Sorry to post to list, thought this might give a good description of the new BADTRANS. Jenny PS I have already received this virus type emails from members of Scottish lists. ----- Original Message ----- From: "Julie Cheesman" <juliec@clara.co.uk> To: <SUSSEX-PLUS-L@rootsweb.com> Sent: Monday, November 26, 2001 12:02 PM Subject: [SXP] ADMIN - WARNING Badtrans new version > This is very important. Anyone ignoring this advice is extremely foolish. > > There is a new variant of the Badtrans virus, it was only detected very > recently. > > The virus is called W32/Badtrans-B (dated 24Nov2001!!!) - see > www.sophos.co.uk for details (including attachment names). The infected > message is blank, whereas Badtrans-A contained a short phrase. > > This new variant is known to reply to old e-mails as well as those you've > just received, I and several other people have received copies claiming to > be replies to messages sent out months ago. The subject line will therefore > be slightly familiar to you but you must NOT open the attachment thinking > that at last you are getting a response. > > The sender's e-mail address may have been corrupted by an underscore prefix > ( _ ) so if you reply to the sender you must remove this to create a valid > address. > > If you receive such a message then let me know the e-mail address of the > sender. It must be the e-mail address, not just the name of the sender. I > will then inform them and temporarily unsubscribe them from the list. As the > virus replies to old as well as new messages the infected computer may > belong to someone who is no longer on the list but kept a copy of messages > received. > > It remains the case than you cannot receive a virus from a RootsWeb mailing > list. RootsWeb do not allow attachments or HTML and there is a size limit > for messages which is below the size of harmful viruses.These three factors > all prevent viruses from getting through RootsWeb mailing lists, the same > cannot be guaranteed for all mailing lists hosted by other organisations. > > Remember, NEVER open attachments unless you know EXACTLY what they contain. > If in any doubt delete it. Always THINK before opening anything, no matter > how tempting it might seem. > > Julie, Sussex-Plus Listowner > > > ==== SUSSEX-PLUS Mailing List ==== > The Surrey surname interests page can be found at http://www.genuki.org.uk/big/eng/Surnames/sry.htm >

Hi Walter and June You have Norton - don't you? I can't remember right now. Run Live Update and get the new definitions also. You know this is on-line. Secondly, when you are not busy on your machine, update the system but don't leave it too long (I don't trust these idiots) - it takes a while, but thankfully it's done off-line. I had 11 infected files this morning and they were all quarantined but couldn't be repaired. I received another this afternoon and Norton and I have dealt with it satisfactorily. When the job was finished, I went to the Quarantine File and deleted them line by line. Now, you know I'm a dunce but there was something else in there under backup files I think, so I deleted that also. Walter, I am sending a copy of this to the South East Queensland Germans List too. because it can cause a lot of heartaches for our over "79-ers" and over "80s". We over "60s" have a bad enough time! Love to both of you David and Bev Stay well Walter - 80 is just around the corner!! ----- Original Message ----- From: "wjbadge" <wjbadge@smartchat.net.au> To: "Bev Kerlin" <kerlindavidbev@ozemail.com.au> Sent: Tuesday, November 27, 2001 1:59 PM Subject: Re: Another new Worm Virus > wow - I've had problems too with a new worm and I've just had to let > quarantine deal with it. The only way it seems > > I wish I could get it out of the computer completely. > > Any tips, please. > Walter & June BADGE at Port Macquarie, Australia > Ph. 61265843776 Fax 61265843646 > E-mail <wjbadge@smartchat.net.au>

