Hoax Warnings


	Alphabetical Index

NAME:	Good Times
ALIAS:	Good News, End Times, Defrag

Good Times is not a virus - it is just a hoax.

NOTE: The Good Times hoax was going around in 1994-1995. The description below was written then - it is not accurate anymore. Specifically, viruses which CAN activate just by reading an e-mail were found during 2001.

This rare 'worm', known as Good Times, slithered its way through Internet newsgroups and various e-mail systems during December, 1994. Good Times was not a virus as the word is commonly understood; more accurately, it was an efficient chain letter. Instead of spreading from one computer to another by itself, Good Times relied on people to pass it on.

The idea behind Good Times is something like this: the originator puts an e-mail message into circulation that has the text 'Good Times' as its subject. The message itself contains a warning of a dangerous virus called Good Times which spreads itself through e-mail systems and activates when the message in which it hides is read. The message goes on to explain that such a dangerous message can be recognized by its subject, which is, of course, 'Good Times'. According to the warning, the 'Good Times' message must never be read, but destroyed on the spot instead.

Many users don't realize that this warning is a hoax - no public e-mail system supports the execution of programs while the accompanying message is read. However, since the message is written in a very sincere tone, people copy it and send it to their friends; in fact, the warning explicitly encourages them to do so.

Sooner or later, what goes around comes around and the user who has sent the message receives it as a warning from a friend's friend or from some more distant relation. The first thing the user sees is that the message has 'Good Times' as its subject. Believing to be under attack by the terrible virus, the user destroys the message without reading it. The message, of course, contains only the original warning. After this near escape, the user probably sends out even more 'Good Times' warnings.

The Good Times warning-virus came in several different versions, one of which is shown below:

        Subject: Good Times
        Date: 12/2/94 11:59 AM

        Thought you might like to know...

        Apparently , a new computer virus has been engineered by a
        user of America Online that is unparalleled in its
        destructive capability.  Other, more well-known viruses such
        as Stoned, Airwolf, and Michaelangelo pale in comparison to
        the prospects of this newest creation by a warped mentality.

        What makes this virus so terrifying is the fact that no
        program needs to be exchanged for a new computer to be
        infected.  It can be spread through the existing e-mail
        systems of the InterNet.

        Luckily, there is one sure means of detecting what is now
        known as the "Good Times" virus.  It always travels to new
        computers the same way - in a text e-mail message with the
        subject line reading simply "Good Times". Avoiding infection
        is easy once the file has been received - not reading it.
        The act of loading the file into the mail server's ASCII
        buffer causes the "Good Times" mainline program to
        initialize and execute.

        The program is highly intelligent - it will send copies of
        itself to everyone whose e-mail address is contained in a
        received-mail file or a sent-mail file, if it can find one.
        It will then proceed to trash the computer it is running on.

        The bottom line here is - if you receive a file with the
        subject line "Good TImes", delete it immediately!  Do not
        read it!  Rest assured that whoever's name was on the
        "From:" line was surely struck by the virus.   Warn your
        friends and local system users of this newest threat to the
        InterNet!  It could save them a lot of time and money.

Despite extensive efforts to put a stop to Good Times, messages have continued to spread and multiply in numerous e-mail systems worldwide. On some occasions, Good Times warnings have been published even in newspapers and broadcasted on radio.

As was to be expected, it did not take too long for virus writers to realize how they could take advantage of the Good Times rumor. In April, 1995 an Australian virus group known as VLAD published a real PC virus called 'Good Times'. This version of 'Good Times' is an ordinary file virus which infects COM and EXE files. To further confuse the issue, the following message is included in the source code of the virus:

        ; The act of loading the file
        ; into a mail server's ASCII
        ; buffer causes the "Good
        ; Times" mainline program to
        ; initialize and execute.
        ; Remember to email all your
        ; friends, warning them about
        ; Good Times!

For obvious reasons, anti-virus programs will not recognize this virus by the name 'Good Times'. Instead, it has been named 'GT-Spoof'.

A similar incident took place also in the beginning of 1993. It involved a rumor about a fictional virus called 'Proto-T', which was soon followed by the real thing.

CIAC has released an advisory on this hoax. Please see http://ciac.llnl.gov/ciac/CIACHoaxes.html

[Mikko Hypponen, F-Secure]