>From shinberg@ssc.wisc.edu Wed Dec 7 09:18:01 1994 Received: from eunice.ssc.wisc.edu (eunice.ssc.wisc.edu [128.104.110.26]) by csf.Colorado.EDU (8.6.9/8.6.9/CNS-3.5) with SMTP id JAA28963 for ; Wed, 7 Dec 1994 09:17:59 -0700 Received: from SOC3.DECnet MAIL11D_V3 by eunice.ssc.wisc.edu; id AA27472; 5.65/42; Wed, 7 Dec 1994 10:21:25 -0600 Date: Wed, 7 Dec 1994 10:21:25 -0600 Message-Id: <9412071621.AA27472@eunice.ssc.wisc.edu> From: shinberg@ssc.wisc.edu (Diane) To: "ppn@csf.colorado.edu"@ssc.wisc.edu Subject: virus hoax update > U.S. DOE's Computer Incident Advisory Capability > ___ __ __ _ ___ __ __ __ __ __ > / | /_\ / |\ | / \ | |_ /_ > \___ __|__ / \ \___ | \| \__/ | |__ __/ > >Number 94-04 December 6, 1994 > > ------------------- A - T - T - E - N - T - I - O - N ------------------- >| CIAC is available 24-hours a day via its two skypage numbers. To use | >| this service, dial 1-800-759-7243. The PIN numbers are: 8550070 (for | >| the CIAC duty person) and 8550074 (for the CIAC manager). Please keep | >| these numbers handy. | > ------------------------------------------------------------------------- > >Welcome to the fourth issue of CIAC Notes! This is a special edition to >clear up recent reports of a "good times" virus-hoax. Let us know if you >have topics you would like addressed or have feedback on what is useful and >what is not. Please contact the editor, Allan L. Van Lehn, CIAC, >510-422-8193 or send E-mail to ciac@llnl.gov. > > $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$ > $ Reference to any specific commercial product does not necessarily $ > $ constitute or imply its endorsement, recommendation or favoring by $ > $ CIAC, the University of California, or the United States Government.$ > $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$ > >THE "Good Times" VIRUS IS AN URBAN LEGEND > >In the early part of December, CIAC started to receive information requests >about a supposed "virus" which could be contracted via America OnLine, simply >by reading a message. The following is the message that CIAC received: > > --------------------------------------------------------------------------- >| Here is some important information. Beware of a file called Goodtimes. | >| | >| Happy Chanukah everyone, and be careful out there. There is a virus on | >| America Online being sent by E-Mail. If you get anything called "Good | >| Times", DON'T read it or download it. It is a virus that will erase your | >| hard drive. Forward this to all your friends. It may help them a lot. | > --------------------------------------------------------------------------- > >THIS IS A HOAX. Upon investigation, CIAC has determined that this message >originated from both a user of America Online and a student at a university >at approximately the same time, and it was meant to be a hoax. > >CIAC has also seen other variations of this hoax, the main one is that any >electronic mail message with the subject line of "xxx-1" will infect your >computer. > >This rumor has been spreading very widely. This spread is due mainly to the >fact that many people have seen a message with "Good Times" in the header. >They delete the message without reading it, thus believing that they have >saved themselves from being attacked. These first-hand reports give a false >sense of credibility to the alert message. > >There has been one confirmation of a person who received a message with >"xxx-1" in the header, but an empty message body. Then, (in a panic, because >he had heard the alert), he checked his PC for viruses (the first time he >checked his machine in months) and found a pre-existing virus on his machine. > He incorrectly came to the conclusion that the E-mail message gave him the >virus (this particular virus could NOT POSSIBLY have spread via an E-mail >message). This person then spread his alert. > >As of this date, there are no known viruses which can infect merely through >reading a mail message. For a virus to spread some program must be executed. >Reading a mail message does not execute the mail message. Yes, Trojans have >been found as executable attachments to mail messages, the most notorious >being the IBM VM Christmas Card Trojan of 1987, also the TERM MODULE Worm >(reference CIAC Bulletin B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-12). > But this is not the case for this particular "virus" alert. > >If you encounter this message being distributed on any mailing lists, simply >ignore it or send a follow-up message stating that this is a false rumor. > >Karyn Pichnarczyk >CIAC Team >ciac@llnl.gov > > >- ------------------------------ >Contacting CIAC > >If you require additional assistance or wish to report a vulnerability, call >CIAC at 510-422-8193, fax messages to 510-423-8002 or send E-mail to >ciac@llnl.gov. For emergencies and off-hour assistance, call 1-800-SKY-PAGE >(759-7243) and enter PIN number 8550070 (primary) or 8550074 (secondary). >The CIAC Duty Officer, a rotating responsibility, carries the primary >skypager. The Project Leader carries the secondary skypager. If you are >unable to contact CIAC via phone, please use the skypage system. > >- ------------------------------ >This document was prepared as an account of work sponsored by an agency of >the United States Government. Neither the United States Government nor the >University of California nor any of their employees, makes any warranty, >express or implied, or assumes any legal liability or responsibility for the >accuracy, completeness, or usefulness of any information, apparatus, product, >or process disclosed, or represents that its use would not infringe privately >owned rights. Reference herein to any specific commercial products, process, >or service by trade name, trademark, manufacturer, or otherwise, does not >necessarily constitute or imply its endorsement, recommendation or favoring >by the United States Government or the University of California. The views >and opinions of authors expressed herein do not necessarily state or reflect >those of the United States Government or the University of California, and >shall not be used for advertising or product endorsement purposes. > >- ------------------------------ >End of CIAC Notes Number 94-04 94_12_06 >**************************************** > >- -- >Ted Lemon mellon@vix.com >+1 415 477 5045 > >Fight to preserve your freedom to program: Join the League for >Programming Freedom! For info, contact lpf@uunet.uu.net. > >------- End of Forwarded Message