Subject: (Fwd) New virus on the Internet! (fwd)

From: Genel M Uehara <[email-masked]>
Date: Thu, 14 Nov 1996 10:43:26 -1000

---------- Forwarded message ----------
Date: Thu, 14 Nov 1996 03:36:10 -1000
From: "Julienne K. Maeda" <[email-masked]>
To: [email-masked]
Subject: (Fwd) New virus on the Internet! (fwd)

>Date: Wed, 13 Nov 1996 15:22:56 -0500 (EST)
>Reply-To: [email-masked]
>Sender: [email-masked]
>X-PH: V4.4@lists
>From: [email-masked] (Camille O'Bryant)
>To: [email-masked]
>Subject: (Fwd) New virus on the Internet! (fwd)
>X-Sender: [email-masked]
>X-Listprocessor-Version: 7.2 -- ListProcessor by CREN
>
>Hello there!
>>>
>>>Chanel forwarded some information to me about a new virus that we should be
>>aware of.  I thought it would be helpful if I pass it along to you all.
>>Please let others know.
>>>
>>>Camille
>>>
>>>p.s.  thanks Chanel.
>>>
>>>>>The following is an e-mail I received from someone at the School of
>>>>>Management at Rutgers University.  The message had been forwarded from
>>>>>quite a few credible organizations,including Rutgers, so I'm going to
>>>>>assume this is a real scare.
>>>>>Prof. Shields
>>>>>
>>>>>>>>Subject:  New virus.
>>>>>>
>>>>>>Here's a warning you should be aware of:
>>>>>>There is a computer virus that is being sent across the Internet. If you
>>>>>>receive an e-mail message with the subject line "Irina", DO NOT read the
>>>>>>message, DELETE it immediately. Some
>>>>>>miscreant is sending e-mail under the title"Irina". If you receive this
>>>>>>mail or file, Do NOT DOWNLOAD IT! It has a virus that rewrites your hard
>>>>>>drive, obliterating anything on it.
>>>>>>
>>>>>>What makes this virus so terrifying is the fact that no program needs be
>>>>>>exchanged for a new computer to be infected. It can be spread through the
>>>>>>existing e-mail systems of the Internet. Once a computer is infected, one
>>>>>>of several things can happen. If the computer contains a hard drive, that
>>>>>>will most likely be destroyed. If the program is not stopped, the
>>>>>>computer's processor will be placed in an nth-complexity infinite binary
>>>>>>loop - which can severely damage the processor if left running that
way too
>>>>>>long. Unfortunately, most novice computer users will not realize what is
>>>>>>happening until it is far too late.
>>>>>>Luckily, there is one sure means of detecting what is now known as Irina
>>>>>>virus. It always travels to new computers the same way: In a text e-mail
>>>>>>message with the subject
>>>>>>line reading simply "Irina".
>>>>>>
>>>>>>Avoiding infection is easy once the file has been received -    not
reading
>>>>>>it. The act of loading the file into the mail server's ASCII buffer causes
>>>>>>the "Irina" mainline program to initialize and execute. Warn your friends
>>>>>>and local system users of this newest threat to thier computer system! It
>>>>>>could save them a lot of time and money.  This virus is almost
identical to
>>>>>>the "Good Times" virus that was plaguing the Internet about a year and a
>>>>>>half ago.  BE ADVISED that although it is currently only reported on the
>>>>>>Internet, this virus will undoubtedly work its way into local bulletin
>>>>>>boards and other On-line services,
>>>>>>AND BE SURE TO TELL YOUR KIDS IF THEY DO ANYTHING ON THE
>>>>>>MODEM TO BE ALERT FOR THIS!
>>>>>>So let me know if you come across it, and be sure to pass the message
on to
>>>>>>friends, family, associates, etc. Take care and I'll talk to you soon.
>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>>
>>>>                     @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
>>>>                     @            Chanél L. King             @
>>>>                     @  Sport Management Graduate Program    @
>>>>                     @      The Ohio State University        @
>>>>                     @          *Making it Happen*           @
>>>>                     @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
>>>>
>>>>
>>>>
>>>>
>>>
>>
>>
>>
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>Camille O'Bryant, Ph.D.
>Assistant Professor
>School of Physical Activity and Educational Services
>347 Larkins Hall - 337 W. 17th Avenue
>Columbus, OH  43210
>614-292-0867
>614-688-3432 (FAX)
>[email-masked]
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>
>

---

From: Timothy J Luoma <[email-masked]>
Date: Thu, 14 Nov 96 15:58:23 -0500

Responding To:	Genel M Uehara <[email-masked]>
Original Date:	Thu, 14 Nov 1996 10:43:26 -1000
Message-ID: 	<Pine.GSO.3.93.961114104320.5926D-100000@uhunix4>

You aren't serious, are you?

