>Date: Wed, 7 Dec 1994 11:03:26 EST
>Reply-To: Melissa Spurr <spurr at BEDFORD.PROGRESS.COM>
>Sender: CONSLINK - The Conservation Network
><CONSLINK%SIVM.BITNET at VTBIT.CC.VT.EDU>
>From: Melissa Spurr <spurr at BEDFORD.PROGRESS.COM>
>Subject: virus hoax
>To: Multiple recipients of list CONSLINK
><CONSLINK%SIVM.BITNET at VTBIT.CC.VT.EDU>
>
>===========================================================
>Message Forwarded by Luke Taylor (taylor at bedford.progress.COM):
>(Forwards Deleted)
>
>>
>>
>> While not being relevent to the discussion of these lists the earlier
>> posts involving the supposed virus being sent by mail does deserve this
>> information.
>>
>>
>> U.S. DOE's Computer Incident Advisory Capability
>> ___ __ __ _ ___ __ __ __ __ __
>> / | /_\ / |\ | / \ | |_ /_
>> \___ __|__ / \ \___ | \| \__/ | |__ __/
>>
>> Number 94-04 December 6, 1994
>>
>> ------------------- A - T - T - E - N - T - I - O - N -------------------
>> | CIAC is available 24-hours a day via its two skypage numbers. To use |
>> | this service, dial 1-800-759-7243. The PIN numbers are: 8550070 (for |
>> | the CIAC duty person) and 8550074 (for the CIAC manager). Please keep |
>> | these numbers handy. |
>> -------------------------------------------------------------------------
>>
>> Welcome to the fourth issue of CIAC Notes! This is a special edition to
>> clear up recent reports of a "good times" virus-hoax. Let us know if you
>> have topics you would like addressed or have feedback on what is useful and
>> what is not. Please contact the editor, Allan L. Van Lehn, CIAC,
>> 510-422-8193 or send E-mail to ciac at llnl.gov.
>>
>> $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
>> $ Reference to any specific commercial product does not necessarily $
>> $ constitute or imply its endorsement, recommendation or favoring by $
>> $ CIAC, the University of California, or the United States Government.$
>> $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
>>
>> THE "Good Times" VIRUS IS AN URBAN LEGEND
>>
>> In the early part of December, CIAC started to receive information requests
>> about a supposed "virus" which could be contracted via America OnLine,
>> simply by reading a message. The following is the message that CIAC
>received:
>>
>> ---------------------------------------------------------------------------
>> | Here is some important information. Beware of a file called Goodtimes. |
>> |
>> | Happy Chanukah everyone, and be careful out there. There is a virus on |
>> | America Online being sent by E-Mail. If you get anything called "Good |
>> | Times", DON'T read it or download it. It is a virus that will erase your
>|
>> | hard drive. Forward this to all your friends. It may help them a lot. |
>> ---------------------------------------------------------------------------
>>
>> THIS IS A HOAX. Upon investigation, CIAC has determined that this message
>> originated from both a user of America Online and a student at a university
>> at approximately the same time, and it was meant to be a hoax.
>>
>> CIAC has also seen other variations of this hoax, the main one is that any
>> electronic mail message with the subject line of "xxx-1" will infect your
>> computer.
>>
>> This rumor has been spreading very widely. This spread is due mainly to the
>> fact that many people have seen a message with "Good Times" in the header.
>> They delete the message without reading it, thus believing that they have
>> saved themselves from being attacked. These first-hand reports give a false
>> sense of credibility to the alert message.
>>
>> There has been one confirmation of a person who received a message with
>> "xxx-1" in the header, but an empty message body. Then, (in a panic, because
>> he had heard the alert), he checked his PC for viruses (the first time he
>> checked his machine in months) and found a pre-existing virus on his
>> machine. He incorrectly came to the conclusion that the E-mail message
>> gave him the virus (this particular virus could NOT POSSIBLY have spread
>> via an E-mail message). This person then spread his alert.
>>
>> As of this date, there are no known viruses which can infect merely through
>> reading a mail message. For a virus to spread some program must be
>executed.
>> Reading a mail message does not execute the mail message. Yes, Trojans have
>> been found as executable attachments to mail messages, the most notorious
>> being the IBM VM Christmas Card Trojan of 1987, also the TERM MODULE Worm
>> (reference CIAC Bulletin B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-
>> 12).
>> But this is not the case for this particular "virus" alert.
>>
>> If you encounter this message being distributed on any mailing lists, simply
>> ignore it or send a follow-up message stating that this is a false rumor.
>>
>> Karyn Pichnarczyk
>> CIAC Team
>> ciac at llnl.gov
>>
>>
>> ------------------------------
>> Contacting CIAC
>>
>> If you require additional assistance or wish to report a vulnerability, call
>> CIAC at 510-422-8193, fax messages to 510-423-8002 or send E-mail to
>> ciac at llnl.gov. For emergencies and off-hour assistance, call 1-800-SKY-PAGE
>> (759-7243) and enter PIN number 8550070 (primary) or 8550074 (secondary).
>> The CIAC Duty Officer, a rotating responsibility, carries the primary
>> skypager. The Project Leader carries the secondary skypager. If you are
>> unable to contact CIAC via phone, please use the skypage system.
>>
>> ------------------------------
>> This document was prepared as an account of work sponsored by an agency of
>> the United States Government. Neither the United States Government nor the
>> University of California nor any of their employees, makes any warranty,
>> express or implied, or assumes any legal liability or responsibility for the
>> accuracy, completeness, or usefulness of any information, apparatus,
>product,
>> or process disclosed, or represents that its use would not infringe
>privately
>> owned rights. Reference herein to any specific commercial products,
>> process, or service by trade name, trademark, manufacturer, or otherwise,
>> does not necessarily constitute or imply its endorsement, recommendation
>> or favoring by the United States Government or the University of
>> California. The views and opinions of authors expressed herein do not
>> necessarily state or reflect those of the United States Government or the
>> University of California, and shall not be used for advertising or product
>> endorsement purposes.
>>
>> ------------------------------
>> End of CIAC Notes Number 94-04 94_12_06
>> ****************************************
>>
>>
>> --
>> Steven Kusnitz ab786 at lafn.org mhkb13a at prodigy.com
>> 76374.72 at compuserve.com stevek26 at aol.com s.l.kusnitz at genie.geis.com
>>
>> ---
>> Administrivia:
>> The rest of this message is automatically appended by the mail exploder.
>> To make a posting, send mail to "saturn at oar.net".
>> To reach a human who mucks with mail administrative matters (including
>> adding or deleting you from the list), send mail to
>"saturn-request at oar.net".
>> To change to/from the digest format, send mail to "saturn-request at oar.net".
>> To retrieve archives and/or pictures, anonymous ftp to
>ftp.oar.net:/pub/saturn.
>> If you have WWW access, use the URL http://www.physics.sunysb.edu/Saturn/.
>> Note that this list and the newsgroup are separate, but we're all still
>> happy Saturn owners!
>> ---
>===========================================================
>End of Forwarded Message
>===========================================================
>Hope this clears up a few things.
>
>
>----- End Included Message -----

Dennis Paulson phone: (206) 756-3798
Slater Museum of Natural History fax: (206) 756-3352
University of Puget Sound e-mail: dpaulson at ups.edu
Tacoma, WA 98416