unknown destination of emigration: Hamann from Arendsee 1885 Karl Friedrich Wilhelm Schurke from Arendsee 1872 Wilhem Friedrich Stegemann from Bandelow 1872 Karl Christian Friedrich Schuhmacher from Battinsthal 1871 Schelk from Beenz 1885 Karl Heinrich Theodor Thormann from Beenz 1872 Friedrich Wilhelm Sommer from Blankenburg 1872 Wilhelm August Karl Dähnhoff from Bröllin 1880 Wilhelm Dietrich from Brüssow 1872 Karl Friedrich Mesecke from Brüssow 1893 Friedrich Meyer from Brüssow 1871 Karl Pstrong ? from Carmzow 1880 Thomas Bagorski from Cremzow 1893 Doebler from Damerow 1885 Christian Wilhelm Johann Sprenger from Dolgen 1872 Priem from drense 1885 Ladwig from Ellingen 1887 Karl August Wilhelm Huth from Fuerstenwerder 1853 Friedrich Wilhelm Karl Wille from Fuerstenwerder 1872 Albert Fersen from Gerswalde 1870 Julius Franz bernhard Schulz from Gerswalde 1870 Karl Friedrich Wilhelm Bade from Göritz 1871 W. Hamann from Göritz 1872 Wilhelm Genschow from Gollmitz 1871 Wilhelm Engel from Gramzow 1872 August Lustig from Gramzow 1872 Martin Stahl from Gramzow 1872 Ferdinand Gierke from Grimme 1872 Johann Karl Wilhelm Dürchen from Grimme 1872 Johann Friedrich Wilhelm Lubach from Grünberg 1880 Frierich Wilhelm Wolf from Grünberg 1894 Karl Mörsel from Grünow 1872 Karl Karstedt from Güstow 1872 Karl Stoll from Güstow 1863 Wilhelmine Stoll from Güstow 1863 Hermann Theodor Albert Mittelstädt from Hedwigshof 1871 greetings from germany Peter Woddow

Hello family and friends My computer was infected with a virus, but Norton quarantined the mails before any damage was done. I've received mail - buckets of it - in the last two days and most of it came from some of you people, although most was via the SEQ Germans List. It really is amazing how the perpetrator knows my "Subject" line. For example I hadn't written to Walter for a couple of months and the darn thing came back at me Re: Re: How is your health now (or words to that effect). Almost all of the subject lines have the Re: Re: beginning. The attachment is ATT..(various numbers here)...... .txt (0 bytes). Any or all of those people listed in the To line have received attachments from me and wouldn't think twice about opening a .txt file. Well don't (PLEASE). Mike those two huge things you have received this morning are excel and paf - NO .txt files! Although the creature appears to be hitting the SEQ Germans Listers, it can't be going through rootsweb - attachments are not permitted. The person doing this has been collected our addresses for quite some time, by the look of it. Well I've spent another wasted couple of hours "doubly cleaning up" just to be sure. Let's all be happy (funny way to get your kicks!!) Cheers Bev

copied from Norton's site:::::::::: © 1995-2001 Symantec Corporation. All rights reserved. Legal Notices Privacy Policy W32.Badtrans.B@mm Discovered on: November 24, 2001 Last Updated on: November 26, 2001 at 12:46:58 PM PST Printer-friendly version Tell a Friend Due to the increased rate of submissions, we have updated the threat level of this worm from level 3 to level 4. W32.Badtrans.B@mm is a MAPI worm that emails itself out as one of several different file names. This worm also creates a DLL in \Windows\System directory as Kdll.dll. It uses functions from this DLL to log keystrokes. Type: Worm Virus Definitions: November 24, 2001 Threat Assessment: Wild: High Damage: Low Distribution: High Wild: Number of infections: More than 1000 Number of sites: 3 - 9 Geographical distribution: Low Threat containment: Easy Removal: Easy Damage: Payload: Large scale e-mailing: Uses MAPI commands to send email. Compromises security settings: Installs keystroke logging Trojan horse. Technical description: This worm arrives as an email with one of several attachment names and a combination of two appended extensions. The list of possible file names is: HUMOR DOCS S3MSONG ME_NUDE CARD SEARCHURL YOU_ARE_FAT! NEWS_DOC IMAGES PICS The first extension that is appended to the file name is one of the following: .DOC .MP3 .ZIP The second extension that is appended to the file name is one of the following: .pif .scr The resulting file name would look something like this: CARD.DOC.PIF NEWS_DOC.MP3.SCR etc. When executed, this worm copies itself as kernel32.exe in the "\windows\system" directory. It then adds the following registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Kernel32=kernel32.exe. Prevention methods: 1. Corporate email filtering systems should block all email that have attachments with the extensions .scr and .pif. 2. Users should not open any emails with an attachment that matches the names listed above. Any email that has such an attachment should be deleted. Removal instructions: 1. Run LiveUpdate to make sure that you have the most recent virus definitions. 2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files. 3. Run a full system scan. 4. Delete all files that are detected as W32.Badtrans.B@mm. 5. Remove the registry value listed above. Write-up by: Patrick Martin

