(Fwd) Re: Good times virus

My post of the "Good Times" virus to Cypherpunks got me
bar-b-qued as completely clueless, dumb and deserving of
whatever I got for taking such nonsense seriously.

OTOH, there was lively discussion about how such a hoax might
be technically possibly, that is, how email could be used to
distribute an executable file just by reading.  Some wizards
thought it easily possible, and posted a slew of code
instructions, leads, precedents and rants, while some violently
disagreed and invoked their own unassailable authorities.

After about 2 dozen exchanges the heat cooled, especially after
the notice below was posted by a calm-minded c'punk who took
the time to check with CIAC.  However, there are a few messages
still coming in showing that more than one person is exploring
how to make such a virus.

So virus design continues as appropriate to the multi-faceted
Design-L cornucopia.

Crispy Critter


Forwarding Cypherpunk mail by: jdwilson@xxxxxxxxxxxxxxxxxxxx
(NetSurfer) on Tue, 6 Dec 11:34 PM
-------------------

According to CIAC:

>From karyn@xxxxxxxxxxxxxxxx Tue Dec  6 23:34:02 1994  Date:
Tue, 6 Dec 1994 15:26:51 -0800
From: Karyn Pichnarczyk <karyn@xxxxxxxxxxxxxxxx>
To: jdwilson@xxxxxxxxxxxxxxxxxxxx
Subject: CIAC Notes 94-04


             U.S. DOE's Computer Incident Advisory Capability
           ___  __ __    _     ___           __  __ __   __
__
          /       |     /_\   /       |\ |  /  \   |    |_   /_
          \___  __|__  /   \  \___    | \|  \__/   |    |__
__/

Number 94-04
December 6, 1994

 ------------------- A - T - T - E - N - T - I - O - N
-------------------
|  CIAC is available 24-hours a day via its two skypage
numbers.  To use  |  |  this service, dial 1-800-759-7243.  The
PIN numbers are: 8550070 (for  |  |  the CIAC duty person) and
8550074 (for the CIAC manager).  Please keep |  |  these
numbers handy.
 |
-----------------------------------------------------------------
--------

Welcome to the fourth issue of CIAC Notes!  This is a special
edition to  clear up recent reports of a "good times"
virus-hoax.  Let us know if you  have topics you would like
addressed or have feedback on what is useful and  what is not.
Please contact the editor, Allan L. Van Lehn, CIAC,
510-422-8193 or send E-mail to ciac@xxxxxxxxx


$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
-$-$-$  $ Reference to any specific commercial product does not
necessarily   $  $ constitute or imply its endorsement,
recommendation or favoring by  $  $ CIAC, the University of
California, or the United States Government.$
$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
-$-$-$

THE "Good Times" VIRUS IS AN URBAN LEGEND

In the early part of December, CIAC started to receive
information requests  about a supposed "virus" which could be
contracted via America OnLine, simply  by reading a message.
The following is the message that CIAC received:


-----------------------------------------------------------------
----------
| Here is some important information. Beware of a file called
Goodtimes.    |  |
                             |  |  Happy Chanukah everyone, and
be careful out there. There is a virus on   |  | America Online
being sent by E-Mail.  If you get anything called "Good    |  |
Times", DON'T read it or download it.  It is a virus that will
erase your |  | hard drive.  Forward this to all your friends.
It may help them a lot.   |
-----------------------------------------------------------------
----------

THIS IS A HOAX.  Upon investigation, CIAC has determined that
this message  originated from both a user of America Online and
a student at a university  at approximately the same time, and
it was meant to be a hoax.

CIAC has also seen other variations of this hoax, the main one
is that any  electronic mail message with the subject line of
"xxx-1" will infect your  computer.

This rumor has been spreading very widely.  This spread is due
mainly to the  fact that many people have seen a message with
"Good Times" in the header. They delete the message without
reading it, thus believing that they have  saved themselves
from being attacked. These first-hand reports give a false
sense of credibility to the alert message.

There has been one confirmation of a person who received a
message with  "xxx-1" in the header, but an empty message body.
 Then, (in a panic, because  he had heard the alert), he
checked his PC for viruses (the first time he  checked his
machine in months) and found a pre-existing virus on his
machine. He incorrectly came to the conclusion that the E-mail
message gave him the  virus (this particular virus could NOT
POSSIBLY have spread via an E-mail  message).  This person then
spread his alert.

As of this date, there are no known viruses which can infect
merely through  reading a mail message.  For a virus to spread
some program must be executed.  Reading a mail message does not
execute the mail message.  Yes, Trojans have  been found as
executable attachments to mail messages, the most notorious
being the IBM VM Christmas Card Trojan of 1987, also the TERM
MODULE Worm  (reference CIAC Bulletin B-7) and the GAME2 MODULE
Worm (CIAC Bulletin B-12). But this is not the case for this
particular "virus" alert.

If you encounter this message being distributed on any mailing
lists, simply  ignore it or send a follow-up message stating
that this is a false rumor.

Karyn Pichnarczyk
CIAC Team
ciac@xxxxxxxx


------------------------------
Contacting CIAC

If you require additional assistance or wish to report a
vulnerability, call  CIAC at 510-422-8193, fax messages to
510-423-8002 or send E-mail to  ciac@xxxxxxxxx  For emergencies
and off-hour assistance, call 1-800-SKY-PAGE  (759-7243) and
enter PIN number 8550070 (primary) or 8550074 (secondary). The
CIAC Duty Officer, a rotating responsibility, carries the
primary  skypager. The Project Leader carries the secondary
skypager.  If you are  unable to contact CIAC via phone, please
use the skypage system.

------------------------------
This document was prepared as an account of work sponsored by
an agency of  the United States Government.  Neither the United
States Government nor the  University of California nor any of
their employees, makes any warranty,  express or implied, or
assumes any legal liability or responsibility for the
accuracy, completeness, or usefulness of any information,
apparatus, product,  or process disclosed, or represents that
its use would not infringe privately  owned rights.  Reference
herein to any specific commercial products, process,  or
service by trade name, trademark, manufacturer, or otherwise,
does not  necessarily constitute or imply its endorsement,
recommendation or favoring  by the United States Government or
the University of California.  The views  and opinions of
authors expressed herein do not necessarily state or reflect
those of the United States Government or the University of
California, and  shall not be used for advertising or product
endorsement purposes.

------------------------------
End of CIAC Notes Number 94-04  94_12_06
****************************************