SOME HOAXES

VIRUS HOAXES

In the old days only bearded techies with sandals were on the Internet. They were heavily into computers, they understood how computers worked (they had to in order to get on the net in the first place) - in a nutshell they were academic types.

But times have changed. Today "the information superhighway" has caught the public’s imagination, and Joe Public can’t go anywhere without seeing magazines blaring on about the importance of being "wired" and how they’re not anyone in the nineties if they’ve not got a webpage.

And today the guys with the beards and sandals are in the minority – becoming vastly outnumbered by the masses on America OnLine, CompuServe, MSN, and other easy-to-use service providers. Not all these service providers necessarily offer the same abilities as a raw direct connection to the net, but that doesn’t matter to the masses. They want something that’s pretty, and simple to navigate about with using a mouse, and - most vitally - gives them email.

With email they can make friends, and keep in touch with people they would never dream of telephoning or writing a letter to. It’s quick and simple and doesn’t require walking down the road to a post box.

Furthermore if someone emails you a funny joke you can forward it to all your friends. Very little effort and everyone thinks you’re the funniest chap around.. and no chance of you fluffing the punch line.

Another great thing about the internet is it can give people a sense of community. Anyone who has dropped into a newsgroup like alt.comp.virus soon finds out that it’s the equivalent of meeting friends down the pub. Although people are always quick to assist those who have a virus problem, they’re also there to chat about anything and everything.

I have an account with an online conferencing system. Its Internet connection is pretty lousy, its newsfeed is patchy, but the reason why I and thousands of others choose to stay with it is because it’s "comfortable", it’s a community, it’s where our friends hang out.

As well as sharing jokes with friends to keep them amused, we’re also concerned about their welfare. And if we hear about a problem it’s natural to warn our friends as well.

It is this concern for fellow computer users which has ignited hoaxes into a significant problem.

The "Mother" of all hoaxes has to be "Good Times":

Good Times

There are a number of different versions of Good Times, some are more elaborate than others. Here’s an example Good Times warning:

Messages similar to the one above began to be spread around the net and the internal mail systems of corporate companies in 1994. It has propagated itself extremely well, and media organizations have not helped the problem by on occasion printing the hoax as fact (and thus adding even more credibility to the story).

Those of us with knowledge of how viruses can and cannot work knew instantly that Good Times was a hoax, but the average user who knows little about computers let alone viruses could easily believe the message. This belief was further encouraged when another version of the hoax claimed that the US FCC (Federal Communications Commission) had issued a warning about the "virus". The FCC were quick to debunk this but of course few people took time to check.

After it’s initial burst in 1994, Good Times went quiet for a while. Many people breathed a sigh of relief hoping we had seen the last of it. But then it burst into life again - if anything even more brightly than before.

The theory is that every so often a hoax will "get lucky" again. Just like a virus can "get lucky" by being accidentally shipped with commercial software, or being made available on a popular website, so a hoax can become lucky if some (albeit well-intentioned) individual or company receives the hoax warning and decides to "tell all their friends".

This behaviour has also been seen in many of the other hoaxes discussed in this paper.

In summary (I feel I have to say this every time): Good Times is a hoax, not a real virus.

I first heard of Irina on the morning of September 20^th 1996. It was the second morning of the Virus Bulletin conference in Brighton, England, and I received a message to call Robert Uhlig of The Daily Telegraph about a brand new virus called "Irina".

Uhlig asked me if we detected the virus and I responded that the name was unfamiliar to me (maybe it was a new virus which another anti-virus company had named?) and asked him for more information.

It transpired that Robert Uhlig had received a mail from a Professor Edward Prideaux at the College of Slavonic Studies warning of the new virus.

As Uhlig began to describe what the virus was supposed to do it became obvious that it was a hoax. After a little investigation the whole story then began to emerge..

The Irina hoax was a "marketing ploy" by a UK publisher, Penguin Books, to promote a new book of theirs. Guy Gadney, the former head of electronic publishing at Penguin, sent out a "virus alert" in an attempt to stir up interest in their new book. Unfortunately the alert did not make clear that it was a hoax and not supposed to be taken seriously.

The alert claimed to be from a Professor Edward Prideaux at the College of Slavonic Studies in London. The College of Slavonic Studies does not exist, but London's School of Slavonic and East European Studies was reportedly inundated with calls to the fictitious Professor Prideaux.

Although Gadney sent out a second letter explaining that the first was a hoax, it has done little to stop the spread of the alert, and it is now beyond anyone's control.

To promote "Irina" Penguin Books targeted the science fiction community and a significant number of science fiction periodicals and writers (many of whom had an internet connection) received the original version of the hoax.

The United Kingdom science fiction magazine Ansible was one of the publications to pick up on the story, and they did their best to limit the spread of the panic in Issue 111 (reprinted with permission from the editor of Ansible magazine):

Ansible wrote again about the Irina fiasco in their next edition, where they revealed that Penguin Books were taking an interesting approach to the problem.

At the time it was suggested that Penguin Books should provide a statement on their website, reassuring computer users that the Irina virus was a hoax, but to my knowledge nothing appeared. Furthermore I was bombarded with requests for Guy Gadney’s email address (I do have it, but I declined all requests in a rare display of mercy) from system administrators who wanted to forward their panicking users directly to him.

