Subject: Virus Warning -Forwarded -Forwarded (fwd)

From: Steve Swain <[email-masked]>
Date: Wed, 14 Aug 1996 20:03:42 -0700 (MST)

-------------------------------------------------------------------------------
swainadv                                  __  __     ____  ___       ___ ____
[email-masked]                    /__)/__) / / / / /_  /\  / /_    /
                                        /   / \  / / / / /__ /  \/ /___  /
-------------------------------------------------------------------------------

---------- Forwarded message ----------
Date: Mon, 12 Aug 1996 09:49:56 -0700
From: Steve Swain <[email-masked]>
To: [email-masked]
Subject: Virus Warning -Forwarded -Forwarded

      Date:  08/12/1996  08:00 am  (Monday)  
      From:  Neal Stites
        To:  Everyone
   Subject:  Virus Warning -Forwarded

Date: Sun, 11 Aug 1996 15:31:32 -0700
From: [email-masked] (Mike Basson SUN Phoenix Sales)
To: [email-masked], [email-masked], [email-masked], [email-masked],
        [email-masked], [email-masked],
        [email-masked], [email-masked],
        [email-masked]
Subject: Virus Warning

> From [email-masked] Sat Aug 10 10:33 MST 1996
> Mime-Version: 1.0
> Subject: WARNING !!!!!  INTERNET VIRUS
> To: [email-masked], [email-masked], [email-masked],
>         [email-masked], [email-masked],
>         [email-masked], [email-masked],
>         [email-masked], [email-masked],
>         [email-masked], [email-masked], [email-masked],
>         [email-masked], [email-masked], [email-masked],
>         [email-masked], [email-masked], [email-masked],
>         [email-masked], [email-masked], [email-masked],
>         [email-masked]
> Content-Transfer-Encoding: 7bit
> Content-Description: cc:Mail note part
> 
>      
> Please be sure your teams see this and divert disaster!
> 
> ______________________________ Forward Header __________________________________
> Subject: WARNING !!!!!  INTERNET VIRUS
> Author:  Drew Boyd at BOSSALES
> Date:    8/9/96 9:43 AM
> 
> 
>      Ciaran,
>      
>      This message was forwarded to me.  It sounds like a real nasty virus 
>      potential. I thought you should see it and have it distributed 
>      appropriately.
>      
>      Drew
>      
>      Date:  8/5/96 3:43 PM
>      
>      SUBJECT: VIRUSES--IMPORTANT PLEASE READ IMMEDIATELY There is a 
>      computer virus that is being sent across the Internet. If you receive 
>      an e-mail message with the subject line "Good Times", DO NOT read the 
>      message, DELETE it immediately. Please read the messages below. Some 
>      miscreant is sending e-mail under the title "Good Times" nation wide, 
>      if you get anything like this, DON'T DOWN LOAD THE FILE! It has a 
>      virus that rewrites your hard drive, obliterating anything on it. 
>      Please be careful and forward this mail to anyone you care about. 
>      
>      ******************************************************************
>      WARNING!!!!!!! INTERNET VIRUS
>      ******************************************************************
>      
>      The FCC released a warning last Wednesday concerning a matter of major 
>      importance to any regular user of the Internet. Apparently a new com 
>      puter virus has been engineered by a user of AMERICA ON LINE that is 
>      unparalleled in its destructive capability. Other more well-known 
>      viruses such as "Stoned", "Airwolf" and "Michaelangelo" pale in 
>      compari son to the prospects of this newest creation by a warped 
>      mentality.  
>      
>      What makes this virus so terrifying, said the FCC, is the fact that no 
>      program needs to be exchanged for a new computer to be infected. It 
>      can be spread through the existing e-mail systems of the Internet. 
>      Once a Computer is infected, one of several things can happen. If the 
>      computer contains a hard drive, that will most likely be destroyed. If 
>      the program is not stopped, the computer's processor will be placed in 
>      an nth-complexity infinite binary loop -which can severely damage the 
>      processor if left running that way too long. 
>      
>      Unfortunately, most novice computer users will not realize what is 
>      happening until it is far too late. Luckily, there is one sure means 
>      of detecting what is now known as the "Good Times" virus. It always 
>      travels to new computers the same way in a text email message with the 
>      subject line reading "Good Times". 
>      
>      Avoiding infection is easy once the file has been received simply by 
>      NOT READING IT! The act of loading the file into the mail server's 
>      ASCII buffer causes the "Good Times" mainline program to initialize 
>      and execute. The program is highly intelligent- it will send copies of 
>      itself to everyone whose e-mail address is contained in a receive-mail 
>      file or a sent-mail file, if it can find one. It will then proceed to 
>      trash the computer it is running on. 
>      
>      The bottom line there is - if you receive a file with the subject line 
>      "Good Times", delete it immediately! Do not read it" Rest assured that 
>      whoever's name was on the "From" line was surely struck by the virus. 
>      Warn your friends and local system users of this newest threat to the 
>      Internet! It could save them a lot of time and money. 
> 