Hello Fay, year 1844 is the emigration from Germany for August Ferdinand OLM. 1844 appear however wrong to be, I accept in 1884? The Uckermark is a field in the country Brandenburg. It is northeast of Berlin and Prenzlau is the capital from that. I however, still found memos to Olm into mine other literature: August Ferdinand OLM , born 25.02.1840 Ludwigsburg Kreis Prenzlau/Uckermark/Brandenburg Profession: Miller. Existence wife Johanna Louise Friederike nee GENT, born 03.01.1841 Weselitz near Prenzlau children: Wilhelm August ferdinand borne 10.01.1867 Prenzlau Carl Ludwig Hermann borne 13.06.1868 Göritz Hermann Christian Carl borne 01.06.1871 Göritz Johann Friedrich Erdmann borne 21.08.1873 Göritz Wilhelm Ferdinand August borne 21.03.1877 Prenzlau Johanna Friederike Louise borne 07.09.1881 Schönfeld greetings from germany Peter Woddow

Taken from the Queenslander, Brisbane, Saturday, April 28, 1894 p 791 Old Times Revived A little event which took place at Badmington, Nudgee-road, on the 16th instant, and which for the second time proclaimed Carl Frederick GERLER and Clara THOMPSON man and wife, suggests thoughts of bygone days. The marriage took place in the drawing room of Dr. LANG, on the 16th April, 1844. The breakfast followed, and the cake-- a monster in its way, measuring as it did 3ft. 6in. in height and 1ft.1in. in Diameter--was cut and served by the great grandaughter, little Estelle M;GILL. The cake was in four tiers, representing the four generations of the family present. The Lutheran Mission was established at what is now Nundah in 1838, the first batch of workers including the familiar names of:--- SCHMIDT, EIPPER, WAGNER, RODÉ, ZILLMANN, HAUSMANN, FRANZ, HARTENSTEIN, and OLBRECHT. There were twelve in number, and had been sent on their mission of peace by that very able man, Father GOSSNER. He was so satisfied with the results achieved by his pioneer missionaries that in 1843 he despatched a second lot of four, and among these was Mr. GERLER, then a single man. His co-labourers were Brothers RICHTER, GERIKE, and HERMANN, the first of whom vanished some years ago, no one seems to know where; the other two are dead. This story then takes up almost the whole page of the paper, names mentioned are as follows: Rev. A.G. WELLER Mr. Carl GERLER, jnr. Lieut GERLER, the youngest son, an officer in the Salvation Army Mr. WESTAWAY Captain WICKHAM Mr. James GIBSON Mr. SLADE Mr. GERLER, though 77 years, is still a vigorous old gentleman, but a buggy accident which befel hin a few years ago has incapacitated him somewhat. Cheers Bev

Yes Gay - you are really in the line Joan Baumann Nic Klaasen W.J.Badge - this one indicates it's in my address book too, unless he is still subscribed Fay Walker Norton has been going crazy this morning 28 messages. Bev K

Listers, I also received the virus and yes, I have updated regularly but it got into my system anyway. The problem is that all and I mean ALL my inbox was wiped out.............. Someone asked me if they could put a request on the list for family stories - cannot remember who it was exactly, have had a few similar requests recently. Be my guest! put a note on the list and see who contacts you for your book that you are writing. At least my address book is intact - so I am grateful that this has not been touched. cheers and I hope we get this virus thingy squashed. Beverly. Life on Earth is Expensive, but at least you get a free trip around the sun....... So wear a hat and enjoy the ride!