It seems I wasn’t alone in receiving requests for details on how to have Gadney’s head on a silver plate, as in the 3^rd December 1996 edition of PC Week (UK Edition) one reader wrote in:

I am sure that Penguin Books are extremely embarrassed by the whole incident, and will be vary wary of conducting a similar spoof to promote a new publication in the future. Other companies should observe Penguin’s discomfort and avoid engaging in similar publicity stunts.

None of this, of course, stops the hoax from spreading and unfortunately, many companies and individuals continue to fall for this hoax. Ironically one victim was the anti-virus company McAfee whose Moscow office deemed the hoax genuine (!) and faxed out a warning about the "virus" alongside a genuine alert about Bandung to its customers on October 31^st 1996:

It could be argued that in this way Irina "got lucky". By sneaking into a message from an anti-virus company it gained the ultimate credibility.

In summary (sorry if this is getting tedious.. but we need to get the message across): Irina is a hoax, not a real virus.

In many ways Deeyenda is similar to the Good Times hoax. The warning shares similarities (even dragging the FCC in again) and claims to spread in the same way (by reading a message with a particular subject line).

It was pointed out to me sometime after I first encountered the Deeyenda hoax that "Deeyenda Maddick" sounds phonetically like "The end of my dick". I guess that I was not alone in failing to spot that, and maybe that is once again an effect of communicating via email. If I was discussing this email message face-to-face with someone then the crude joke in the name would have become apparent. Electronic discussion, however, fails to make it obvious.

In summary: Deeyenda is a hoax, not a real virus.

In many ways PenPal Greetings is similar to "Good Times":

The sad truth is that despite users having been barraged with the Good Times hoax, and the Deeyenda hoax not everyone was aware that they had been the victim of a hoax. Furthermore there were still many more users who hadn’t received a similar warning in the past. So, despite the similarities in this hoax to previous examples the PenPal Greetings hoax has also managed to spread far and wide.

In summary: PenPal Greetings is a hoax, not a real virus.

Ghost is not a virus. But it’s also not quite the same as the e-mail chain letter hoaxes such as Good Times and Deeyenda.

Ghost is an innocent program which has received excessive publicity online after being falsely accused of containing malicious code. Ghost is a fun Windows program designed to entertain idle users in a similar vein to a screensaver. A graveyard is displayed and ghosts fly around the window in front of a full moon. On Friday the 13th, the title bar changes to 'Happy Friday the 13th!' and the ghosts start flying around the Windows desktop.

According to reports on McAfee’s CompuServe forum a version of their anti-virus product identified the program as being infected with the "GHOST virus". For a while confusion reigned as all other anti-virus products declared the file to be clean, and anti-virus researchers were unable to find anything suspicious in the file.

McAfee later confirmed that the file was indeed clean and did not perform any malicious activity. It has been suggested that it was possible that McAfee’s intention was to label the file as a known ‘joke’ program to reassure those who felt it was a virus, and that’s why detection for the program was added to their database. Some anti-virus programs do detect common ‘joke’ programs (such as BONK) to reassure users who may think they are suspect.

All samples seen so far by anti-virus developers have proven to be benign. However, please be aware that although these are not viruses, the programs themselves could be infected in the future.

This hoax is similar to "Good Times", but taken to a somewhat more melodramatic level:

It’s hard to believe that such a sensational payload like this can be believable. But this hoax still spreads and some users are still concerned and contact their technical support department. In this way the message is still a troublesome nuisance.

In summary: Free Money is a hoax, not a real virus.

Like Ghost this is another program which has been mistakenly accused of being virus infected. It is just another simple ‘joke’ program which has proven harmless.

All samples seen so far by anti-virus developers have proven to be benign. However, please be aware that although these are not viruses, the programs themselves could be infected in the future.

THIS WAS SENT TO ME BY TWO PEOPLE. PLEASE BEWARE_

Anyone who receives this must send it to as many people as you can. It is essential that this problem be reconciled as soon as possible. A few hours ago, I opened an E-mail that had the subject heading of aol4free.com. Within seconds of opening it, a window appeared and began to display my files that were being deleted. I immediately shut down my computer, but it was too late. This virus wiped me out. It ate the Anti-Virus Software that comes with the Windows '95 Program along with F-Prot AVS. Neither was able to detect it. Please be careful and send this to as many people as possible, so maybe this new virus can be eliminated.

As with the majority of virus hoaxes, this claims to be triggered when opening an e-mail, which is not possible.

A pirated copy of a commercial Japanese software program called "Stray Sheep Screen Mate" has been distributed on the net. It displays pictures of bouncing sheep. 'Stray Sheep' is apparently a very popular animated television series in Japan and the sheep is the star of the show.

Rumours have circulated that the program is infected with a virus. All the samples seen by anti-virus developers to date have proven to be benign. Of course it is unethical and irresponsible to pirate commercial software. However, please be aware that although these are not viruses, the programs themselves could be infected.

Sheep, Eyes, and Ghost could all - of course - be infected in the future by a virus like any other program.

General hoax, hype and hysteria information

Good Times specific references

Irina specific references

Sheep specific references

Miscellaneous

Finally..

Just as I was finishing this paper I received the following message in my email. I thought you would appreciate it.