Mike Basson				E-Mail: [email-masked]

Sun Microsystems, Inc.			Phone: (602) 224-3520
2398 E. Camelback Rd., Suite 950	Fax:   (602) 224-9831
Phoenix, Arizona 85016

---

From: Chip Old <[email-masked]>
Date: Thu, 15 Aug 1996 00:13:59 -0400 (EDT)

Hoax alert!  Hoax alert!
 
This is the infamous "Good Times Virus" hoax that has been resurfacing
about every six months for the past two or three years.  The Good Times
virus does not exist, nor has the FCC ever issued a warning about it, nor
can you transmit a virus in the manner described. 
 
Please don't waste bandwidth by redistributing this rubbish.
 
On Wed, 14 Aug 1996, Steve Swain wrote to pine-info:

> Received: from mercury.Sun.COM by mx4.smtp.psi.net (8.7.5/SMI-5.4-PSI)
> 	id SAA00303; Sun, 11 Aug 1996 18:35:41 -0400 (EDT)
> Received: by mercury.Sun.COM (Sun.COM)
> 	id PAA13986; Sun, 11 Aug 1996 15:32:13 -0700
> Received: from sunburn.West.Sun.COM by West.Sun.COM (5.0/SMI-5.3)
> 	id AA10617; Sun, 11 Aug 1996 15:32:11 -0700
> Received: by sunburn.West.Sun.COM (SMI-8.6/SMI-SVR4)
> 	id PAA04760; Sun, 11 Aug 1996 15:31:32 -0700
> Message-Id: <[email-masked]>

-------------------------------------
Chip Old   <[email-masked]>
 
"Intel Inside"     The World's most widely used warning label...

---

From: ADAM Sulmicki <[email-masked]>
Date: Thu, 15 Aug 1996 03:08:37 -0400 (EDT)

->>      What makes this virus so terrifying, said the FCC, is the fact that no 
->>      program needs to be exchanged for a new computer to be infected. It 
->>      can be spread through the existing e-mail systems of the Internet. 
->>      Once a Computer is infected, one of several things can happen. If the 
->>      computer contains a hard drive, that will most likely be destroyed. If 
->>      the program is not stopped, the computer's processor will be placed in 
->>      an nth-complexity infinite binary loop -which can severely damage the 
->>      processor if left running that way too long. 

Hehehehe, I haven't read lately anything so funny.. espcecially the
paragraph above.. but haven't you forgot to mention that virus uses
monitor radiation to (display &) transport it cells to reader of the email
and kill him as well :) 

Of curiosity, if I'll have double-cpu comptuer then the infinte loop will
be of 2*nth-complexity or 2^nth-complexity ?

-Adam

---

From: Les Wallis <[email-masked]>
Date: Thu, 15 Aug 1996 17:19:53 +1000 (AEST)

Not that old one again! It is a HOAX

---

From: "Hiram Lester Jr." <[email-masked]>
Date: Thu, 15 Aug 1996 04:03:39 -0500 (CDT)

> Please don't waste bandwidth by redistributing this rubbish.

For even more info and links to the actual CIAC advisories, check out the
following URL for the Good Times Virus FAQ:

http://www.usit.net/public/lesjones/goodtimes.html

:)

   +------------------------------------+-------------------------------+
   | Hiram W. Lester, Jr.               | E-Mail: [email-masked]    |
   | Computer Science                   | Homepage:                     |
   | Middle Tennessee State University  |   http://pobox.com/~hwlester/ |
   +------------------------------------+-------------------------------+

---

From: Vivek Subramanian <[email-masked]>
Date: Wed, 14 Aug 1996 21:44:50 -0700

> 2398 E. Camelback Rd., Suite 950        Fax:   (602) 224-9831

Oh come on.... this thing has been floating around for YEARS!!! Give it
a break!
Pray tell, how can a text file execute itself????  Seems like everytime
this
spam is dead, it rears its ugly head again,  and a billion users start
sending
chain mail everwhere regarding the thing.  YOU CANNOT GET A VIRUS SIMPLY
BY READING
A TEXT FILE.  PERIOD.

