CIAC NotesCIAC NotesHere is some important information. Beware of a file called Goodtimes.THIS IS A HOAX. Upon investigation, CIAC has determined that this message originated from both a user of America Online and a student at a university at approximately the same time, and it was meant to be a hoax.
Happy Chanukah everyone, and be careful out there. There is a virus on America Online being sent by E-Mail. If you get anything called "Good Times", DON'T read it or download it. It is a virus that will erase your hard drive. Forward this to all your friends. It may help them a lot.
CIAC has also seen other variations of this hoax, the main one is that any electronic mail message with the subject line of "xxx-1" will infect your computer.
This rumor has been spreading very widely. This spread is due mainly to the fact that many people have seen a message with "Good Times" in the header. They delete the message without reading it, thus believing that they have saved themselves from being attacked. These first-hand reports give a false sense of credibility to the alert message.
There has been one confirmation of a person who received a message with "xxx-1" in the header, but an empty message body. Then, (in a panic, because he had heard the alert), he checked his PC for viruses (the first time he checked his machine in months) and found a pre-existing virus on his machine. He incorrectly came to the conclusion that the E-mail message gave him the virus (this particular virus could NOT POSSIBLY have spread via an E-mail message). This person then spread his alert.
As of this date, there are no known viruses which can infect merely through reading a mail message. For a virus to spread some program must be executed. Reading a mail message does not execute the mail message. Yes, Trojans have been found as executable attachments to mail messages, the most notorious being the IBM VM Christmas Card Trojan of 1987, also the TERM MODULE Worm (reference CIAC Bulletin B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-12). But this is not the case for this particular "virus" alert.
If you encounter this message being distributed on any mailing lists, simply ignore it or send a follow-up message stating that this is a false rumor.
Karyn Pichnarczyk
CIAC Team
ciac@llnl.gov
CIAC is located at Lawrence Livermore National Laboratory and is a part of its Computer Security Technology Center. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide.
ATTENTION: For emergencies and off-hour assistance, CIAC is available 24-hours a day to DOE and DOE contractors via an integrated voicemail and SKYPAGE number. To use this service, dial 1-510-422-8193 or 1-800-759-7243 (SKYPAGE). The primary SKYPAGE PIN number, 8550070 is for the CIAC duty person. A second PIN, 8550074 is for the CIAC Project Leader. Keep these numbers handy.
NOTE: 1/07/2004 - The self-subscribing service to CIAC's Bulletin
mailing list is no longer available.
FOR government and military agencies ONLY:
send an e-mail to ciac@ciac.org asking to be put on our
internal Bulletin mailing list including the e-mail address to
which you want notices sent.
FOR all others:
All bulletins can still be accessed on our web site, with the most
recently published ones on our home page.
CIAC-BULLETINS: for Advisories, highest priority - time critical
information bulletins, and other important computer security information;
To be removed from the Bulletin mailing list, send an e-mail to ciac@ciac.org with
your request.