Christian Mayer wrote:



----------------------------------------------------------------------------
---------------------------------

  Subject: virus alert
  Date: Thu, 14 Aug 1997 17:02:33 -0400
  From: "Michael A. Mayer c/o THINK, Inc." <[log in to unmask]>
  To: "Toby e-mail Pischetsrieder" <[log in to unmask]>,
       "Peter A e-mail Mayer" <[log in to unmask]>,
       "Dr. Michael e-mail Fuchs" <[log in to unmask]>,
       "Dr. Gerd e-mail Graf" <[log in to unmask]>,
       "Christian e-mail Mayer" <[log in to unmask]>,
       "Andreas e-mail Dietl" <[log in to unmask]>

   Subject: VERY IMPORTANT!!!!  PLEASE > READ THIS ONE  > >
  IMPORTANT!!!!
  > >           It is essential that this  problem be reconciled as soon as

  possible.
  > >           A few hours ago, > Someone opened an E-mail that had the
  subject heading  of ao4free.com" etc. etc...
_____________________________________________________________________
Virus Information

Virus or Hoax?

From time to time messages warning of dangerous computer viruses are
distributed throughout the campus via email.
Although it is good to be informed of real threats, unfortunately most of
these announcements have been hoaxes, and their
proliferation has consumed people energy, email resources, and produced
unwarranted concern.

Please do NOT forward messages about viruses to anyone except the mail
account "HELPDESK". Let Information
Resources determine the nature of a virus or hoax. If we find or are
alerted to a REAL virus, you will be informed.

Throughout the past year or so, numerous mail messages have circulated
about viruses that turned out to be hoaxes
(false). This message (containing information from a reliable governmental
agency that tracks viruses) contains summary
information about each of the following virus HOAXES:

  PKZ300
  Irina
  Good Times
  Deeyenda
  Ghost
  PENPAL GREETINGS!
  Make MoneyFast

Remember these are all HOAXES.

PKZ300
The PKZ300 Trojan is a real Trojan program, but the initial warning about
it was released over a year ago. For
information pertaining to PKZ300 Trojan reference CIAC Notes issue 95-10,
at
http://ciac.llnl.gov/ciac/notes/Notes10.shtml that was released in June of
1995. The warning itself, on the other hand, is
gaining urban legend status. There has been an extremely limited number of
sightings of this Trojan and those appeared
over a year ago. Even though the Trojan warning is real, the repeated
circulation of the warning is a nuisance. Individuals
who need the current release of PKZIP should visit the PKWare web page at
http://www.pkware.com. CIAC
recommends that you DO NOT recirculate the warning about this particular
Trojan.

Irina
The "Irina" virus warnings are a hoax. The former head of an electronic
publishing company circulated the warning to
create publicity for a new interactive book by the same name. The
publishing company has apologized for the publicity
stunt that backfired and panicked Internet users worldwide. The original
warning claimed to be from a Professor Edward
Pridedaux of the College of Slavic Studies in London; there is no such
person or college. However, London's School of
Slavonic and East European Studies has been inundated with calls. This
poorly thought-out publicity stunt was highly
irresponsible. For more information pertaining to this hoax, reference the
UK Daily Telegraph at
http://www.telegraph.co.uk.

Good Times
The "Good Times" virus warnings are a hoax. There is no virus by that name
in existence today. These warnings have
been circulating the Internet for years. The user community must become
aware that it is unlikely that a virus can be
constructed to behave in the manner ascribed in the "Good Times" virus
warning. This message includes a claim that the
Federal Communications Commission (FCC) released a warning about the danger
of the "Good Times" virus, but the
FCC did not and will not ever issue a virus warning. It is not their job to
do so.

Deeyenda
The following "Deeyenda" virus warning is a hoax. CIAC has received
inqueries regarding the validity of the Deeyenda
virus.The warnings are very similar to those for Good Times, stating that
the FCC issued a warning about it, and that it is
self activating and can destroy the contents of a machine just by being
downloaded. Users should note that the FCC does
not and will not issue virus or Trojan warnings. It is not their job to do
so. As of this date, there are no known viruses
with
the name Deeyenda in existence. For a virus to spread, it must be executed.
Reading a mail message does not execute
the
mail message. Trojans and viruses have been found as executable attachments
to mail messages, but they must be
extracted and executed to do any harm. CIAC still affirms that reading
E-mail, using typical mail agents, can not activate
malicious code delivered in or with the message.

Ghost.exe
The Ghost.exe program was originally distributed as a free screen saver
containing some advertising information for the
author's company (Access Softek). The program opens a window that shows a
Halloween background with ghosts flying
around the screen. On any Friday the 13th, the program window title changes
and the ghosts fly off the window and
around the screen. Someone apparently got worried and sent a message
indicating that this might be a Trojan. The
warning grew until it said that Ghost.exe was a Trojan that would destroy
your hard drive and the developers got a lot of
nasty phone calls (their names and phone numbers were in the About box of
the program.) A simple phone call to the
number listed in the program would have stopped this warning from being
sent out. The original ghost.exe program is just
cute; it does not do anything damaging. Note that this does not mean that
ghost could not be infected with a virus that
does do damage, so the normal antivirus procedure of scanning it before
running it should be followed.

PENPAL GREETINGS!
The PENPAL GREETINGS! Hoax appears to be an attempt to kill an e-mail chain
letter by claiming that it is a self
starting Trojan that destroys your hard drive and then sends copies of
itself to everyone whose address is in your
mailbox.
Reading an e-mail message does not run it nor does it run any attachments,
so this Trojan must be self starting. Aside
from
the fact that a program cannot start itself, the Trojan would also have to
know about every different kind of e-mail
program to be able to forward copies of itself to other people. This
warning is totally a hoax.

Make Money Fast
The Make Money Fast Warning Hoax appears to be similar to the PENPAL
GREETINGS! Warning in that it is a hoax
warning message that is attempting to kill an e-mail chain letter. While
laudable in its intentions, the hoax warning has
caused as much or more problems than the chain letter it is attempting to
kill.


Modified February 4, 1997 by Jerry Hoover

http://www.pepperdine.edu/ir/UserServices/helpdesk/virus/hoaxes.htm


Göran Ocklind, Ph.D.
Uppsala Univ, Pharmacy /Div  Pharmaceutics
Box 580, 751 23 Uppsala, Sweden
http://pharm.bmc.uu.se/~galenisk