Hello List Last night I received mail from Fay Walker, Phyllis Zirbel and Leith Brandt in response to the above names posting. Unfortunately each one had the W32.badtrans.B virus attached. Norton picked it up but reckons it cannot repair the files and although the files are clean when I scan them individually I am reluctant to open them. Could the above people please resend the information - preferably without the attachment Thank You. Leonard Mackrill

So Sorry to everyone At about 10.30.pm last night I received an email with an attatchment from Phyllis Zirbel Subject line Carr Information Since Phyllis and I have sent information to each other in the past I thought everything was all right When I clicked on the email there appeared to be a folder and a ball but it was so quick I could not work out what it was so clicked another couple of times and still could not work out what it was so I then opened the attatchment and it was blank ATT00042TXT [ 0bytes] It was either wordpad or note pad I sent Phyllis an email asking if she had sent me an email telling her it was blank The email came back address unknown I sent another one and it was returned too I went onto the net and checked out the latest Nortons virus scan because ours has not been updated for about a month And it came back no viruses so I thought I was ok I have just done another virus check online with nortons and the answer is no files infected Could someone tell me what to do next The attatchment was blank even before I checked for viruses Once again sorry to everyone regards Fay Walker

List of emigrants (incompletely, the official documents went in a lost manner) to Australia: Place: Name: Year: Eickstedt: Arndt, Alma ?? Nechlin Luchterlandt, Karl Friedrich 1885 Prenzlau Dobbert, Johanna 1884 with the children: Marie friederike Wilhelmine, Louise Auguste Emelie, Karl Hermann Wilhelm, Wilhelm Julius August and Ida Emelie Auguste Prenzlau Goetsch, Gottlieb Friedrich Wilhelm 1865 Prenzlau Kriedemann, August Friedrich Wilhelm 1885 Prenzlau Loewecke, Albert Karl 1874 with wife Dorothee Henriette Albertine and daugther Johanne Friederike Wilhelmine. and the non-legitimate daughter of the wife Berta Auguste Emelie Prenzlau Luchterlandt, Johann Friedrich Wilhelm 1885 and wife Charlotte juliane and son Christian Friedrich Johann Prenzlau Luedke, Arnold Wilhelm Paul 1866 Prenzlau Mülleer, A. ? 1888 Prenzlau Olm, August Ferdinand 1844 with wife Johanna Luise Friederike and children Wilhelm August Ferdinand, Karl Ludwig Hermann, Hermann Christian Karl, Johann Friedrich Erdmann, Wilhelm Ferdinand August and Johanna Friederike Luise Prenzlau Paalzow, Max 1896 with wife Helene Prenzlau Riedel, Wilhelm Herbert Albert Richard 1903 Prenzlau Schalk, Emil 1909 Prenzlau Schmunk, Karl Friedrich 1885 Prenzlau Schütz, August Friedrich Wilhelm 1885 Prenzlau Vollbrecht, Wilhelm Friedrich 1885 The emigrants with unknown ones destination soon hand over. greetings from germany Peter Woddow

Hello list, for the village, Gross Luckow in the Uckermark is written a local chronicle. This would be to be sent nice to it me if somebody from there should drive up, there this there also with noted should be. Thank. Yours sincerely from Germany Peter Woddow

