If we delete suspicious email and refrain from opening unknown attachments ,we can prevent infection. I recieved 6 emails today from Helen O'Malia each was from a different Rootsweb list to which I subscribe . I assume they were autosent without her knowledge but they all had attachments of the fun.exe which I deleted .I found the INETD file in Windows as described below .I deleted the program before it was executed . One of the listowners sent this advice so I forward it for our mutual benefit . ----- Original Message ----- From: "Tom Welch" <tomas@directcon.net> To: <DUMFRIES-GALLOWAY-L@rootsweb.com> Sent: Monday, June 05, 2000 8:38 AM Subject: LISTOWNER MESSAGE > Hi everyone, > > Helen, at h.omalia@home.com, Is infected with a worm virus. It will automatically send an email with an > infected attachment to each person who emails her. I have contacted her and warned her not to send emails to > any list members until she cleans her Hard Drive. > > PLEASE!! Do not start a thread on viruses. They can NOT be sent through the Rootsweb list. > > As is always prudent, never open an attachment the source of which you do not know. Install a good Virus > protection program on your machine and keep it up to date. > > Following is information from the TrendMicro website; > > TROJ_PLAGE2000.A > This virus has been seen in the wild > TROJ_PLAGE2000.A is a Trojan worm that propagates via email using MAPI. > This program replies to unread email with the malicious program attached to > it. When executed, this Trojan displays a dialog box similar to self-extracting > programs. Regardless of the button clicked on the dialog box, the Trojan > installs itself to windows by dropping a slightly modified copy of itself to the > Windows directory. An infected system will have the file INETD.EXE in the > Windows folder and this file has to be deleted from the system to remove this > Trojan. All Trend customers are advised not to open email attachments with > following file names if they should receive it: hamster.exe, tamagotxi.exe, > searchURL.exe, SETUP.EXE, Card.EXE, billgt.exe, midsong.exe, > s3msong.exe, docs.exe, humor.exe, fun.exe, pics.exe, images.exe, > joke.exe, PsPGame.exe, news_doc.exe. Trend pattern file #647 and above is > able to detect this Trojan. > > You can go to this URL for more details: > > http://www.antivirus.com/vinfo/alert_archive.htm > -- > Tom Welch, Listowner-ALLEE, BLACKLOCK, DUMFRIES-GALLOWAY lists > The ALLEE/ALLEY website; http://www.directcon.net/tomas/ > The DUMFRIES/GALLOWAY website; http://homepages.rootsweb.com/~scottish/ > > FREE FAMILY WEBSITE !FREE FAMILY WEBSITE ! > http://www.myfamily.com/index.asp?ID=AFFBNR1&source=AFFBNR1&clicktrade=17897 4 > > > ==== DUMFRIES-GALLOWAY Mailing List ==== > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > To see a list of Genealogy Lists go to John Fuller's Page > http://members.aol.com/johnf14246/internet.html > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >