Home Page
Search
Site Contents

Good Times is not a virus - it's just a hoax.

This 'worm', known as Good Times, slithered its way through Internet news groups and various e-mail systems during December 1994. Good Times was not a 'virus' as the word is commonly understood; more accurately, it was an efficient chain letter. Instead of spreading from one computer to another by itself, Good Times relied on people to pass it along.

The idea behind Good Times works something like this: the originator puts into circulation an e-mail message which has the text 'Good Times' as its subject. The message itself contains a warning of a dangerous virus called Good Times which spreads itself through e-mail systems and activates when the message in which it hides is read. The message goes on to explain that such a dangerous message can be recognized by its subject, which is, of course, 'Good Times'. According to the warning, a 'Good Times' message must never be read, but destroyed on the spot instead.

Many users don't realize that this warning is a hoax - no public e-mail system supports the execution of programs while the accompanying message is read. However, since the message is written in a very sincere tone, people copy it and send it along to their friends; in fact, the warning explicitly encourages them to do so.

Sooner or later, what goes around comes around, and a user who has sent the message along receives it as a warning from a friend's friend or more distant relation. The first thing the user sees is that he or she has received a message which has 'Good Times' as its subject. Believing himself under attack by the terrible virus, the user destroys the message without reading it. The message, of course, contains only the original warning. After this near escape, the user probably sends out still more 'Good Times' warnings.

The Good Times warning-virus came in several different versions, one of which is shown below:

****
Subject: Good Times
Date: 12/2/94 11:59 AM 
Thought you might like to know... 
Apparently , a new computer virus has been engineered by a user of America Online
that is unparalleled in its destructive capability.  Other, more well-known viruses
such as Stoned, Airwolf, and Michaelangelo pale in comparison to the prospects of
this newest creation by a warped mentality. 
What makes this virus so terrifying is the fact that no program needs to be exchanged
for a new computer to be infected.  It can be spread through the existing e-mail
systems of the InterNet. 
Luckily, there is one sure means of detecting what is now known as the "Good Times"
virus.  It always travels to new computers the same way - in a text e-mail message
with the subject line reading simply "Good Times". Avoiding infection is easy once
the file has been received - not reading it. The act of loading the file into the
mail server's ASCII buffer causes the "Good Times" mainline program to initialize
and execute. 
The program is highly intelligent - it will send copies of itself to everyone whose
e-mail address is contained in a received-mail file or a sent-mail file, if it can
find one. It will then proceed to trash the computer it is running on. 
The bottom line here is - if you receive a file with the subject line "Good Times",
delete it immediately!  Do not read it!  Rest assured that whoever's name was on 
the "From:" line was surely struck by the virus.   Warn your friends and local 
system users of this newest threat to the InterNet!  It could save them a lot
of time and money.
**** 

Despite extensive efforts to put a stop to Good Times, the messages have continued to spread and multiply in numerous e-mail systems worldwide. On some occasions, Good Times warnings have even been published in newspapers and broadcasted on radio.

IMPORTANT: As was to be expected, it did not take too long for virus writers to realize how they could take advantage of the Good Times rumor. In April, 1995 an Australian virus group known as VLAD published a real PC virus called 'Good Times'. This version of 'Good Times' is an ordinary file virus which infects COM and EXE files. To further confuse the issue, the following message is included in the virus source code:

; The act of loading the file
; into a mail server's ASCII
; buffer causes the "Good
; Times" mainline program to
; initialize and execute.
; Remember to email all your
; friends, warning them about
; Good Times! 

A similar incident took place also in the beginning of 1993. It involved a rumor about a fictional virus called 'Proto-T', which was soon followed by the real thing.

See also www.tcp.co.uk/tcp/good-times/ and ftp://usit.net/pub/lesjones/good-times-virus-hoax-faq.txt.

[Mikko Hypponen, Data Fellows Ltd's F-PROT Professional Support]