A virus that comes across an email message?  Really?  How does it  
execute?  Hmm?

The "Good Times" virus was a hoax, and the same tired old plot now  
lives on with "Irina".

Plain and simple: if you don't run the program, it can't touch your  
system.  If someone mails you an executable, don't run it.

Simply downloading your email will do nothing.

TjL

---

From: [email-masked] (Thomas Roessler)
Date: 15 Nov 1996 20:33:05 GMT

In article <[email-masked]>, 
Ben Norwood wrote:

>Viruses spread by email can only take effect if 1) they are included in an
>executable attachment to the email, and 2) the attachment is saved locally
>and executed. Just reading a mail cannot cause any harm to your system.

Since we are in comp.mail.pine, I agree with you.  However, with Visual
Basic getting more and more widespread on personal computers, it's quite
possible to have Macro Viruses propagate from one system to the other in
Mail attachments; you won't have to save and execute anything.  Viewing
the mail with the appropriate software (e.g., Word) should be sufficient
to get into trouble.

Similar problems seem to have been considered several years ago:  The
default mailcaps file which is distributed with the metamail MIME
reference implementation handles PostScript attachments by sending them
to the printer to not have them do any harm to the system.

On another note, did anyone notice the nice inconsistency in the Irina
announcement?  The proposed solution is not to *read* the message after
it has been received.  Nevertheless, a few lines later the posting
claims that the code is executed when the virus is saved on the
*server*'s disk.

tlr
-- 
Thomas Roessler                  	  http://www.rhein.de/~roessler/

---

From: Ben Norwood <[email-masked]>
Date: Fri, 15 Nov 1996 16:40:12 +0000

On 14 Nov 1996, Genel M Uehara wrote:

:>>>>>>>>Subject:  New virus.
:>>>>>>
:>>>>>>Here's a warning you should be aware of:
:>>>>>>There is a computer virus that is being sent across the Internet. If you
:>>>>>>receive an e-mail message with the subject line "Irina", DO NOT read the
:>>>>>>message, DELETE it immediately.

Anyone heard of "Good Times"? This sounds suspiciously like a "Good
Times"-type virus hoax. Do NOT forward the message to anyone else..."Irina"
cannot possibly do any harm to your system.

So if you find a message prattling on about an email virus, delete it and do
not forward it to anyone else.

-- _
  / |  __  __      Web:  http://www.aber.ac.uk/~bdn5     
 /-<  /_/ / /    Email: [email-masked] 
/__/ /_  / /    Finger: [email-masked]

---

From: [email-masked] (jeffrey trust)
Date: 15 Nov 96 01:17:35 GMT

This virus alert is a hoax, just like the Good Times virus alert was a
hoax!  It is impossible to get a virus from email (without downloading
and executing a file).

Jeffrey

--
Jeffrey Trust ([email-masked]).  Student, Dept. of Geological Sciences,
California State University, Northridge (for which I don't speak).
"The winds will blow their own freshness into you, and the storms their
energy, while cares will drop off like autumn leaves."  -John Muir
                       http://www.csun.edu/~hbgeo002/

---

From: [email-masked] (Steve Patlan)
Date: 18 Nov 1996 18:31:51 GMT

>   [email-masked] (Genel M Uehara) writes:

(Something that anybody who's been on the Internet for more than five minutes
should have recognized as the Good Times warning)

>  From: "Julienne K. Maeda" <[email-masked]>
..
>  >From: [email-masked] (Camille O'Bryant)
..
>>>>>quite a few credible organizations,including Rutgers, so I'm going to
                 ^^^^^^^^
You misspelled "credulous and unobservant"

>>>>>assume this is a real scare.
     ^^^^^^^^^^^^^^^^^^^^^^^^^^^

You misspelled "Display my ignorance before the entire world."

>>>>>Prof. Shields
..
>>>>>>message, DELETE it immediately. Some

This warning was a stupid publicity stunt by Penguin books, for a new release
which was also available on the web or something.  They assumed that most people
would recognize it as the *exact same text* of the Good Times warning, only with
the word "Irina" substituted for "Good Times".  Of course, they were wrong - and
simpletons have been forwarding the warning for months now.  Sheesh.

- Steve Patlan
--
<*> [email-masked]

---

From: [email-masked] (Thomas Roessler)
Date: 15 Nov 1996 00:31:15 GMT

In article <Pine.GSO.3.93.961114104320.5926D-100000@uhunix4>, Genel M
Uehara gave us Good Times, The Next Generation.

