fa, according to PKZIP. Hence if you are a user of ELFBOWL.EXE or FROGPULT.EXE and the size and CRC-32 match, you can be confident that your copies are untainted.

• Rest assured that if these really were infected with a virus, then any competent antivirus scanner would detect them, assuming that it is kept up to date. Note that it is of course possible that a program named "Elf Bolwing" might be infected at some time in the future, but keeping your antivirus software current will protect you against getting bitten in this case.

• Had this been a genuine warning, it is trivial for the Bad Guys to change the name of the file to something else -- which means that the warning would be of little value.

Please do not forward this -- or any other hoax -- to all your friends.

Instead, you should reply to the sender -- and as far back up the email chain as you have energy -- informing the originators that this is a hoax. For this particular hoax, I suggest that you provide a pointer to this URL (http://www.umich.edu/~virus-busters/hoaxes/elfbowl.html)

Moreover, this is a good opportunity to make three of our favorite recommendations:

1. Keep your antivirus software up-to-date

2. If you download software from the web or from FTP sites, get it only from the software vendor or intermediaries you trust, not from unknown third parties

3. NEVER ACCEPT UNSOLICITED EMAIL ATTACHMENTS, even when they appear to come from those you know and trust.

For virus or hoax info, please see our main page (http://www.umich.edu/~virus-busters/) or go to another reputable site, like DataFellows (leaving our site).

   -BPB

visits to this page since 13 December, 1999 12:40 EDT