Goodtimes
Good times
Type File virus
Creator Qark
Date Discovered 1995.04
Place of Origin Australia
Source Language Assembly
Platform DOS
File Type(s) .com, .exe
Infection Length 1131 bytes

Good Times is a polymorphic memory-resident infecter of MS-DOS .COM and.EXE files. The source code of Good Times includes a small portion of the 'Good Times' hoax email, which caused a great deal of panic and confusion in the mid-1990's. It was coded by Qark of VLAD and appeared in Issue 4 of VLAD magazine in April 1995. Among its features is the use of the polymorphic engine RHICE, coded by VLAD member Rhincewind, as well as anti-heuristic structures.

Behavior

Good Times used fairly standard methods of infecting .COM and .EXE files, with one exception: When infecting .COM files the virus will follow and JMP NEAR (E9h), JMP SHORT (EBh) and CALL (E8h) instructions in an attempt to place the jump to the virus further inside the file. Only these 3 instructions were followed.

When infecting .EXE files Good Times will avoid overlay files, .EXE files whos 'maxmem' field is not 0FFFFh and Windows executables. .EXE files were marked as infected by setting offset 12h (checksum value) of the MZ header to 'BV' (VB). This caused the virus to avoid infecting files that had been generically disinfected by the 'Virus Buster' anti-virus.

When an infected executable is run the Good Times checks if it is already resident in memory, goes memory-resident if not and then returns control to the host. To allocate memory Goodtimes uses Qarks standard method by reducing the size of the MCB of the host if it is the last in the chain, as well as the 'top of memory' field of the host PSP. The virus copies itself to this allocated block of memory and hooks INT 21h.

The Good Times INT 21h handler handles the viruses residency check and infect files on open, execute, rename and chmod calls. Only files with extensions beginning with 'c', 'C', 'e' or 'E' are infected. Good Times differentiates between .COM and .EXE files by checking for presence
of MZ header. Good Times included the text string:

Good Times by Qark/VLAD

Origin and Name

Good times was coded in Australia in 1995 by Qark of VLAD and appeared in the 4th issue of VLAD's magazine. "Good times" was also the name of a hoax email warning of a virus that spread by email in the 1990's. There never was an actual email capable virus named Good times. Though there were some examples of email worms in the late 1980's, such as the Christmas Tree worm, but there would not be an actual email virus until the Sharefun macro virus of 1997.

Sources

Original research by JPanic aka @JPanicVX

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License