Article View: bit.listserv.devmedia
Article #1330bogus virus alert debunked (fwd)
From: Kent Wakely
Date: Thu, 08 Dec 1994 09:10
Date: Thu, 08 Dec 1994 09:10
129 lines
8045 bytes
8045 bytes
FYI Kent ------------------------------------------------------------------------------ Kent Wakely Internet: kwakely@uoguelph.ca http://tdg.uoguelph.ca/~kwakely/ kwakely@tdg.uoguelph.ca ------------------------------------------------------------------------------ ---------- Forwarded message ---------- Date: Wed, 7 Dec 1994 11:16:44 -0800 From: Phil Agre <pagre@weber.ucsd.edu> To: rre@weber.ucsd.edu Subject: bogus virus alert debunked [I've removed many headers.] > >------- Forwarded Message > > U.S. DOE's Computer Incident Advisory Capability > ___ __ __ _ ___ __ __ __ __ __ > / | /_\ / |\ | / \ | |_ /_ > \___ __|__ / \ \___ | \| \__/ | |__ __/ > >Number 94-04 December 6, 1994 > > ------------------- A - T - T - E - N - T - I - O - N ------------------- >| CIAC is available 24-hours a day via its two skypage numbers. To use | >| this service, dial 1-800-759-7243. The PIN numbers are: 8550070 (for | >| the CIAC duty person) and 8550074 (for the CIAC manager). Please keep | >| these numbers handy. | > ------------------------------------------------------------------------- > >Welcome to the fourth issue of CIAC Notes! This is a special edition to >clear up recent reports of a "good times" virus-hoax. Let us know if you >have topics you would like addressed or have feedback on what is useful and >what is not. Please contact the editor, Allan L. Van Lehn, CIAC, >510-422-8193 or send E-mail to ciac@llnl.gov. > > $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$ > $ Reference to any specific commercial product does not necessarily $ > $ constitute or imply its endorsement, recommendation or favoring by $ > $ CIAC, the University of California, or the United States Government.$ > $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$ > >THE "Good Times" VIRUS IS AN URBAN LEGEND > >In the early part of December, CIAC started to receive information requests >about a supposed "virus" which could be contracted via America OnLine, simply >by reading a message. The following is the message that CIAC received: > > --------------------------------------------------------------------------- >| Here is some important information. Beware of a file called Goodtimes. | >| | >| Happy Chanukah everyone, and be careful out there. There is a virus on | >| America Online being sent by E-Mail. If you get anything called "Good | >| Times", DON'T read it or download it. It is a virus that will erase your | >| hard drive. Forward this to all your friends. It may help them a lot. | > --------------------------------------------------------------------------- > >THIS IS A HOAX. Upon investigation, CIAC has determined that this message >originated from both a user of America Online and a student at a university >at approximately the same time, and it was meant to be a hoax. > >CIAC has also seen other variations of this hoax, the main one is that any >electronic mail message with the subject line of "xxx-1" will infect your >computer. > >This rumor has been spreading very widely. This spread is due mainly to the >fact that many people have seen a message with "Good Times" in the header. >They delete the message without reading it, thus believing that they have >saved themselves from being attacked. These first-hand reports give a false >sense of credibility to the alert message. > >There has been one confirmation of a person who received a message with >"xxx-1" in the header, but an empty message body. Then, (in a panic, because >he had heard the alert), he checked his PC for viruses (the first time he >checked his machine in months) and found a pre-existing virus on his machine. > He incorrectly came to the conclusion that the E-mail message gave him the >virus (this particular virus could NOT POSSIBLY have spread via an E-mail >message). This person then spread his alert. > >As of this date, there are no known viruses which can infect merely through >reading a mail message. For a virus to spread some program must be executed. >Reading a mail message does not execute the mail message. Yes, Trojans have >been found as executable attachments to mail messages, the most notorious >being the IBM VM Christmas Card Trojan of 1987, also the TERM MODULE Worm >(reference CIAC Bulletin B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-12). > But this is not the case for this particular "virus" alert. > >If you encounter this message being distributed on any mailing lists, simply >ignore it or send a follow-up message stating that this is a false rumor. > >Karyn Pichnarczyk >CIAC Team >ciac@llnl.gov > > >- ------------------------------ >Contacting CIAC > >If you require additional assistance or wish to report a vulnerability, call >CIAC at 510-422-8193, fax messages to 510-423-8002 or send E-mail to >ciac@llnl.gov. For emergencies and off-hour assistance, call 1-800-SKY-PAGE >(759-7243) and enter PIN number 8550070 (primary) or 8550074 (secondary). >The CIAC Duty Officer, a rotating responsibility, carries the primary >skypager. The Project Leader carries the secondary skypager. If you are >unable to contact CIAC via phone, please use the skypage system. > >- ------------------------------ >This document was prepared as an account of work sponsored by an agency of >the United States Government. Neither the United States Government nor the >University of California nor any of their employees, makes any warranty, >express or implied, or assumes any legal liability or responsibility for the >accuracy, completeness, or usefulness of any information, apparatus, product, >or process disclosed, or represents that its use would not infringe privately >owned rights. Reference herein to any specific commercial products, process, >or service by trade name, trademark, manufacturer, or otherwise, does not >necessarily constitute or imply its endorsement, recommendation or favoring >by the United States Government or the University of California. The views >and opinions of authors expressed herein do not necessarily state or reflect >those of the United States Government or the University of California, and >shall not be used for advertising or product endorsement purposes. > >- ------------------------------ >End of CIAC Notes Number 94-04 94_12_06 >****************************************
Technical Details
Message-ID:
<Pine.3.89.9412080445.A1514-0100000@gadwall.cs.uoguelph.ca>Path:
arc1-ca.pugleaf.net!bga.com!news.sprintlink.net!howland.reston.ans.net!paladin.american.edu!auvm!uoguelph.ca!kwakelyShow Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 105940,c417f056fe265c7e,start X-Google-Attributes: gid105940,public X-Google-ArrivalTime: 1994-12-08 04:46:49 PST Path: arc1-ca.pugleaf.net!bga.com!news.sprintlink.net!howland.reston.ans.net!paladin.american.edu!auvm!uoguelph.ca!kwakely Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU Newsgroups: bit.listserv.devmedia Comments: ******************************************************** Comments: * The following "Approved" statement verifies header * Comments: * information for gateway passage. No approval of the * Comments: * content is implied. * Approved: NETNEWS@AUVM.AMERICAN.EDU * Comments: ******************************************************** Date: Thu, 8 Dec 1994 04:10:33 -0500 Message-ID: <Pine.3.89.9412080445.A1514-0100000@gadwall.cs.uoguelph.ca> Errors-To: kwakely@uoguelph.ca Reply-To: devmedia@uoguelph.ca Originator: devmedia@uoguelph.ca Sender: devmedia@uoguelph.ca Precedence: bulk From: Kent Wakely <kwakely@uoguelph.ca> Subject: bogus virus alert debunked (fwd) X-Listprocessor-Version: 6.0c -- ListProcessor by Anastasios Kotsikonas X-Comment: Media for Development in Democracy Lines: 130