Info on the "good times" virus hoax

[rneu _at__ RNEU.loc.gov]

----------------------------- Note follows -----------------------------
Message-Id: <9412071909.AA0960 _at__ hsan.loc.gov>
Date: Wed, 7 Dec 94 14:08:02 EST
From: hcs _at__ hsan.loc.gov
To: rneu _at__ RNEU.loc.gov, meyer _at__ mail.loc.gov, robert _at__ rccd8.loc.gov
Subject: Info on the "good times" virus hoax

   The latest. It's as Russell suspected. I personally couldn't 
understand how just reading a message could cause viral 
infection, but there's lots I don't understand.

   These opinions are my own, not those of the Library of
Congress.

                                                Howard Sanner
                                                hcs _at__ hsan.loc.gov
                                                sanner _at__ mail.loc.gov

----------------------------- Note follows -----------------------------
From: cody _at__ kbt.com (Bill Posner - Knowledge Based Technologies)
To: "The MOPAR Mailing List" <MoPar _at__ Chennov1.tamu.edu>
Subject: Info on the "good times" virus hoax
Date: Wed, 7 Dec 1994 08:25:10 -0500
Errors-To: <JJP8508 _at__ chennov1.tamu.edu>
Sender: Maiser _at__ Chennov1.tamu.edu
X-Listname: <MoPar _at__ Chennov1.tamu.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Mailer: Mercury MTA v1.13.
Message-Id: <D4A263682 _at__ Chennov1.tamu.edu>

