roundtable: Re: "Good Times" virus

roundtable: Re: "Good Times" virus

Re: "Good Times" virus

Roundtable moderator (listmgr@cni.org)
Mon, 24 Apr 1995 10:36:57 -0400 (EDT) 

From: Roundtable moderator <listmgr@cni.org>
Message-Id: <9504241436.AA09286@a.cni.org>
Subject: Re: "Good Times" virus
To: roundtable@cni.org
Date: Mon, 24 Apr 1995 10:36:57 -0400 (EDT)


The message re: the "Good Times" virus should not have been posted 
to the ROUNDTABLE list.  The fact that it was posted was a slip-up, as 
the message is known to be unreliable as is evidenced by the following 
responses...  Discussion of viruses is not the focus of this list, so 
no more postings will be made on this subject.


[1]
To: roundtable@cni.org
Subject: Re: Warning of new internet virus 
Date: Sat, 22 Apr 1995 00:17:20 -0500
From: Michael Chui <mchui@cs.indiana.edu>

jane s blume <jblume@unm.edu> writes:
> 
>The virus is called "Good Times."  If you receive an email message with 
>this title in the subject line, please do not read the message.  Instead, 
>delete it immediately.  The program will rewrite your hard drive; send 
>copies of itself to everyone whose email address is contained in a 
>received-mail file or sent-mail file; and then trash the computer it is 
>running on.

     This "virus alert" is a hoax.  However, the warning message has 
some very virus-like properties...

Michael Chui
mchui@cs.indiana.edu

[2]
Date: Sat, 22 Apr 1995 01:34:11 -0400 (EDT)
From: Marshall Kragen <mkragen@access.digex.net>
To: jane s blume <jblume@unm.edu>
Cc: Telecommunications Policy Roundtabl <ROUNDTABLE@cni.org>
Subject: Re: Warning of new internet virus


Please do not spread news of this further.  There is no such virus.  This 
was all spread around last Christmastime and CERT then stated there was 
no such thing.  You can't spread a virus by e-mail.  Further, if you will 
look closely at this, it was started on April 1 and states something to 
the effect of an n-th infinite loop which happens to be something out of 
a Star Trek episode.  Meanwhile, I've seen this posted all over again, 
wasting precious bandwidth again.

*****************************************************************************
Marshall Kragen            /\  Internet liaison for National Coalition
mkragen@access.digex.net   \/  for Cancer Survivorship (NCCS), 1010 Wayne 
gwrepmk@aol.com            \/  Avenue, Silver Spring, MD 20910 (301)650-8868
                           
[3]
Date: Sat, 22 Apr 1995 12:29:01 -0400 (EDT)
From: David Levine <motodave@butterfly.net>
To: roundtable@cni.org
Subject: Good Times


I've gotten notes form many respectable people warning me not to read a
message titled good times. 

I've been hearing about this virus for 5 or 6 months and it is starting 
to annoy me.

My guess is that the "virus" is a meme, sort of like a chain letter, that 
is replicated by concerned people contacting their peers.

A Zeos 486 where I used to work got "stoned" by a file transfer from 
Paris, and could do nothing but print "you are now stoned" to the screen. 
The hard disk was fragmented beyond repair.

My question: by titling this email Good Times, am I transmitting the virus
or innoculating against it? Am I increasing the risk of infection by
lowering apprehensions of a "real" threat, or am I strengthening 
resistance agains such memes by introducing critical thought?

--Dave
http://iron.butterfly.net/motodave


[4]
To: David Levine <motodave@butterfly.net>
Cc: roundtable@cni.org
Subject: Re: email meta-virus [Com-Priv Digest V3 #106]
Date: Sun, 23 Apr 1995 13:48:40 -0400
From: Ed Frankenberry <ezf@osf.org>


> My guess is that the "virus" is a meme, sort of like a chain letter, that 
> is replicated by concerned people contacting their peers.

Exactly right.  The original hoax surfaced in December 1994 and now
appears to be making the rounds again (with some variations).

> or am I strengthening resistance agains such memes by introducing
> critical thought?

Let's hope it's the latter so we can quash this meta-virus now!
     Ed Frankenberry
p.s. - here's the CIAC explanation:

================================================================

                CIAC Notes

Number 94-04c:December 8, 1994 

Welcome to the fourth issue of CIAC Notes! This is a special edition
to clear up recent reports of a "good times" virus-hoax.  Let us know
if you have topics you would like addressed or have feedback on what
is useful and what is not. Please contact the editor, Allan L. Van
Lehn, CIAC, 510-422-8193 or send E-mail to ciac@llnl.gov.

Reference to any specific commercial product does not necessarily
constitute or imply its endorsement, recommendation or favoring by
CIAC, the University of California, or the United States Government.


THE "Good Times" VIRUS IS AN URBAN LEGEND

In the early part of December, CIAC started to receive information
requests about a supposed "virus" which could be contracted via
America OnLine, simply by reading a message.  The following is the
message that CIAC received:

 Here is some important information.  Beware of a file called Goodtimes. 

 Happy Chanukah everyone, and be careful out there. There is a virus on America
 Online being sent by E-Mail. If you get anything called "Good Times",
 DON'T read it or download it.  It is a virus that will erase your hard
 drive.  Forward this to all your friends.  It may help them a lot.

THIS IS A HOAX.  Upon investigation, CIAC has determined that this message
originated from both a user of America Online and a student at a university
at approximately the same time, and it was meant to be a hoax.