THIS IS A HOAX.  I include an advisory on Good Times which is PGP-signed
by the German CERT.  Pardon the German text in the beginning of the
note.

tlr
------------------------------ 

-----BEGIN PGP SIGNED MESSAGE-----

Guten Tag!

In letzter Zeit haeufen sich leider wiederholt die Nachfragen bzgl. einem
angeblichen Virus "Good Times". Wir haben diesen Vorgang im Dezember 1994
ausfuehrlich verfolgt und die Resultate der Aufklaerung bereits am 7 Dezember
1994 ueber unsere Mailing-Liste (win-sec-ssc) verteilt.

Leider scheinen sich aber diese Art von Geruechten und FEHLINFORMATION
nicht zu legen. Wir sehen uns daher veranlasst diese Hinweise erneut zu
wiederholen (was wir bereits Anfang 1995 gemacht haben).

Die beiden nachfolgenden Meldungen von CIAC beschaeftigen sich ausfuehrlich
mit dieser Problematik.

Mit freundlichen Gruessen
  Wolfgang Ley (DFN-CERT)
- --
Wolfgang Ley, DFN-CERT, Vogt-Koelln-Str. 30, 22527 Hamburg,    Germany
Email: [email-masked]   Phone: +49 40 54715-262 Fax: +49 40 54715-241
PGP-Key available via finger [email-masked] any key-server or via
WWW from http://www.cert.dfn.de/~ley/               ...have a nice day

CIAC notes04.txt ftp://ftp.cert.dfn.de/pub/csir/ciac/notes/notes04.txt
===========================================================================

             U.S. DOE's Computer Incident Advisory Capability
           ___  __ __    _     ___           __  __ __   __   __
          /       |     /_\   /       |\ |  /  \   |    |_   /_
          \___  __|__  /   \  \___    | \|  \__/   |    |__  __/

Number 94-04c                                               December 8, 1994

Welcome to the fourth issue of CIAC Notes!  This is a special edition to
clear up recent reports of a "good times" virus-hoax.  Let us know if you
have topics you would like addressed or have feedback on what is useful and
what is not.  Please contact the editor, Allan L. Van Lehn, CIAC,
510-422-8193 or send E-mail to [email-masked].

  $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
  $ Reference to any specific commercial product does not necessarily   $
  $ constitute or imply its endorsement, recommendation or favoring by  $
  $ CIAC, the University of California, or the United States Government.$
  $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$

THE "Good Times" VIRUS IS AN URBAN LEGEND

In the early part of December, CIAC started to receive information requests
about a supposed "virus" which could be contracted via America OnLine, simply
by reading a message.  The following is the message that CIAC received:

 ---------------------------------------------------------------------------
| Here is some important information. Beware of a file called Goodtimes.    |
|                                                                           |
|  Happy Chanukah everyone, and be careful out there. There is a virus on   |
| America Online being sent by E-Mail.  If you get anything called "Good    |
| Times", DON'T read it or download it.  It is a virus that will erase your |
| hard drive.  Forward this to all your friends.  It may help them a lot.   |
 ---------------------------------------------------------------------------

THIS IS A HOAX.  Upon investigation, CIAC has determined that this message
originated from both a user of America Online and a student at a university
at approximately the same time, and it was meant to be a hoax.

CIAC has also seen other variations of this hoax, the main one is that any
electronic mail message with the subject line of "xxx-1" will infect your
computer.

This rumor has been spreading very widely.  This spread is due mainly to the
fact that many people have seen a message with "Good Times" in the header.
They delete the message without reading it, thus believing that they have
saved themselves from being attacked. These first-hand reports give a false
sense of credibility to the alert message.

There has been one confirmation of a person who received a message with
"xxx-1" in the header, but an empty message body.  Then, (in a panic, because
he had heard the alert), he checked his PC for viruses (the first time he
checked his machine in months) and found a pre-existing virus on his machine.
 He incorrectly came to the conclusion that the E-mail message gave him the
virus (this particular virus could NOT POSSIBLY have spread via an E-mail
message).  This person then spread his alert.

As of this date, there are no known viruses which can infect merely through
reading a mail message.  For a virus to spread some program must be executed.
Reading a mail message does not execute the mail message.  Yes, Trojans have
been found as executable attachments to mail messages, the most notorious
being the IBM VM Christmas Card Trojan of 1987, also the TERM MODULE Worm
(reference CIAC Bulletin B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-12).
 But this is not the case for this particular "virus" alert.

