This is part of an email message that I sent in response to a virus hoax .... Yes, the famous 'Good TImes' virus. At the end of this is "the final word on the 'Good Times' computer virus" - which is similar to the 'Penpal' virus.
The first part is completely serious. The information on the Good Times virus is a clever spoof that I thought people might enjoy. -Scott
One of the best Web sites for computer virus information is the Virus Bulletin at URL:
The is a lot more information here than people can usually digest and a small database. Below is a list of incidence of viral attack and types of virus from October 1998 (the most recent for which I have posted data).
A very extensive virus database is at McAfee's site at URL:
Anti-virus software can be downloaded from a variety of sites on the Web. The best are listed at the Virus Bulletin site.
With regard to the message from "IBM", the virus has already struck your computer! The message itself is the virus. It accomplishes all of the purposes of a virus:
It started in 1994 and hasn't died off yet. I'm sure whoever started it is having as good a laugh as any other virus developer. There is a virus that was created that has the name good times that was invented after the hoax was well underway, but it is not common.
This is real. The most recent PKZIP is 2.04 so don't download one that purports to be the new one. When there is eventually a new one, download it from a site that you know is reliable.
Probably, the one that I got in Australia on my laptop computer. Apparently, I transferred it from a Mac to my PC. None of the virus detecting programs could find it, and all of my original software was back in the U.S. I was planning to catch up on manuscript writing, but instead it took me about a month to get the computer operational again. It took my FATs (file allocation tables) and pointed them randomly causing the directory to forget where any of its files were. I suspect it was a virus activated by <CTRL><ALT><DELETE> resets that rewrote scandisk. When I encounted a "small glitch," I invoked scandisk which reported that FAT1 and FAT2 (its backup) did not agree and prompted me as to whether I wanted to correct the problem. Gullibly, I said yes and it took out about 2,500 files, leaving only about 30 datafiles untouched. No program files were untouched. I suspected it was "dead" and reloaded everything, which lasted about a day before doing the same thing. Ultimately, I used a program to write zeroes over the data in each sector. That seems to have killed it. I have "only a few" problems since.
What are the scariest characteristics? Stealth, multipartite, polymorphic virus that destroy the hard drive are the greatest threat. Fortunately, the most virulent are also less common. Hare Krisna is a famous one of this type from 1996. Just before the drive is destroyed there is a "Hare krshna, hare hare" message. This is self encrypting virus that changes sizes. Part of the virus moves to the boot record, infects memory and the rest is resident on other files as patched-on code. It attacks on August and September 22. It is hard to detect because it changes in form and size. (This made New York times and many newspapers, but few actual attacks were found.)
Virus Name | Type | Number of incidents | Percentage |
---|---|---|---|
Class | Macro | 160 | 24.0% |
Laroux | Macro | 119 | 17.9% |
Win95/CIH | File | 36 | 5.4% |
Cap | Macro | 34 | 5.1% |
Compat | Macro | 30 | 4.5% |
Groov | Macro | 25 | 3.8% |
Paix | Macro | 22 | 3.3% |
Wazzu | Macro | 13 | 2.0% |
Steroid | Macro | 11 | 1.7% |
AntiEXE | Boot | 7 | 1.1% |
Form | Boot | 7 | 1.1% |
Jedi | Macro | 7 | 1.1% |
Munch | Macro | 7 | 1.1% |
Cartman | Macro | 6 | 0.9% |
Marburg | File | 6 | 0.9% |
NoNo | Macro | 6 | 0.9% |
Npad | Macro | 6 | 0.9% |
NYB | Boot | 6 | 0.9% |
Appder | Macro | 5 | 0.8% |
Concept | Macro | 5 | 0.8% |
Extras | Macro | 5 | 0.8% |
Niceday | Macro | 5 | 0.8% |
Nottice | Macro | 5 | 0.8% |
Parity_Boot | Boot | 5 | 0.8% |
Ripper | Boot | 5 | 0.8% |
Win95/Fono | Multi-partite | 5 | 0.8% |
AntiCMOS | Boot | 4 | 0.6% |
