Jonathan Robie is right! Another way to verify whether a virus alert is
bogus is to write to ("reply" to) the author of the virus alert. If the
virus alert is authentic, the email address is valid and (usually) there
is a signature line with the author's affiliation, email address, and/or
phone number. If the reply email you sent back is returned to your
mailbox as undeliverable because the email address is not valid, you can
probably ignore the message (but I would still check some of the virus
databases available here on the WWW as Jonathan suggests). Just use a
search engine (Alta Vista, Excite, etc.) and search for "virus
signatures."
Also: If you are interested in a more detailed discussion of resources,
see below (I took this from (http://www.nn.doe.gov/goodtime.html) and I
thank them for the information.)
Hoper
Jonathan Robie wrote:
>
> False alarm. This has been verified as a hoax. The original "virus" of this
> type was the "Good Times" virus - same story as this one, but the title was
> "Good Times" instead of "PENPAL GREETINGS".
>
> Any time you hear rumors of viruses, a good place to check it out is the
> McAfee web site:
>
> http://www.mcafee.com
>
> Take a look at their virus database. For further information on virus
> hoaxes, see:
>
> http://www.mcafee.com/support/hoax.html
> Jonathan
>
> At 02:02 PM 12/14/96 -0500, David J. Rising wrote:
> >Subject: Virus Alert
> >Importance: High
> >
> >If anyone receives mail entitled: PENPAL GREETINGS! please delete it WITHOUT
> >reading it. Below is a little explanation of the message, and what it would
> >do to your PC if you were to read the message. If you have any questions or
> >concerns please contact SAF-IA Info Office on 697-5059.
NOTE THAT NO TELEPHONE AREA CODE IS PROVIDED!
> >This is a warning for all internet users - there is a dangerous virus
> >propagating across the internet through an e-mail message entitled "PENPAL
> >GREETINGS!". DO NOT DOWNLOAD ANY MESSAGE ENTITLED "PENPAL GREETINGS!"
> >
> >This message appears to be a friendly letter asking you if you are
> >interested in a penpal, but by the time you read this letter, it is too
> >late. The "trojan horse" virus will have already infected the boot sector
> >of your hard drive, destroying all of the data present. It is a
> >self-replicating virus, and once the message is read, it will AUTOMATICALLY
> >forward itself to anyone who's e-mail address is present in YOUR mailbox!
THIS IS NOT YET POSSIBLE! THERE MUST BE A PROGRAM FILE ATTACHED THAT
THE EMAIL READER MUST ACTUALLY OPEN AND EXECUTE.
> >This virus will DESTROY your hard drive, and holds the potential to DESTROY
> >the hard drive of anyone whose mail is in your inbox, and who's mail is in
> >their inbox, and so on. If this virus remains unchecked, it has the
> >potential to do a great deal of DAMAGE to computer networks worldwide!!!!
NOT YET POSSIBLE
Is an email virus possible?
No. There is no way for a virus to spread simply by reading email. A few
people have Gone through mental gymnastics trying to dream up a way such
a thing could be done. The closest anyone has come is to infect a
program with a virus, encode the program into text with uuencode,
binhex, etc., and email the encoded program. The person receiving the
email would have to download the mail to their hard drive, decode it,
and run the infected program. That's not even close to the claims made
for the spread of Good Times.
You should, of course, be wary of any file attachments a stranger sends
you. At the least, you should check such file attachments for viruses
before running them.
How can I protect myself from viruses in general?
Use a virus checker regularly. Freeware, shareware, and commercial
anti-virus programs are widely available. Which program you use isn't as
important as how you use it. Most people get into trouble because they
never bother to check their computer for viruses.
Most viruses spread through floppy disks, so isolating yourself from
online services and the Internet will not protect you from viruses. In
fact, you're probably safer if you're online, simply because you'll have
access to anti-viral software and information.
What can I find anti-viral information on the Internet?
Usenet newsgroups comp.virus
Mailing lists
VIRUS-L is for discussions of viruses and anti-viral products. Send
email to listserv@lehigh.edu to subscribe. In the body of the message,
include the line "sub virus-l your-name" (without the quotes). VALERT-L
is for announcements of new viruses. Send email to listserv@lehigh.edu.
In the body of the message, include the line "sub valert-l your-name"
(again, without the quotes).
FTP sites
(ftp://ftp.cert.org) in pub/virus-l/docs/ Contains information about
viruses and anti-virus products, with pointers to other FTP sites.
HOPER'S COMMENT: This directory contains digests of the virus-l mailing
list 1988-1993. The current, and completely up to date, archive site for
virus-l is (ftp://ftp.infospace.com/pub/virus-l/)
Comp.virus FAQ on the World Wide Web
(http://www.datafellows.fi/vl-faq.htm#A7)
Was the hoax a sort of virus itself?
Yes, but it wasn't a computer virus. It was more like a social virus or
a thought virus.
When someone on alt.folklore.urban asked if the virus was for real, Clay
Shirky (clays@panix.com) answered: "Its for real. Its an opportunistic
self-replicating email virus which tricks its host into replicating it,
sometimes adding as many as 200,000 copies at a go. It works by finding
hosts with defective parsing apparatus which prevents them from
understanding that a piece of email which says there is an email virus
and then asking them to remail the message to all their friends is the
virus
itself."
Shirky eloquently described what a lot of people were thinking. Good
Times was a virus, but not a computer virus, just as a computer virus
was a virus, but not a biological virus. So what is a virus? To a
biologist, a virus is a snippet of DNA that must infect a host organism
to survive and reproduce. To be contagious, a virus usually carries
instructions that cause the host to engage in certain pathological
activities (such as sneezing and coughing) that spread the infection to
other organisms.