If you encounter this message being distributed on any mailing lists, simply
ignore it or send a follow-up message stating that this is a false rumor.

Karyn Pichnarczyk
CIAC Team
[email-masked]

CIAC notes09.txt ftp://ftp.cert.dfn.de/pub/csir/ciac/notes/notes09.txt
===========================================================================

             U.S. DOE's Computer Incident Advisory Capability
           ___  __ __    _     ___           __  __ __   __   __
          /       |     /_\   /       |\ |  /  \   |    |_   /_
          \___  __|__  /   \  \___    | \|  \__/   |    |__  __/

Number 95-09                                               April 24, 1995

This edition of CIAC NOTES describes the recent rebirth of "Good Times",
and reiterates CIAC's previous position that "Good Times" is a hoax.
Please send your comments and feedback to [email-masked].

  $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
  $ Reference to any specific commercial product does not necessarily   $
  $ constitute or imply its endorsement, recommendation or favoring by  $
  $ CIAC, the University of California, or the United States Government.$
  $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$

There is a rebirth of the "Good Times" urban legend. CIAC and other
response teams, along with the Federal Communications Commission and
America Online, have received numerous queries regarding the validity
of the "Good Times" virus. The current "Good Times" message appears to
be a repeat of the hoax perpetuated last December.

CIAC first released CIAC NOTES 94-04 in December 1994 which is titled
"THE 'Good Times' VIRUS IS AN URBAN LEGEND." The original "Good Times"
message that was posted and circulated contained the following:

 ---------------------------------------------------------------------------
| Here is some important information. Beware of a file called Goodtimes.    |
|                                                                           |
|  Happy Chanukah everyone, and be careful out there. There is a virus on   |
| America Online being sent by E-Mail.  If you get anything called "Good    |
| Times", DON'T read it or download it.  It is a virus that will erase your |
| hard drive.  Forward this to all your friends.  It may help them a lot.   |
 ---------------------------------------------------------------------------

Soon after the release of CIAC NOTES 04, another "Good
Times" message was circulated. This is the same message that is
being circulated during this recent "Good Times" rebirth. This
message includes a claim that the Federal Communications Commission
(FCC) released a warning about the danger of the "Good Times"
virus. This "Good Times" hoax message contains the following:

     The FCC released a warning last Wednesday concerning a matter of
   major importance to any regular user of the InterNet.  Apparently,
   a new computer virus has been engineered by a user of America
   Online that is unparalleled in its destructive capability.  Other,
   more well-known viruses such as Stoned, Airwolf, and Michaelangelo
   pale in comparison to the prospects of this newest creation by a
   warped mentality.
     What makes this virus so terrifying, said the FCC, is the fact
   that no program needs to be exchanged for a new computer to be
   infected.

    ... { stuff deleted } ...

CIAC contacted the FCC to ensure that this reference was fabricated
and that the "Good Times" is truly a hoax.

ADDITIONAL INFORMATION
======================
Having malicious code (malware) buried in the body of an E-mail
message that would "infect" your computer is not a very likely
possibility because characters in an E-mail message are displayed, not
executed. CIAC still affirms that reading E-mail, using typical mail
agents, will not activate malware delivered in or with the message.

Many people believe "in theory" that malware can be delivered and
activated by some mail agents that have automated services.  An
example of such malware is mail delivered to a PC that has embedded,
seemingly invisible escape sequences which affect screen display or
program the keyboard to do some nastiness when some key is
"accidently" pressed. The following is an excerpt from CIAC NOTES
05 which included and update to the "Good Times" urban legend.

  CIAC did not claim that E-mail could not be a delivery agent for
  malware.  A real threat comes from attached files which could
  contain viruses or Trojan programs.  You should scan any executable
  attachment before executing it in the same way that you scan all new
  software before using it.  It is possible to create a file that
  remaps keys when displayed on a PC/MS-DOS machine with the ANSI.SYS
  driver loaded. However, this only works on PC/MS-DOS machines with
  the text displayed on the screen in text mode.  It would not work in
  Windows or in most text editors or mailers.  A key could be remapped
  to produce any command sequence when pressed, for example DEL or
  FORMAT.  However, the command is not issued until the remapped key
  is pressed and the command issued by the remapped key would be
  visible on the screen.  You could protect yourself by removing
  ANSI.SYS from the CONFIG.SYS file, but many DOS programs use the
  functionality of ANSI.SYS to control screen functions and colors.
  Windows programs are not effected by ANSI.SYS, though a DOS program
  running in Windows would be.

===========================================================================

------------------------------
-- 
Thomas Roessler                  	  http://www.rhein.de/~roessler/