Chack | Macro | 4 | 0.6% |
Cheval | File | 4 | 0.6% |
Hark | Macro | 4 | 0.6% |
MDMA | Macro | 4 | 0.6% |
Showoff | Macro | 4 | 0.6% |
CopyCap | Macro | 3 | 0.5% |
DelCMOS | Boot | 3 | 0.5% |
mIRC/Gerre | File | 3 | 0.5% |
Sampo | Boot | 3 | 0.5% |
Shiver | Macro | 3 | 0.5% |
TWNO | Macro | 3 | 0.5% |
Baph.1536 | Multi-partite | 2 | 0.3% |
Bleah | Boot | 2 | 0.3% |
Brenda | Macro | 2 | 0.3% |
Diablo | Boot | 2 | 0.3% |
Explosion | File | 2 | 0.3% |
Int40 | Boot | 2 | 0.3% |
Jumper | Boot | 2 | 0.3% |
Komcon | Macro | 2 | 0.3% |
Kompu | Macro | 2 | 0.3% |
MTE.4167 | File | 2 | 0.3% |
Nucleii | File | 2 | 0.3% |
Stealth_Boot | Boot | 2 | 0.3% |
Swlabs | Macro | 2 | 0.3% |
Trout.6804 | File | 2 | 0.3% |
Vp | Macro | 2 | 0.3% |
WelcomB | Boot | 2 | 0.3% |
AccessiV | Macro | 1 | 0.2% |
Angelina | Boot | 1 | 0.2% |
AntiMarc | Macro | 1 | 0.2% |
Apparition.7035 | File | 1 | 0.2% |
Cannibal.275 | File | 1 | 0.2% |
Cebu | Macro | 1 | 0.2% |
Cerebus | File | 1 | 0.2% |
Demon | Macro | 1 | 0.2% |
DMV | Macro | 1 | 0.2% |
Dodgy | Boot | 1 | 0.2% |
Enuns.1536 | File | 1 | 0.2% |
Fehler | Macro | 1 | 0.2% |
Filler | Boot | 1 | 0.2% |
Generic_Boot2 | Boot | 1 | 0.2% |
Goldfish | Macro | 1 | 0.2% |
Hare | Multi-partite | 1 | 0.2% |
Invader | Multi-partite | 1 | 0.2% |
Junkie | Multi-partite | 1 | 0.2% |
Killock | Macro | 1 | 0.2% |
Leonor | Macro | 1 | 0.2% |
Mercado | Macro | 1 | 0.2% |
Moloch | Boot | 1 | 0.2% |
Monika | File | 1 | 0.2% |
Monkey | Boot | 1 | 0.2% |
NightShade | Macro | 1 | 0.2% |
NoInt | Boot | 1 | 0.2% |
Pieck.4444 | Multi-partite | 1 | 0.2% |
Proteced | Macro | 1 | 0.2% |
Radyum | File | 1 | 0.2% |
Raven Boot | Boot | 1 | 0.2% |
SetMD | Macro | 1 | 0.2% |
SillyC.1032 | File | 1 | 0.2% |
Stoned.Stonehenge | Boot | 1 | 0.2% |
Superhacker.1077 | File | 1 | 0.2% |
TabeJ | Macro | 1 | 0.2% |
Techno.1123 | File | 1 | 0.2% |
Temple | Macro | 1 | 0.2% |
TPVO.3783 | Multi-partite | 1 | 0.2% |
VMPCK1 | Macro | 1 | 0.2% |
V-Sign | Boot | 1 | 0.2% |
Werewolf.1500 | File | 1 | 0.2% |
Win95/Anxiety.1823 | File | 1 | 0.2% |
Win95/Darkside | File | 1 | 0.2% |
Wolleh | Boot | 1 | 0.2% |
Good Times will rewrite your hard drive. Not only that, it will scramble any disks that are even close to your computer. It will re-calibrate your refrigerator's thermostat so that all your ice cream melts. It will demagnetise the strips on all your credit cards, screw up the tracking on your VCR and use subspace field harmonics to scratch any CD's you try to play. It will give your ex-girlfriend your new phonenumber. It will mix Kool-Aid in your fishtank. It will drink all your beer and leave its socks out on the coffee table when there is company coming. It will put a dead kitten in the back pocket of your good suit pants and hide your car keys when you are late for work.
Good Times will make you fall in love with a penguin. It will give you nightmares about circus midgets. It will pour sugar in your gas tank and shave off both your eyebrows, while dating your current girlfriend behind your back and billing the dinner and hotel room to your Visa card Such is the power of Good Times: it reaches out beyond the grave to sully those things we hold most dear.
Good Times moves your car randomly around parking lots so that you can't find it. It will kick your dog. It will leave libidinous messages on your boss' voice mail in your voice! It is insidious and subtle, it is dangerous and terrifying to behold. It is also a rather interesting shade of mauve.
Good Times will give you Dutch elm disease. It will make a batch of methamphetamine in your bathtub and then leave bacon cooking on the stove while it goes out to chase primary school students with your new snowblower.
Listen to me. Good Times does not exist. It can not do anything to you But I can. I am sending this message to everyone in the world. Tell your friends, tell your family. If anyone else sends me another email about this fake Good Time virus, I will turn hating them into a religion. I will do things to them that would make a horse's head in your bed look like Sunday brunch.
Your network manager (from the Net)"