tlhIngan-Hol Archive: Thu Dec 08 09:53:10 1994
[Date Prev][Date Next][Thread Prev][Thread Next]
CIAC Advisory concerning the email virus hoax
- From: [email protected] (M. Whiteacre)
- Subject: CIAC Advisory concerning the email virus hoax
- Date: Thu, 08 Dec 1994 11:47:27 -0600
The following message may shead some light on the subject of the virus
"GOODTIMES"
>Return-Path: <@tamvm1.tamu.edu:[email protected]>
>Received: from tamvm1.tamu.edu by ZEUS.TAMU.EDU with SMTP;
> Wed, 7 Dec 1994 12:06:36 -0600 (CST)
>Received: from TAMVM1.TAMU.EDU by tamvm1.tamu.edu (IBM VM SMTP V2R2)
> with BSMTP id 1699; Wed, 07 Dec 94 12:06:28 CST
>Received: from TAMVM1.TAMU.EDU (NJE origin LISTSERV@TAMVM1) by
TAMVM1.TAMU.EDU (LMail V1.2a/1.8a) with BSMTP id 6802; Wed, 7 Dec 1994
12:06:28 -0600
>Date: Wed, 7 Dec 1994 09:59:14 PST
>Reply-To: AUTOCAD Discussion List <[email protected]>
>Sender: AUTOCAD Discussion List <[email protected]>
>From: Rodger Payne <[email protected]>
>Subject: CIAC Advisory concerning the email virus hoax
>X-To: [email protected], [email protected]
>To: Multiple recipients of list AUTOCAD <[email protected]>
>
> Dear folks,
>
> FYI... The following message may save a lot of unnecessary
> hand-wringing.
>
> Cheers,
> Rodger Payne, Manager
> Higher-Education Programs
> Autodesk, Inc.
> 111 McInnis Parkway
> San Rafael, CA 94903 (NOTE: This ZIP code is correct. I erroneously
> typed "94303" in a previous email. My
> apologies!)
>
>---------------------------------------------------------------------------
-----
>
>This just in from the DOE. I encourage all computer professionals to
>monitor the usenet "comp.security.misc" newsgroup for information before
>crying "fire" in the virtual theater. -PT
>
>[For further information contact [email protected]]
>
> U.S. DOE's Computer Incident Advisory Capability
> ___ __ __ _ ___ __ __ __ __ __
> / | /_\ / |\ | / \ | |_ /_
> \___ __|__ / \ \___ | \| \__/ | |__ __/
>
>Number 94-04 December 6, 1994
>
> ------------------- A - T - T - E - N - T - I - O - N -------------------
>| CIAC is available 24-hours a day via its two skypage numbers. To use |
>| this service, dial 1-800-759-7243. The PIN numbers are: 8550070 (for |
>| the CIAC duty person) and 8550074 (for the CIAC manager). Please keep |
>| these numbers handy. |
> -------------------------------------------------------------------------
>
>Welcome to the fourth issue of CIAC Notes! This is a special edition to
>clear up recent reports of a "good times" virus-hoax. Let us know if you
>have topics you would like addressed or have feedback on what is useful and
>what is not. Please contact the editor, Allan L. Van Lehn, CIAC,
>510-422-8193 or send E-mail to [email protected].
>
> $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
> $ Reference to any specific commercial product does not necessarily $
> $ constitute or imply its endorsement, recommendation or favoring by $
> $ CIAC, the University of California, or the United States Government.$
> $-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$-$
>
>THE "Good Times" VIRUS IS AN URBAN LEGEND
>
>In the early part of December, CIAC started to receive information requests
>about a supposed "virus" which could be contracted via America OnLine, simply
>by reading a message. The following is the message that CIAC received:
>
> ---------------------------------------------------------------------------
>| Here is some important information. Beware of a file called Goodtimes. |
>| |
>| Happy Chanukah everyone, and be careful out there. There is a virus on |
>| America Online being sent by E-Mail. If you get anything called "Good |
>| Times", DON'T read it or download it. It is a virus that will erase your |
>| hard drive. Forward this to all your friends. It may help them a lot. |
> ---------------------------------------------------------------------------
>
>THIS IS A HOAX. Upon investigation, CIAC has determined that this message
>originated from both a user of America Online and a student at a university
>at approximately the same time, and it was meant to be a hoax.
>
>CIAC has also seen other variations of this hoax, the main one is that any
>electronic mail message with the subject line of "xxx-1" will infect your
>computer.
>
>This rumor has been spreading very widely. This spread is due mainly to the
>fact that many people have seen a message with "Good Times" in the header.
>They delete the message without reading it, thus believing that they have
>saved themselves from being attacked. These first-hand reports give a false
>sense of credibility to the alert message.
>
>There has been one confirmation of a person who received a message with
>"xxx-1" in the header, but an empty message body. Then, (in a panic, because
>he had heard the alert), he checked his PC for viruses (the first time he
>checked his machine in months) and found a pre-existing virus on his machine.
> He incorrectly came to the conclusion that the E-mail message gave him the
>virus (this particular virus could NOT POSSIBLY have spread via an E-mail
>message). This person then spread his alert.
>
>As of this date, there are no known viruses which can infect merely through
>reading a mail message. For a virus to spread some program must be executed.
>Reading a mail message does not execute the mail message. Yes, Trojans have
>been found as executable attachments to mail messages, the most notorious
>being the IBM VM Christmas Card Trojan of 1987, also the TERM MODULE Worm
>(reference CIAC Bulletin B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-12).
> But this is not the case for this particular "virus" alert.
>
>If you encounter this message being distributed on any mailing lists, simply
>ignore it or send a follow-up message stating that this is a false rumor.
>
>Karyn Pichnarczyk
>CIAC Team
>[email protected]
>
>
>------------------------------
>Contacting CIAC
>
>If you require additional assistance or wish to report a vulnerability, call
>CIAC at 510-422-8193, fax messages to 510-423-8002 or send E-mail to
>[email protected]. For emergencies and off-hour assistance, call 1-800-SKY-PAGE
>(759-7243) and enter PIN number 8550070 (primary) or 8550074 (secondary).
>The CIAC Duty Officer, a rotating responsibility, carries the primary
>skypager. The Project Leader carries the secondary skypager. If you are
>unable to contact CIAC via phone, please use the skypage system.
>
>------------------------------
>This document was prepared as an account of work sponsored by an agency of the
>United States Government. Neither the United States Government nor the
>University of California nor any of their employees, makes any warranty,
>express or implied, or assumes any legal liability or responsibility for the
>accuracy, completeness, or usefulness of any information, apparatus, product,
>or process disclosed, or represents that its use would not infringe privately
>owned rights. Reference herein to any specific commercial products, process,
>or service by trade name, trademark, manufacturer, or otherwise, does not
>necessarily constitute or imply its endorsement, recommendation or favoring by
>the United States Government or the University of California. The views and
>opinions of authors expressed herein do not necessarily state or reflect those
>of the United States Government or the University of California, and shall not
>be used for advertising or product endorsement purposes.
>
>------------------------------
>End of CIAC Notes Number 94-04 94_12_06
>****************************************
>
____
|INRI|
____| |____
| |
|____ ____|
| | Matt Whiteacre
| | [email protected]
| |
| |
|____|