Denise this came to me...I think I am clean.. .please tell me.... I use Trend PC_Cillin and it picks it up...I stupidly opened the first one from Pat Zirbel ..but I have had over 60 virus messages since this morning... The virus is WORM_BADTRANS.B It is very new and slipped in between the daily updates that I do... Best of luck..and commiserations Gay ---- Original Message ----- From: Denise Clark <dsclark@ozzi.com.au> To: Gay Fielding <gayze@dingoblue.net.au> Sent: Monday, November 26, 2001 1:54 PM Subject: Re: PLEASE READ THIS > Hiya Listers you aren't the only ones getting them i also have recived the > ATT00201.txt message today apparently it is a worm virus that is new and > norton can't detect do not open the attachment. Just delete it out of you > mail. > > Denise > ----- Original Message ----- > From: "Gay Fielding" <gayze@dingoblue.net.au> > To: <AUS-QLD-SE-Germans-L@rootsweb.com> > Sent: Monday, November 26, 2001 1:45 PM > Subject: Re: PLEASE READ THIS > > > > Hi Everyone... > > I have to say that I have been picking up viruses since 6.30 this > > morning...the virus scanner is picking them up but others listers in my > > inbox have and address book have also been infected..It appears that if > you > > have a message in my inbox the virus sends you an email from me...with a > > virus attached... > > Hopefully this won't happen with this message.. > > I have already had over 50 viruses today...and I guess more to come later > in > > the days to come.. > > Sorry for the inconvenience..I'm about ready to throw in the towel.. > > I can't say cheers today... > > See ya > > Gay > > > > > > > > > > > > > > > > > > ----- Original Message ----- > > From: Bev Kerlin <kerlindavidbev@ozemail.com.au> > > To: <AUS-QLD-SE-Germans-L@rootsweb.com> > > Sent: Monday, November 26, 2001 1:35 PM > > Subject: PLEASE READ THIS > > > > > > > Hello Fellow Listers > > > > > > I am turning to this List because I'm almost certain these 2 ladies are > > > Listers. > > > > > > Today, I have received two messages with no content but a subject line I > > > have used, and attachments .txt (0 bytes). Yes, a bit strange to have > > zilch > > > bytes! > > > > > > I will not reveal their names, but have written notes to both advising > of > > > this. > > > > > > The first one was Re: World Connect Project - Attachment (looks like > > > Wordpad) was ATT00201.txt (0 bytes) > > > > > > This afternoon was Re: ALTHAUS/MULLER - Attachment (again looks like > > > Wordpad) was ATT00190.txt (0 bytes). > > > > > > Norton DID NOT Alert nor Quarantine either of these, so maybe it's > > something > > > very new (like in the last week or 10 days when I did live update). > > > > > > Sorry Beverly for sending this through the List - but it appears we are > > the > > > most likely to be affected (so far), that's if it is what I suspect it > > might > > > be. Maybe Norton 'cleaned' them before they hit the Inbox and that may > be > > > why they are 0 bytes. > > > > > > Cheers > > > Bev K. > > > > > > > > > ============================== > > > Search over 1 Billion names at Ancestry.com! > > > http://www.ancestry.com/rd/rwlist1.asp > > > > > > > > > ============================== > > Visit Ancestry.com for a FREE 14-Day Trial and enjoy access to the #1 > > Source for Family History Online. Go to: > > http://www.ancestry.com/rd/redir.asp?targetid=702&sourceid=1237 > > > > >

Now that the names have been mentioned, the virus first appeared on my computer from one of those two ladies named....Sorry but am not an expert but I can't work out who it is sending itself to...There are returned mails from places and people that I have no knowledge of... Phewwy Gay

Hi Everyone... I have to say that I have been picking up viruses since 6.30 this morning...the virus scanner is picking them up but others listers in my inbox have and address book have also been infected..It appears that if you have a message in my inbox the virus sends you an email from me...with a virus attached... Hopefully this won't happen with this message.. I have already had over 50 viruses today...and I guess more to come later in the days to come.. Sorry for the inconvenience..I'm about ready to throw in the towel.. I can't say cheers today... See ya Gay ----- Original Message ----- From: Bev Kerlin <kerlindavidbev@ozemail.com.au> To: <AUS-QLD-SE-Germans-L@rootsweb.com> Sent: Monday, November 26, 2001 1:35 PM Subject: PLEASE READ THIS > Hello Fellow Listers > > I am turning to this List because I'm almost certain these 2 ladies are > Listers. > > Today, I have received two messages with no content but a subject line I > have used, and attachments .txt (0 bytes). Yes, a bit strange to have zilch > bytes! > > I will not reveal their names, but have written notes to both advising of > this. > > The first one was Re: World Connect Project - Attachment (looks like > Wordpad) was ATT00201.txt (0 bytes) > > This afternoon was Re: ALTHAUS/MULLER - Attachment (again looks like > Wordpad) was ATT00190.txt (0 bytes). > > Norton DID NOT Alert nor Quarantine either of these, so maybe it's something > very new (like in the last week or 10 days when I did live update). > > Sorry Beverly for sending this through the List - but it appears we are the > most likely to be affected (so far), that's if it is what I suspect it might > be. Maybe Norton 'cleaned' them before they hit the Inbox and that may be > why they are 0 bytes. > > Cheers > Bev K. > > > ============================== > Search over 1 Billion names at Ancestry.com! > http://www.ancestry.com/rd/rwlist1.asp >