Cheers,
Vivek.

---

From: Ed Greshko <[email-masked]>
Date: Thu, 15 Aug 1996 22:08:23 +0800 (GMT)

> spam is dead, it rears its ugly head again,  and a billion users start

	Ahhh....you have revealed the *true* nature of this virus!
It is a social engineering virus which causes "billion users" to start
sending this around thus taking up bandwidth, disk space, and people's
time.

	Other than wanting to chop down this virus I suppose it has
nothing to do with pine(tree).

	Now back to our regularly scheduled program.....

	Regards,

		Ed

-----
Edward M. Greshko                       Technical Manager, Electronic Commerce
                                        Control Data Asia/Pacific Region
Voice: +886-2-715-2222 x287             6/F, 131 Nanking East Road, Section 3
FAX  : +886-2-712-9197                  Taipei, Taiwan R.O.C

---

From: Michael Schuyler <[email-masked]>
Date: Thu, 15 Aug 1996 08:46:13 -0700 (PDT)

Sigh. Again???

Hello,
  You've warned us about the Good Time virus. It's not real. Here's a 
full newsletter on the topic. Thanks for warning us, though! It's nice to 
know that you are concerned enough to bring this to our attention. After 
all, the next one might be real. Thanks again.
--michael

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    
          Automated Systems Security Incident Support Team
                                                _____
             ___   ___  _____   ___  _____     |     /
      /\    /   \ /   \   |    /   \   |       |    / Integritas
     /  \   \___  \___    |    \___    |       |   <      et
    /____\      \     \   |        \   |       |    \ Celeritas
   /      \ \___/ \___/ __|__  \___/   |       |_____\
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>  
    
                       Bulletin  95-15
 
       Release date: 24 April, 1995, 3:30 PM EDT (GMT -4)

SUBJECT: E-mail virus is a hoax.

SUMMARY: ASSIST has received numerous requests for information
about a computer virus virus known as "Good Times" that is
traversing the Internet and infects systems through e-mail.  THE
GOOD TIMES VIRUS MESSAGE IS A HOAX.  DO NOT FORWARD THE MESSAGE
ON GOOD TIMES TO OTHER PERSONS AND PROPAGATE THE RUMOR FURTHER.

BACKGROUND: The Good Times hoax was initiated in late 1994 and
after investigation the origination of the message was traced to a 
student at a university site and a user of America Online.  There 
have been several variations of the message with a basic theme of
"this electronic mail message with the subject line of "xxx-1" 
will infect your computer".  The spread of the hoax was accelerated
when many people saw a a message with "Good Times" in the header. 
They deleted the message without reading it, thus believing that they
have saved themselves from being attacked. These first-hand reports 
give a false sense of credibility to the alert message.

The initial Good Times incident ended in December 1994 and there
was virtually no traffic on the subject until early April 1995
when another round of hoax messages began circulating on the
network.  The most common April 1995 version of the message
contained references to public statements from the Federal
Communications Commission and America Online as to Good Times
being verified as a legitamate virus.  This second round of Good
Times messages is also a hoax and based on the same false reports
as the 1994 Good Times messages.

As of this time, there are no known viruses which can infect merely
through reading a mail message, for a virus to infect and spread
a file must be executed.  Simply reading a text message does not
cause execution of any files.  It would be possible for malicious
code to be transferred as an attachment or within the body (i.e
uuencoded) of a message, but then the file would have to be
decoded and separate action taken outside of a mailer to execute
the file.  In addition, it would be extremely difficult for 
malicious code to be written to infect an environment as diverse 
as the Internet.  There are so many different types and versions
of operating systems and mailers in use on the Internet that
writing a piece of code that would succesfully infect any 
recipient of an e-mail message would be highly unlikely.

It has been suggested that, theoretically, e-mail could be used
to deliver and activate malicious code in mailers that would 
have some type of embedded automated services.  An example was 
given of "invisible" escape sequences which affect screen 
display or program the keyboard to do some malicious action when 
some key is "accidently" pressed.  This could be done through a 
file that remaps keys when displayed on a PC/MS-DOS machine with 
the ANSI.SYS driver loaded.  However, this only works on MS-DOS 
machines with the text displayed on the screen in text mode.  It 
would not work in Windows or in most text editors or mailers.  A 
key could be remapped to produce any command sequence when pressed, 
for example DEL or FORMAT.  However, the command is not issued 
until the remapped key is pressed and the command issued by the 
remapped key would be visible on the screen.  You could protect 
yourself by removing ANSI.SYS from the CONFIG.SYS file, but many 
DOS programs use the functionality of ANSI.SYS to control screen 
functions and colors.  Windows programs are not effected by 
ANSI.SYS, though a DOS program running in Windows would be. 

