Message-Id: <mailto:199504191315.IAA28724@library.wustl.edu> Date: Wed, 19 Apr 1995 08:09:31 -0500 From: Toni Schulenburg <mailto:toni@ACCESS.TEXAS.GOV> Subject: Re: Virus Alert To: Multiple recipients of list IMAGELIB
>Date: Wed, 19 Apr 1995 07:56:04 -0600 (CST)
>From: Ed Stuart <mailto:ES12453@swt.edu>
>Subject: Already Knew About "Good Times"
>To: mailto:toni@access.texas.gov
>Organization: Southwest Texas State University
>X-Vms-To: IN%"mailto:toni@access.texas.gov"
>
> Here's the "offical" report on the "Good Times" virus from the DOE's
> Computer Security group.
>
> Ed
>
>
> U.S. DOE's Computer Incident Advisory Capability
> ___ __ __ _ ___ __ __ __ __ __
> / | /_\ / |\ | / \ | |_ /_
> \___ __|__ / \ \___ | \| \__/ | |__ __/
>
>Number 94-04c December 8, 1994
>
>Welcome to the fourth issue of CIAC Notes! This is a special edition to
>clear up recent reports of a "good times" virus-hoax. Let us know if you
>have topics you would like addressed or have feedback on what is useful and
>what is not. Please contact the editor, Allan L. Van Lehn, CIAC,
>510-422-8193 or send E-mail to mailto:ciac@llnl.gov.
>
> $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
> $ Reference to any specific commercial product does not necessarily $
> $ constitute or imply its endorsement, recommendation or favoring by $
> $ CIAC, the University of California, or the United States Government.$
> $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
>
>THE "Good Times" VIRUS IS AN URBAN LEGEND
>
>In the early part of December, CIAC started to receive information requests
>about a supposed "virus" which could be contracted via America OnLine, simply
>by reading a message. The following is the message that CIAC received:
>
> ---------------------------------------------------------------------------
>| Here is some important information. Beware of a file called Goodtimes. |
>| |
>| Happy Chanukah everyone, and be careful out there. There is a virus on |
>| America Online being sent by E-Mail. If you get anything called "Good |
>| Times", DON'T read it or download it. It is a virus that will erase your |
>| hard drive. Forward this to all your friends. It may help them a lot. |
> ---------------------------------------------------------------------------
>
>THIS IS A HOAX. Upon investigation, CIAC has determined that this message
>originated from both a user of America Online and a student at a university
>at approximately the same time, and it was meant to be a hoax.
>
>CIAC has also seen other variations of this hoax, the main one is that any
>electronic mail message with the subject line of "xxx-1" will infect your
>computer.
>
>This rumor has been spreading very widely. This spread is due mainly to the
>fact that many people have seen a message with "Good Times" in the header.
>They delete the message without reading it, thus believing that they have
>saved themselves from being attacked. These first-hand reports give a false
>sense of credibility to the alert message.
>
>There has been one confirmation of a person who received a message with
>"xxx-1" in the header, but an empty message body. Then, (in a panic, because
>he had heard the alert), he checked his PC for viruses (the first time he
>checked his machine in months) and found a pre-existing virus on his machine.
> He incorrectly came to the conclusion that the E-mail message gave him the
>virus (this particular virus could NOT POSSIBLY have spread via an E-mail
>message). This person then spread his alert.
>
>As of this date, there are no known viruses which can infect merely through
>reading a mail message. For a virus to spread some program must be executed.
>Reading a mail message does not execute the mail message. Yes, Trojans have
>been found as executable attachments to mail messages, the most notorious
>being the IBM VM Christmas Card Trojan of 1987, also the TERM MODULE Worm
>(reference CIAC Bulletin B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-12).
> But this is not the case for this particular "virus" alert.
>
>If you encounter this message being distributed on any mailing lists, simply
>ignore it or send a follow-up message stating that this is a false rumor.
>
>Karyn Pichnarczyk
>CIAC Team
mailto:>mailto:ciac@llnl.gov >
>
>------------------------------
>
>WHO IS CIAC?
>
>CIAC is the U.S. Department of Energy's Computer Incident Advisory
>Capability. Established in 1989, shortly after the Internet Worm, CIAC
>provides various computer security services free of charge to employees
>and contractors of the DOE, such as: Incident Handling consulting, Computer
>Security Information, On-site Workshops, White-hat Audits.
