As listowner, I have SOLE authority to send out virus alerts on the CHINA, FEWELL, MIXON and WHITTEMORE lists. This message, from Tim Pierce at RootsWeb, may be of interest to you. There are ways to track the source of viruses, unless the messages are skilfully forged (usually they are not). For more information on how to track the origin of unwanted e-mail, check out the alt.spam FAQ at http://ddi.digital.net/~gandalf/spamfaq.html or the nicely HTML'ed version (by me) at http://fuzzo.com/spam_faq.htm. Later, Dave P.S. If any of you feel compelled to forward a virus warning to any of these lists, please discuss it with me first. A lot of warnings turn out to be hoaxes. I have ways to check the "warnings" out. - ---------------------------------------------------------------------- David M. Lawrence | Home: (804) 559-9786 9272-G Hanover Crossing Drive | Fax: (804) 559-9787 Mechanicsville, VA 23116 | Email: dave@fuzzo.com USA | http: http://fuzzo.com - ---------------------------------------------------------------------- "We have met the enemy and he is us." -- Pogo "No trespassing 4/17 of a haiku" -- Richard Brautigan -----Original Message----- From: Tim Pierce [mailto:twp@rootsweb.com] Sent: Thursday, December 16, 1999 12:42 AM To: listowners-announce@rootsweb.com Subject: Recent Virus Reports Hi, folks - We've had a lot of reports tonight about a virus being passed around on RootsWeb lists. I have looked into these reports and it does NOT appear that the viruses have actually been sent through our lists. I've included a semi-technical explanation of what I have been able to find out, for those of you who are curious. The only important message here is that RootsWeb's lists are NOT the source of recent virus reports. What seems to be happening is that the current flock of viruses do the following things when they infect a new computer: * The virus sends a copy of itself to everyone in the computer's address book; * It forges its own return address to look like it was sent by someone *else* in the address book; * and it uses the Subject line from a message that was recently sent from that machine. So if an infected person sent mail to BUMBLEROTTER-L@rootsweb.com, the virus might send out mail like this to someone else in the victim's address book: From: BUMBLEROTTER-L@rootsweb.com To: joe@example.com Subject: [BUMBLEROTTER] looking for Fred and Wilma Bumblerotter <http://stuart.messagemates.com/index.html>http://stuart.messagemates.com/in dex.html Hypercool Happy New Year 2000 funny programs and animations... We attached our recent animation from this site in our mail ! Check it out ! Even though the mail never was sent to RootsWeb, the return address is forged to make it appear as if it came from us. I will continue to work on figuring out if there is anything that we can do about this; in the meantime, please assure any concerned subscribers that subscribing to a RootsWeb list is not dangerous. :-) -- Regards, Tim Pierce RootsWeb.com lead system admonsterator and Chief Hacking Officer