CIAC has also seen other variations of this hoax, the main one is that
any electronic mail message with the subject line of "xxx-1" will
infect your computer.

This rumor has been spreading very widely.  This spread is due mainly
to the fact that many people have seen a message with "Good Times" in
the header.  They delete the message without reading it, thus
believing that they have saved themselves from being attacked.
These first-hand reports give a false sense of credibility to the
alert message.

There has been one confirmation of a person who received a message
with "xxx-1" in the header, but an empty message body.  Then, (in a
panic, because he had heard the alert), he checked his PC for viruses
(the first time he checked his machine in months) and found a
pre-existing virus on his machine.  He incorrectly came to the
conclusion that the E-mail message gave him the virus (this particular
virus could NOT POSSIBLY have spread via an E-mail message).  This
person then spread his alert.

As of this date, there are no known viruses which can infect merely
through reading a mail message.  For a virus to spread some program
must be executed.  Reading a mail message does not execute the mail
message.  Yes, Trojans have been found as executable attachments to
mail messages, the most notorious being the IBM VM Christmas Card
Trojan of 1987, also the TERM MODULE Worm (reference CIAC Bulletin
B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-12).  But this is not
the case for this particular "virus" alert.

If you encounter this message being distributed on any mailing lists,
simply ignore it or send a follow-up message stating that this is a
false rumor.

Karyn Pichnarczyk
CIAC Team
ciac@llnl.gov 


WHO IS CIAC?

CIAC is the U.S. Department of Energy's Computer Incident Advisory 
Capability. Established in 1989, shortly after the Internet Worm, CIAC 
provides various computer security services free of charge to employees 
and contractors of the DOE, such as: Incident Handling consulting, 
Computer Security Information, On-site Workshops, White-hat Audits.

CIAC is located at Lawrence Livermore National Laboratory and is a
part of its Computer Security Technology Center.  CIAC is also a
founding member of FIRST, the Forum of Incident Response and Security
Teams, a global organization established to foster cooperation and
coordination among computer security teams worldwide.


CONTACTING CIAC

If you require additional assistance or wish to report a
vulnerability, call CIAC at 510-422-8193, fax messages to 510-423-8002
or send E-mail to ciac@llnl.gov.

ATTENTION: For emergencies and off-hour assistance, CIAC is available 
24-hours a day to DOE and DOE contractors via an integrated voicemail 
and SKYPAGE number.  To use this service, dial 1-510-422-8193 or
1-800-759-7243 (SKYPAGE).  The primary SKYPAGE PIN number, 8550070 is
for the CIAC duty person.  A second PIN, 8550074 is for the CIAC
Project Leader. Keep these numbers handy.

CIAC's ELECTRONIC PUBLICATIONS

Previous CIAC Bulletins and other information are available via
anonymous FTP from ciac.llnl.gov.

CIAC has several self-subscribing mailing lists for electronic publications: 

 1. CIAC-BULLETIN for Advisories, highest priority - time critical
    information, and Bulletins, important computer security information; 
 2. CIAC-NOTES for Notes, a collection of computer security articles; 
 3. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI)
    software updates, new features, distribution and availability; 
 4. SPI-NOTES, for discussion of problems and solutions regarding the
    use of SPI products.

Our mailing lists are managed by a public domain software package called
ListProcessor, which ignores E-mail header subject lines.  To subscribe
(add yourself) to one of our mailing lists, send requests of the
following form:

subscribe list-name LastName, FirstName PhoneNumber

as the E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES,
SPI-ANNOUNCE or SPI-NOTES for "list-name" and valid information for
"LastName" "FirstName" and "PhoneNumber."  Send to:
ciac-listproc@llnl.gov (NOT to: ciac@llnl.gov)

e.g., 

subscribe ciac-notes O'Hara, Scarlett 404-555-1212 x36
subscribe ciac-bulletin O'Hara, Scarlett 404-555-1212 x36

You will receive an acknowledgment containing address and initial PIN,
and information on how to change either of them, cancel your
subscription, or get help.

To subscribe an address which is a distribution list, first subscribe
the person responsible for your distribution list.  You will receive an
acknowledgment (as described above).  Change the address to the
distribution list by sending a second E-mail request.  As the body of
this message, substitute valid information for "list-name," "PIN", and
"address of the distribution list" when sending

E-mail to ciac-listproc@llnl.gov: 

        set  list-name  address  PIN  distribution_list_address
  e.g., set ciac-notes address 001860 remailer@tara.georgia.orb

To be removed from a mailing list, send the following request via 

E-mail to ciac-listproc@llnl.gov: 

        unsubscribe  list-name
  e.g., unsubscribe ciac-notes

For more information, send the following request: 

        help

If you have any questions about this list, you may contact the list's 
owner: listmanager@cheetah.llnl.gov. 

This document was prepared as an account of work sponsored by an agency 
of the United States Government.  Neither the United States Government 
nor the University of California nor any of their employees, makes any
warranty, express or implied, or assumes any legal liability or
responsibility for the accuracy, completeness, or usefulness of any
information, apparatus, product, or process disclosed, or represents
that its use would not infringe privately owned rights.  Reference
herein to any specific commercial products, process, or service by
trade name, trademark, manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation or
favoring by the United States Government or the University of
California.  The views and opinions of authors expressed herein do not
necessarily state or reflect those of the United States Government or
the University of California, and shall not be used for advertising or
product endorsement purposes.

End of CIAC Notes Number 94-04c 94_12_08
UCRL-MI-119788 
****************************************

[CNI Home Page]