>
>CIAC is located at Lawrence Livermore National Laboratory and is a part of
>its Computer Security Technology Center. CIAC is also a founding member of
>FIRST, the Forum of Incident Response and Security Teams, a global
>organization established to foster cooperation and coordination among
>computer security teams worldwide.
>
>CONTACTING CIAC
>
>If you require additional assistance or wish to report a vulnerability, call
>CIAC at 510-422-8193, fax messages to 510-423-8002 or send E-mail to
mailto:>mailto:ciac@llnl.gov. >
> ------------------- A - T - T - E - N - T - I - O - N ---------------------
>| For emergencies and off-hour assistance, CIAC is available 24-hours a day |
>| to DOE and DOE contractors via an integrated voicemail and SKYPAGE number.|
>| To use this service, dial 1-510-422-8193 or 1-800-759-7243 (SKYPAGE). The |
>| primary SKYPAGE PIN number, 8550070 is for the CIAC duty person. A second |
>| PIN, 8550074 is for the CIAC Project Leader. Keep these numbers handy. |
> ---------------------------------------------------------------------------
>
>CIAC's ELECTRONIC PUBLICATIONS
>
>Previous CIAC Bulletins and other information are available via anonymous
>FTP from ciac.llnl.gov.
>
>CIAC has several self-subscribing mailing lists for electronic publications:
>1. CIAC-BULLETIN for Advisories, highest priority - time critical
> information, and Bulletins, important computer security information;
>2. CIAC-NOTES for Notes, a collection of computer security articles;
>3. SPI-ANNOUNCE for official news about Security Profile Inspector (SPI)
> software updates, new features, distribution and availability;
>4. SPI-NOTES, for discussion of problems and solutions regarding the use of
> SPI products.
>
>Our mailing lists are managed by a public domain software package called
>ListProcessor, which ignores E-mail header subject lines. To subscribe (add
>yourself) to one of our mailing lists, send requests of the following form:
>
>subscribe list-name LastName, FirstName PhoneNumber
>
>as the E-mail message body, substituting CIAC-BULLETIN, CIAC-NOTES,
>SPI-ANNOUNCE or SPI-NOTES for "list-name" and valid information for
>"LastName" "FirstName" and "PhoneNumber." Send to: mailto:ciac-listproc@llnl.gov
>not to: mailto:ciac@llnl.gov
>
>e.g.,
>subscribe ciac-notes O'Hara, Scarlett 404-555-1212 x36
>subscribe ciac-bulletin O'Hara, Scarlett 404-555-1212 x36
>
>You will receive an acknowledgment containing address and initial PIN, and
>information on how to change either of them, cancel your subscription, or get
>help.
>
>To subscribe an address which is a distribution list, first subscribe the
>person responsible for your distribution list. You will receive an
>acknowledgment (as described above). Change the address to the distribution
>list by sending a second E-mail request. As the body of this message,
>substitute valid information for "list-name," "PIN", and "address of the
>distribution list" when sending
>
>E-mail to mailto:ciac-listproc@llnl.gov:
> set list-name address PIN distribution_list_address
> e.g., set ciac-notes address 001860 mailto:remailer@tara.georgia.orb
>
>To be removed from a mailing list, send the following request via
>
>E-mail to mailto:ciac-listproc@llnl.gov:
> unsubscribe list-name
> e.g., unsubscribe ciac-notes
>
>For more information, send the following request:
> help
>
> If you have any questions about this list, you may contact the list's owner:
mailto:>mailto:listmanager@cheetah.llnl.gov. >
>------------------------------
>
>This document was prepared as an account of work sponsored by an agency of
>the United States Government. Neither the United States Government nor the
>University of California nor any of their employees, makes any warranty,
>express or implied, or assumes any legal liability or responsibility for the
>accuracy, completeness, or usefulness of any information, apparatus, product,
>or process disclosed, or represents that its use would not infringe privately
>owned rights. Reference herein to any specific commercial products, process,
>or service by trade name, trademark, manufacturer, or otherwise, does not
>necessarily constitute or imply its endorsement, recommendation or favoring
>by the United States Government or the University of California. The views
>and opinions of authors expressed herein do not necessarily state or reflect
>those of the United States Government or the University of California, and
>shall not be used for advertising or product endorsement purposes.
>
>------------------------------
>End of CIAC Notes Number 94-04c 94_12_08
>*****************************************
>..
>
>
>
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ Toni Schulenburg email: mailto:toni@access.texas.gov Records Manager phone: 512-322-6559 City of Austin Power & Light fax: 512-322-6037"Life is like a scooter car; not much happens unless you do some peddling."