Hi again Just got the message that both of my replies were undeliverable to the ladies whose names I didn't want to quote. No such addresses. However under the circumstances, they have to know they are being used. ATT00201.txt received early today was supposed to be from Fay Walker ATT00190.txt received lunchtime was supposed to be from Phyllis Zirbel. Sorry girls Bev K

Hello Fellow Listers I am turning to this List because I'm almost certain these 2 ladies are Listers. Today, I have received two messages with no content but a subject line I have used, and attachments .txt (0 bytes). Yes, a bit strange to have zilch bytes! I will not reveal their names, but have written notes to both advising of this. The first one was Re: World Connect Project - Attachment (looks like Wordpad) was ATT00201.txt (0 bytes) This afternoon was Re: ALTHAUS/MULLER - Attachment (again looks like Wordpad) was ATT00190.txt (0 bytes). Norton DID NOT Alert nor Quarantine either of these, so maybe it's something very new (like in the last week or 10 days when I did live update). Sorry Beverly for sending this through the List - but it appears we are the most likely to be affected (so far), that's if it is what I suspect it might be. Maybe Norton 'cleaned' them before they hit the Inbox and that may be why they are 0 bytes. Cheers Bev K.

I would like to share with anyone who may have descendants of any of the the following NOTHDURFT siblings. 1. Johann Peter NOTHDURFT 1872-1942 (Kilburnie) spouse Wilhelmine WEIS 2. Catherina Marg. Magd. NOTHDURFT 1873-1897 spouse John MAAG (Meringandan) 3. Jacob Wilhelm NOTHDURFT 1874-1950 spouse Alwine M WEIS 4. Johann Friedrick NOTHDURFT 1876-1956 spouse Caroline LOWIEN 5. Herman Richard NOTHDURFT 1878-1917 aka John NEWMAN and Daniel SMITH spouses Catherine McELHAW (NSW) and Annie SMITH (Vic) 6. Herman (Sam) NOTHDURFT 1881-1949 spouse Caroline BARTKOWSKI 7. Bertha NOTHDURFT 1883-1967 spouse Herman C JENSEN (Meringandan) 8. Heinrick NOTHDURFT 1885-? spouse Jean ANTHONY 9. August NOTHDURFT 1887-1974 (Pittsworth) spouse Louisa S LOWIEN 10. Johann (Jack) NOTHDURFT 1889-1961 spouse May E ZIMMERLE 11. Augusta Wilhelmina NOTHDURFT 1892-1968 (Jandowae) spouse Carl F NAUSCHUTZ 12. Anna Theresa NOTHDURFT 1894-? spouses Johann Heinrich ZIMMERLE (Gowrie Little Plain), Wallace PATCH (Mackay) 13. Herbert Gottfried NOTHDURFT 1898-1951 (Pittsworth) spouse Elsie S EHRLICH and finally half brother 14. Albert Rheinhold NAUSCHUTZ 1906-1975 (Jandowae) spouse Elsie JEITZ Cheers Christine Nothdurft

The following appears in the Nov/Dec edition of the "Blues's Country" magazine: "The Koehler family and Peranga community reunion will celebrate 100 years of settlement of Glenroy property, Peranga, Rosalie Shire, Queensland. The descendants of August Friedrick Wilhelm Koehler, Lorentina Lohrmann, Louisa Emma Moll, Otto Koehler, Emma Thiemann, friends and neighbours of past generations of their families are invited to the celebrations on Easter Saturday, 2002. Any past history and contacts regarding these families would be greatly appreciated. Anyone knowing of the descendants of the above who are interested in attending the celebrations are asked to contact John Koehler on (07) 46 928 110 or e-mail <koehler@fan.net.au>." Regards Lisa Gladstone, Q The information in this e-mail is confidential and may be privileged or subject to copyright. It is intended for the exclusive use of the addressee(s). If you are not an addressee, please do not read, copy, distribute or otherwise act upon this e-mail. If you have received the e-mail in error, please contact the sender immediately and delete the e-mail. The unauthorised use of this e-mail may result in liability for breach of confidentiality, privilege or copyright. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. This message is provided for informational purposes.