To a computer programmer, a virus is a snippet of computer code that
must infect a host program to spread. To be contagious, a computer virus
usually causes the host program to engage in certain pathological
activities that spread the infection to other programs
>From this perspective, it's easy to see the Good Times hoax as a sort of thought virus. To be contagious, a thought virus causes the host to engage in certain pathological activities that spread the infection.
In the case of Good Times, the original strain (happy Chanukah)
explicitly told people to "forward this to all your friends." The other
major viral strain (infinite loop) encourages people to "Please be
careful and forward this mail to anyone you care about," and "Warn your
friends and local system users of this newest threat to the InterNet!"
Likewise, the stories of an FCC modem tax encourage people to tell their
friends and post the warning on other BBSes. David Rhodes' Make Money
Fast scam instructs people to re-post the message to as many as ten
bulletin boards.
In _The Selfish Gene_ (1976, University of Oxford Press), Oxford
evolutionary biologist Richard Dawkins extends the principles in his
book from biology to human culture. To make the transition, Dawkins
proposes a cultural replicator analogous to genes. He calls these
replicators memes:
"Examples of memes are tunes, ideas, catch-phrases, clothes fashions,
ways of making pots or of building arches. Just as genes propagate
themselves in the gene pool by leaping from body to body via sperm or
eggs, so memes propagate themselves in the meme pool by leaping from
brain to brain via a process which, in the broad sense, can be called
imitation. If a scientist hears, or reads about, a good idea, he passes
it on to his colleagues and students. He mentions it in his articles and
lectures. If the idea catches on, it may be said to propagate itself,
spreading from brain to brain. As my colleague N. K. Humphrey neatly
summed up an earlier draft of this chapter:
"...memes should be regarded as living structures, not just metaphori-
cally, but technically. When you plant a fertile meme in my mind you
literally parasitize my brain, turning it into a vehicle for the meme's
propagation in just the way that a virus may parasitize the genetic
mechanism of a host cell."
"
Amazingly, when I read alt.folklore.computers looking for research
material, two people had already mentioned Dawkins' memes. One of them
referred to an article in the April 8, 1995 _New Scientist_ about
something called the Meme Research Group at the University of
California, San Francisco. The article noted that the group was reticent
about details, and didn't mention a person's name of phone number. I had
no luck it trying to locate the group via USF's operator assistance or
computing department, and I'm still waiting for someone to reply to my
email.
I am not a memeticist, and a real memeticist might take umbrage at my
explanation of the concept. To learn more, I encourage you to visit the
alt.memetics newsgroup on Usenet, and the alt.memetics home page on the
World Wide Web (http://www.xs4all.nl/"hingh/alt.memetics/).
Though we've talked about memes in terms of viruses (a common analogy),
the concept of a meme is neither good nor bad. The idea of "Do unto
others as you would have them do unto you" is as much a meme as the Good
Times hoax.
What's the best way to control a thought virus?
Create a counter virus like this one as an antidote. To make the counter
virus contagious, include instructions such as, "The Good Times email
virus is a hoax. If anyone repeats the hoax, please show them the FAQ."
What are some other hoaxes and urban legends on the Internet?
The FCC Modem Tax
Every so often someone posts a dire warning that the FCC is considering
a tax on modems and online services. The warning encourages you to tell
your friends so they can take political action. It's a hoax. It's been
going on for the five years I've been online, and probably much longer.
If you'll notice, the warnings don't include a date or a bill number.
Make Money Fast
If you haven't seen a Make Money Fast message, call your local
anthropology department. They might be interested in studying you.
Devised by David Rhodes in 1987 or 1988, Make Money Fast (sometimes
distributed on BBSes as a file called fastcash.txt) is an electronic
version of a chain letter pyramid scheme. You're supposed to send money
to the ten people on the list, then add your name to the list and repost
the chain letter, committing federal wire fraud in the process. Posting
a Make Money Fast message is one sure way to lose your Internet account.
Craig Shergold needs your get well cards
Craig Shergold is a UK resident who was dying of cancer. He wanted to
get in the Guinness Book of World Records for having received the most
get well cards. When people heard of the poor boy's wish, they began
sending him postcards. And they kept sending him postcards, and never
stopped. Shergold is now in full remission. He was listed in the
Guinness Book of World Records in 1991. He really does not want your
postcards any more, and neither does his hometown post office.
These are just the urban legends that you're likely to encounter on the
Internet. There are many more in real life that you probably believe. I
won't give them away, but here are some clues: peanut butter, Neiman
Marcus/Mrs. Fields, Rod Stewart, and the Newlywed Game. For more
information, read the alt.folklore.urban FAQ, listed in Online
References at the end of the FAQ.
Online References
CIAC Notes 94-04 and 94-05d
FTP to ciac.llnl.gov and look in the /pub/ciac/sectools/unix directory.
The URL is (ftp://ciac.llnl.gov/pub/ciac/sectools/unix/)
The URL for the CIAC home page on the World Wide Web is:
(http://ciac.llnl.gov/ciac/)
alt.folklore.urban FAQ
Available via FTP from cathouse.org in the
/pub/cathouse/urban.legends/AFU.faq directory.
Also available on the World Wide Web at
(http://cathouse.org/UrbanLegends/AFUFAQ/)
America Online's official statement
keyword "virus2" on America Online
The Good Times Virus Hoax FAQ (WHERE HOPER GOT THIS DOCUMENT)
FTP to usit.net and look in the pub/lesjones directory. The URL is:
(ftp://usit.net/pub/lesjones/GoodTimes-HoaxFAQ.txt)
Regards,
Hoper
-- M. Hope Aguilar, Esq. Phone: U.S.A. (310) 645-8755 Culver City, CA 90230 Fax: U.S.A. (310) 337-7034 hoper@atheist.com