IMPACT: DoD personnel take unnecessary time and effort in 
response to a problem that does not exist.

RECOMMENDED SOLUTIONS: Do not forward a notice about the Good Times
virus to any other persons.  Normal policy should be to scan any 
executable file received from any source for malicious code.

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

ASSIST is an element of the Defense Information Systems Agency 
(DISA), Center for Information Systems Security (CISS), that 
provides service to the entire DoD community. Constituents 
of the DoD with questions about ASSIST or computer security 
security issues, can contact ASSIST using one of the methods
listed below.  Non-DoD organizations/institutions, contact
the Forum of Incident Response and Security Teams (FIRST)
(FIRST) representative.  To obtain a list of FIRST member
organizations and their constituencies send an email to
[email-masked] with an empty "subject" line and a message body
containing the line "send first-contacts".

ASSIST Information Resources: To be included in the distribution
list for the ASSIST bulletins, send your Milnet (Internet) e-mail
address to [email-masked].  Back issues of ASSIST 
bulletins, and other security related information, are available
from the ASSIST BBS at 703-756-7993/1154 DSN 289-7993/1154,
and through anonymous FTP from assist.mil (IP address
199.211.123.11).  Note: assist.mil will only accept anonymous FTP
connections from Milnet addresses that are registered with the
NIC or DNS.
 
ASSIST Contact Information: 
PHONE: 800-357-4231 (or 703-756-7974 DSN 289), duty hours are 06:00
to 22:30 EDT (GMT -4) Monday through Friday.  During off duty hours, 
weekends and holidays, ASSIST can be reached via pager at 800-791-
4857.  The page will be answered within 30 minutes, however if a 
quicker response is required, prefix the phone number with "999".
ELECTRONIC MAIL: Send to [email-masked]. 
ASSIST BBS: Leave a message for the "sysop". 

ASSIST uses Pretty Good Privacy (PGP) 2.6.2 as the digital 
signature mechanism for bulletins.   PGP 2.6.2 incorporates the 
RSAREF(tm) Cryptographic Toolkit under license from RSA Data 
Security, Inc.  A copy of that license is available via anonymous 
FTP from net-dist.mit.edu (IP 18.72.0.3) in the file 
/pub/PGP/rsalicen.txt.  In accordance with the terms of that 
license,  PGP 2.6.2 may be used for non-commercial purposes only.
Instructions for downloading the PGP 2.6.2 software can also be 
obtained from net-dist.mit.edu in the pub/PGP/README file.  PGP 
2.6.2 and RSAREF may be subject to the export control laws of the 
United States of America as implemented by the United States 
Department of State Office of Defense Trade Controls.  The PGP 
signature information will be attached to the end of ASSIST 
bulletins.
  
Reference herein to any specific commercial product, process, or
service by trade name, trademark manufacturer, or otherwise, does
not constitute or imply its endorsement, recommendation, or
favoring by ASSIST.  The views and opinions of authors expressed
herein shall not be used for advertising or product endorsement
purposes. 

      o o o o o o o . . .   _~~~~~~~~~~~~~~~~~~~~~\_ _/~~~~~~~~~~~~~~~~~~\_
    o      _____            |   Kitsap Regional    | |   LinkNet Support  |
  .][__n_n_|DD[  ====_____  |      Library         | |   'least we try!   |
 >(________|__|_[_________]_|______________________|_|____________________|_
 _/oo OOOOO oo`  ooo   ooo  'o^o^o            o^o^o` 'o^o              o^o`
============================================================================
Support: (360) 405-9131 Fax:(360) 405-9128 [email-masked]
Michael Schuyler:     Voice:(360) 405-9139 [email-masked]

---

From: "Richard G. Roberto" <[email-masked]>
Date: Thu, 15 Aug 1996 14:24:23 -0400 (EDT)

> all, the next one might be real. Thanks again.

