Goodtimes virus (1994)

About

Originally, on November 15, 1994, a hoax E-Mail warning about a supposed virus named “Goodtimes” began spreading one forward at a time. The emal cautioned people not to open E-Mails containing the subject “GOOD TIMES!!” lest they be infected with the non-existent virus.

In the beginning…

The Good Times FAQ (last updated in 1998) recounts how some of the first emals were phrased.

I have an early version of the hoax that dates back to November 15, 1994, when it was posted to the TECH-LAW mailing list. This is currently the earliest known example of Good Times. See also “When did the hoax start?”

--Begin quoted material—— FYI, a file, going under the name “Good Times” is being sent to some Internet users who subscribe to on-line services (Compuserve, Prodigy and America On Line). If you should receive this file, do not download it! Delete it immediately. I understand that there is a virus included in that file, which if downloaded to your personal computer, will ruin all of your files. --End quoted material——

One person remembers seeing Good Times as far back as April or May of 1994, but there is no supporting evidence for that claim. For now, the FYI message qualifies as the earliest prototype of Good Times.

Government Intervention

On December 6, 1994, the U.S. Department of Energy’s Computer Incident Advisory Capability (CIAC) officially declared that the Good Times virus did not exist, and that all warnings for it were a hoax.

Excerpt:

THE “Good Times” VIRUS IS AN URBAN LEGEND

In the early part of December, CIAC started to receive information requests about a supposed “virus” which could be contracted via America OnLine, simply by reading a message.

---

Here is some important information. Beware of a file called Goodtimes.

Happy Chanukah everyone, and be careful out there. There is a virus on

America Online being sent by E-Mail. If you get anything called "Good

Times", DON’T read it or download it. It is a virus that will erase your

hard drive. Forward this to all your friends. It may help them a lot.

---------------------------------------------------------------------------

THIS IS A HOAX. Upon investigation, CIAC has determined that this message originated from both a user of America Online and a student at a university at approximately the same time, and it was meant to be a hoax.

CIAC has also seen other variations of this hoax, the main one is that any electronic mail message with the subject line of “xxx-1” will infect your computer.

This rumor has been spreading very widely. This spread is due mainly to the fact that many people have seen a message with “Good Times” in the header. They delete the message without reading it, thus believing that they have saved themselves from being attacked. These first-hand reports give a false sense of credibility to the alert message.

There has been one confirmation of a person who received a message with “xxx-1” in the header, but an empty message body. Then, (in a panic, because he had heard the alert), he checked his PC for viruses (the first time he checked his machine in months) and found a pre-existing virus on his machine. He incorrectly came to the conclusion that the E-mail message gave him the virus (this particular virus could NOT POSSIBLY have spread via an E-mail message). This person then spread his alert.

As of this date, there are no known viruses which can infect merely through reading a mail message. For a virus to spread some program must be executed. Reading a mail message does not execute the mail message. Yes, Trojans have been found as executable attachments to mail messages, the most notorious being the IBM VM Christmas Card Trojan of 1987, also the TERM MODULE Worm (reference CIAC Bulletin B-7) and the GAME2 MODULE Worm (CIAC Bulletin B-12). But this is not the case for this particular “virus” alert.

If you encounter this message being distributed on any mailing lists, simply ignore it or send a follow-up message stating that this is a false rumor.

Karyn Pichnarczyk
CIAC Team
ciac@llnl.gov

Soon, the E-Mails became more detailed, containing specific information about what the fake virus would do, typically causing either a buffer overflow, or an “Nth-complexity infinite binary loop”, a completely made up term. Once the hoax stopped spreading, people made new ones, including “Penpal greetings”, “Free Money”, “Deeyenda”, “Invitation”, and “Win a Holiday” There was even one called “Bad times”, named in tribute to “Goodtimes”

A hoax leads to a real virus

In 1995 a group of virus writers named VLAD (Virus Labs and Distribution) wrote a real virus and called it “Good Times” although it did not act as the virus was rumored to.

In the following email, VLAD take credit for The Good Times Virus. The email is hosted on the Good Times Virus FAQ.

(lesjones@usit.net wrote:)
> (vlad@trisection.mit.edu wrote:)
>
> > You’ll find that although it is not an email virus, there IS an ms-dos
> > virus bearing the name “Good Times” it can be found in vlad#4.
> (Metabolis)
>
> I heard about it last week. It’s a copycat that was created six months after
> the hoax began.
>
> Leslie
>
That’s right! Even we Vxers have a sense of humor. BTW, it’s not a
‘copycat,’ it’s simply a good joke (many people have fallen for it until
they actually look at the source). :)
—Antigen

Real email viruses.

Although self-executing email viruses were mostly impossible in 1994, later viruses like 2000’s ILOVEYOU were able to spread via email.

Further Influence.

Weird Al Yankovic made a song parody of the hoaxes entitled Virus Alert.