>>From owner-banyan-l _at__ VM1.CC.UAKRON.EDU Tue Dec  6 23:45:01 1994
>Date:         Wed, 7 Dec 1994 03:32:23 GMT
>Reply-To: Banyan Networks Discussion List <BANYAN-L _at__ VM1.CC.UAKRON.EDU>
>Sender: Banyan Networks Discussion List <BANYAN-L _at__ VM1.CC.UAKRON.EDU>
>Comments:     Warning -- original Sender: tag was NETNEWS _at__ AUVM.AMERICAN.EDU
>From: Brendan McTague <mctague _at__ PILOT.MSU.EDU>
>Organization: The Eli Broad Graduate School of Management
>Subject:      Info on the "good times" virus hoax
>To: Multiple recipients of list BANYAN-L <BANYAN-L _at__ VM1.CC.UAKRON.EDU>
>
>read on ...
>
>>             U.S. DOE's Computer Incident Advisory Capability
>>           ___  __ __    _     ___           __  __ __   __   __
>>          /       |     /_\   /       |\ |  /  \   |    |_   /_
>>          \___  __|__  /   \  \___    | \|  \__/   |    |__  __/
>>
>>Number 94-04                                                December 6, 1994
>>
>> ------------------- A - T - T - E - N - T - I - O - N -------------------
>>|  CIAC is available 24-hours a day via its two skypage numbers.  To use  |
>>|  this service, dial 1-800-759-7243.  The PIN numbers are: 8550070 (for  |
>>|  the CIAC duty person) and 8550074 (for the CIAC manager).  Please keep |
>>|  these numbers handy.                                                   |
>> -------------------------------------------------------------------------
>>
>>Welcome to the fourth issue of CIAC Notes!  This is a special edition to
>>clear up recent reports of a "good times" virus-hoax.  Let us know if you
>>have topics you would like addressed or have feedback on what is useful and
>>what is not.  Please contact the editor, Allan L. Van Lehn, CIAC,
>>510-422-8193 or send E-mail to ciac _at__ llnl.gov.
>>
>>  $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
>>  $ Reference to any specific commercial product does not necessarily   $
>>  $ constitute or imply its endorsement, recommendation or favoring by  $
>>  $ CIAC, the University of California, or the United States Government.$
>>  $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
>>
>>THE "Good Times" VIRUS IS AN URBAN LEGEND
>>
>>In the early part of December, CIAC started to receive information requests
>>about a supposed "virus" which could be contracted via America OnLine, simply
>>by reading a message.  The following is the message that CIAC received:
>>
>> ---------------------------------------------------------------------------
>>| Here is some important information. Beware of a file called Goodtimes.    |
>>|                                                                           |
>>|  Happy Chanukah everyone, and be careful out there. There is a virus on   |
>>| America Online being sent by E-Mail.  If you get anything called "Good    |
>>| Times", DON'T read it or download it.  It is a virus that will erase your |
>>| hard drive.  Forward this to all your friends.  It may help them a lot.   |
>> ---------------------------------------------------------------------------
>>
>>THIS IS A HOAX.  Upon investigation, CIAC has determined that this message
>>originated from both a user of America Online and a student at a university
>>at approximately the same time, and it was meant to be a hoax.
>>
>>CIAC has also seen other variations of this hoax, the main one is that any
>>electronic mail message with the subject line of "xxx-1" will infect your
>>computer.
>>
>>This rumor has been spreading very widely.  This spread is due mainly to the
>>fact that many people have seen a message with "Good Times" in the header.
>>They delete the message without reading it, thus believing that they have
>>saved themselves from being attacked. These first-hand reports give a false
>>sense of credibility to the alert message.
>>
>>There has been one confirmation of a person who received a message with
>>"xxx-1" in the header, but an empty message body.  Then, (in a panic, because
>>he had heard the alert), he checked his PC for viruses (the first time he
>>checked his machine in months) and found a pre-existing virus on his machine.
>> He incorrectly came to the conclusion that the E-mail message gave him the
>>virus (this particular virus could NOT POSSIBLY have spread via an E-mail
>>message).  This person then spread his alert.
>>
>>As of this date, there are no known viruses which can infect merely through
>>reading a mail message.  For a virus to spread some program must be executed.
>>Reading a mail message does not execute the mail message.  Yes, Trojans have
>>been found as executable attachments to mail messages, the most notorious
>>being the IBM VM Christmas Card Trojan of 1987, also the TERM MODULE Worm
>>(reference CIAC Bulletin B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-12).
>> But this is not the case for this particular "virus" alert.
>>
>>If you encounter this message being distributed on any mailing lists, simply
>>ignore it or send a follow-up message stating that this is a false rumor.
>>
>>Karyn Pichnarczyk
>>CIAC Team
>>ciac _at__ llnl.gov
>>
>>
>>------------------------------
>>Contacting CIAC
>>
>>If you require additional assistance or wish to report a vulnerability, call
>>CIAC at 510-422-8193, fax messages to 510-423-8002 or send E-mail to
>>ciac _at__ llnl.gov.  For emergencies and off-hour assistance, call 1-800-SKY-PAGE
>>(759-7243) and enter PIN number 8550070 (primary) or 8550074 (secondary).
>>The CIAC Duty Officer, a rotating responsibility, carries the primary
>>skypager. The Project Leader carries the secondary skypager.  If you are
>>unable to contact CIAC via phone, please use the skypage system.
>>
>>------------------------------
>>This document was prepared as an account of work sponsored by an agency of
>>the United States Government.  Neither the United States Government nor the
>>University of California nor any of their employees, makes any warranty,
>>express or implied, or assumes any legal liability or responsibility for the
>>accuracy, completeness, or usefulness of any information, apparatus, product,
>>or process disclosed, or represents that its use would not infringe privately
>>owned rights.  Reference herein to any specific commercial products, process,
>>or service by trade name, trademark, manufacturer, or otherwise, does not
>>necessarily constitute or imply its endorsement, recommendation or favoring
>>by the United States Government or the University of California.  The views
>>and opinions of authors expressed herein do not necessarily state or reflect
>>those of the United States Government or the University of California, and
>>shall not be used for advertising or product endorsement purposes.
>>
>>------------------------------
>>End of CIAC Notes Number 94-04  94_12_06
>>****************************************
>
>
>
> ========================================================================
>|                     |   _  _  _  _  _   |                              |
>| Brendan McTague     |  |_)|_)| ||_|| \  | Michigan State University    |
>| Network Coordinator |  |_)| \|_|| ||_/  | 103 Eppley Center            |
>| 517-432-2184        |College of Business| East Lansing, Michigan 48824 |
> ==================== mctague _at__ pilot.msu.edu =============================
>
>
       /    \
     /        \        Bill Posner, CBS/CBI
   /  KBT  \      Senior Project Manager
   ----------       Knowledge Based Technologies, Inc.
                       617-828-5600    Fax: 617-828-1911
                      cody _at__ kbt.com    CIS: 71044,2271
                     home page: http://www.kbt.com/kbthome/staff/bill.html
                     ==============================
 Its the information highyway, sure, but I sometimes feel I'm
driving a '74 hatchback with bald tires!