8<--- snip 8<----

> have some type of embedded automated services.  An example was 

Hmmm, what about automatic MIME type recognition?  Netscape
can already be configured (is by default?) to automatically
launch applications associated with a MIME type.  I can
think of a few areas of concern here, but of course the most
obvious is MIME type JAVA or JAVA SCRIPT!!!  Defining MIME
types for perl scripts and such is pretty dangerous too.  On
systems that support it, certain applications can interact
with the system and do damage.  For example, someone can
write a lotus macro that overwrites or deletes files, or
even writes a program and executes it when a .wk* file is
loaded.  Unix supports this functionality, and I believe NT
does too.

There are even more serious concerns in html itself!
There's some scary things going on on the web nowadays!
I've visited some pages that changed the pictures in the
buttons in my Netscape browser!  That's scary!!  I'm glad
this is just a hoax, but security is a serious concern of
mine, so I'd rather get alarmed and find out its a hoax than
find out the hard way that it wasn't!

Just my $.02

Richard G. Roberto
[email-masked]
201-739-2886 - whippany, nj

--
*******************************************************************************
Bear Stearns is not responsible for any recommendation, solicitation, offer or
agreement or any information about any transaction, customer account or account
activity contained in this communication.
*******************************************************************************

---

From: Jason Englander <[email-masked]>
Date: Fri, 16 Aug 1996 00:57:33 -0500 (CDT)

-----BEGIN PGP SIGNED MESSAGE-----

> Hoax alert!  Hoax alert!

I second that!

> Please don't waste bandwidth by redistributing this rubbish.

Forget 2 or 3 years, the first time I saw that warning was on my BBS about
7 years ago!  It's been all over FidoNet, AOL, Prodigy, CompuServe, etc.,
etc., etc., etc...

It is a hoax everyone, it's not true, and think about it, how could you
possibly become infected that way?!

Later,

  Jason

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Jason Englander -=- Burlington, IA - USA
E-mail: [email-masked]
        [email-masked]
WWW: http://www.interl.net/~jasoneng
     http://www.geocities.com/SiliconValley/7485
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

---

From: [email-masked] (Jungshik Shin)
Date: 16 Aug 1996 04:03:09 -0400

Richard G. Roberto <[email-masked]> wrote:
: On Thu, 15 Aug 1996, Michael Schuyler wrote:

: Hmmm, what about automatic MIME type recognition?  Netscape
: can already be configured (is by default?) to automatically
: launch applications associated with a MIME type.  I can
: think of a few areas of concern here, but of course the most
: obvious is MIME type JAVA or JAVA SCRIPT!!!  Defining MIME
: types for perl scripts and such is pretty dangerous too.  On

  Postscript with malicious code is also a concern if MUA is
configured to launch PS interpreter like ghostscript automatically.
One has to give '-Safer'(not exact syntax) option to ghostscript
in mailcap file. As you said, Java and JavaScript impose
much bigger threats, I guess, though.

  Just my $0.02...

    Jungshik Shin

---

From: [email-masked] (Andrew Moar)
Date: 15 Aug 1996 23:37:29 GMT

> Not that old one again! It is a HOAX

And if you don't believe us, have a look at :

http://straylight.cso.niu.edu/nats/goodtime.htm

---

From: Svante Pettersson <[email-masked]>
Date: Sun, 18 Aug 1996 17:04:14 -0700

> can you transmit a virus in the manner described. 

Don't fear anymore. I just found this:

---Fwd---

This message is the "Good Times" Antigen message.  If you have recieved
this message, your system has been completely, permanently disinfected
from the "Good Times" virus.

     <&hgHH*&67%$9Yghhbbo^&7t54V5^54hO*Nnt56%$G&ggR4e4^
     ^&IG67hbCE$@#q1edUYgLKJ()M0l,;io(*HN^&$%FV86565HH^
     ^nhgggfc4ghh*&hhGFff#$wfhjNJM(I*989KMNnbFde#33Dfh>

You can now ignore any messages having anything to do with "Good Times"
-- including threads! -- because you and they have been disinfected as 
of this mailing!  Pass the disinfectant on ONLY to anyone you know to
still be "hung up" on this unfortunate Internet virus.

A Public Service
of the
AutoNym Antigen Task Force.

---End Fwd---

-----------------------------------------------------------------
Svante Pettersson        |  "Anything played wrong twice in a row
HTML-Dork,               |   is the beginning of an arrangement."
Netch Technologies AB    |
http://www.netch.se/     |                           -Frank Zappa
[email-masked]         | 
-----------------------------------------------------------------