From: pcorless@cisco.com (Peter Corless) Subject: Re: VIRUS ALERT- Please For Date: Wed, 11 Oct 1995 19:45:52 -0700 (PDT) Folks: *** For those familiar with "Good Times", hit delete key now! *** Otherwise, feel free to waste time getting "disinfected"... CURE The best antivirus utility for "Good Times" is: * Laugh when you see "Good Times" in the header of a message * Hit the 'delete' key! * Have a nice day! :-) INNOCULATION Let people in on the joke. PATHOLOGY "Good Times" is a sociological virus, not a code/programming problem. The "virus" *is* the e-mail message, spread through a host (a panicking human unfamiliar with computer viruses), who does indeed propogate it: by forwarding the e-mail along with the words "Good Times" clearly still in the message header! Usually, the most damage when they send this to a large group of similarly unfamiliar computer users. The next person reads the e-mail, and forwards it to another group, etc. The malevolence of the "virus" is one of wasted time. There is no code to back it up. It is simply a "virus" in the sense of it being a sociological phenomenon. It is truly virulent, preying upon ignorant minds, and also people who then feel a biological need to overexplain things (like me!)... ;-) MUTATIONS Anyway, I think I can say with assurance that the virus has now *mutated*! It is no longer the "Good Times" virus, since that does not appear in the title of the message any longer. Instead, we are now in danger of the "VIRUS ALERT" virus, who's sole distinguishing characteristic is that it has "VIRUS ALERT" in the title of the email. This new strain will indeed propogate unless everyone refuses to forward this message to anyone else! ...however, I'm afraid we're *already* too late! For this virus is of a nastier kind, being *disguised* in a form that cannot be easily distinguished from true alarms: "for-real" "VIRUS ALERT" messages. Therefore one must at least read a little of the message to ensure this is indeed the nasty-mutant version of "Good Times". Again, though, the cure is the same: tell everyone the joke, and have them hit the "delete" key. -"Doctor" Pete Corless. Computer Viral Pathologist > > Good lord.."nth-complexity infinite binary loop" Sheesh! No such animal. > > I hate to think my name will go down in history as the originator of this thing > (I doubt that I was in fact, but Pierre does recall the events clearly) > > Pay absolutely NO attention to virus alerts that come from any organization you > do not recognize as an authoritative source. Authoritative sources almost > without exception include PGP signatures and a reference to the original source > in their alerts. > > Anything else is just garbage. > > -Keith > > > > > On Oct 11, 5:42am, Pierre Pellissier wrote: > > Subject: Re: VIRUS ALERT- Please For > > Reply to: RE>VIRUS ALERT: Please Forward to I.S. > > > > Don, > > - The virus alert below is suspect to me. Keith Redfield feels that he was > > responsible for tagging the "Good Times" email as a virus several months ago > > when it really does not meet the true virus criteria. > > - It started when the email started showing up around Cisco. Keith told his > > staff to stop forwarding it to others because it wasted resources and could > > theoretically bring down the mail system if enough people forwarded it to > > others. To emphasize his point he compared it to a virus in that it spread by > > casual contact, came in a package which did not seem to be hostile and could > > consume vast resources on the companies computers without anyone really > > knowing about it. (I am working off of memory here so don't hold Keith > > responsible for the prose, just the comparison concept.) > > - As I recall, Keith started hearing word on the internet a couple days later > > about a new virus called "Good Times" which spread via email and did terrible > > things to computers which received it. > > - About this time we received an alert from APAC about "Good Times", which > had > > now grown horns and ate babies with email accounts. > > - The message below seems to be more of the same: Demonstrating that, like a > > good virus, "Good Times" has mutated from it's initial form into a new, less > > obvious version, which can bypass all defenses, continue to spread and waste > > computer resources with impunity. > > - I am anxious to see the FCC report described here and to find out if the > > virus is equally capable of attacking Macs, PC's and UNIX boxes which receive > > the email. > > Pierre > > > > -------------------------------------- > > > > From: lvillarr@qntm.com > > Subject: VIRUS ALERT: Please Forward to I.S. > > To: pqueensb@cc_smtpgw.qntm.com, dwhitely@mail.qntm.com (Don Whitely), > > ctatum@mail.qntm.com (Cory Tatum), > > ppelliss@mail.qntm.com (Pierre Pellissier), > > lynostro@cc_smtpgw.qntm.com, mowen@cc_smtpgw.qntm.com > > > > Please review...... > > > > Linda V. > > X6402 > > ________________________________________________ > > Subject: VIRUS ALERT: Please Forward to I.S. > > From: Laurel Garceau > > Date: 10/9/95 1:52 PM > > > > Hi, Please show this to one of your managers and let them decide if they want > > to > > do anything with it. Laurel > > > > _____________________________________________ > > > > Subject: VIRUS ALERT: Please Forward to I.S. > > > > From: Donna Jamison at HR > > > > Date: 10/9/95 11:11 AM > > > > _____________________________________________ > > > > Hi Everyone: > > > > There is a new computer virus that is being sent across the Internet. > > If you receive an email message with the subject line "Good Times," DO NOT > > read > > the message. DELETE it immediately. > > > > Someone is sending email under the title "good times" nation-wide. If you > get > > > > anything like this, DON'T DOWNLOAD THE FILE! It has a virus that > > rewrites your hard drive, obliterating anything on it. Please be careful and > > forward this mail your colleagues at Quantum. > > > > The FCC released a warning last Wednesday concerning a matter of major > > importance to any regular user of the Internet. Apparently, a new > > computer virus has been engineered by a user of America Online that is > > unparalleled in its destructive capability. Other, more well-known viruses > > such > > as Stoned, Airwolf,and Michaelangelo pale in comparison to the prospects of > > this > > newest creation by a warped mentality. > > > > What makes this virus so terrifying, said the FCC, is the fact that no > > program needs to be exchanged for a new computer to be infected. It can be > > spread through the existing e-mail systems of the InterNet. Once a computer > is > > > > infected, one of several things can happen. If the computer contains a hard > > drive, that will most likely be destroyed. If the program is not stopped, > the > > > > computer's processor will be placed in an nth-complexity infinite binary > loop, > > > > which can severely damage the processor if left running that way too long. > > Unfortunately, most novice computer users will not realize what is happening > > until it is far too late. Luckily, there is one sure means of detecting what > > is > > now known as the "Good Times" virus. It always travels to new computers the > > same way in a test e-mail message with the subject line reading simply "Good > > Times." > > > > Avoiding infection is easy once the file has been received - not reading > > it. The act of loading the file into the mail server's ASCII buffer causes > > the "Good Times" mainline program to initialize and execute. The program is > > highly intelligent -it will send copies of itself to everyone whose e-mail > > address is contained in a received-mail file or a sent-mail file, if it can > > find > > one. It will then trash the computer it is running on. The bottom line here > > is > > - if you receive a file with the subject line "Good Times," delete it > > immediately! Do not read it! Rest assured that whoever's name was on the > > "From:" line was surely struck by the virus. > > > > WILFRED ALKHAS > > > >-- End of excerpt from Pierre Pellissier > > > > -- > Keith Redfield > Manager, Advanced Customer Systems > Cisco Systems, Inc.