Cynthia suggested that I send this along. It's deadly serious -- the new HYBRIS "worm" seems to be running amuck among genealogy list members. It sends copies of itself to everyone in your address book. Even more sinister, it downloads encrypted new "plug ins" from a newsgroup -- changing its behavior, which means its author is controlling it and probably making countermoves to antivirus efforts -- and could easily turn it into a destructive virus. If you've received messages about "Snowhite" from "Hahaha" then you've been targeted. I've gotten TEN of the puppies, three of them from members of lists. (The others may also be from members who put my addy in their address books.) Sender: Hahaha Subject: Snowhite and the Seven Dwarfs - The REAL story! Message: Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and polite with Snowhite. When they go out work at mornign, they promissed a *huge* surprise. Snowhite was anxious. Suddlently, the door open, and the Seven Dwarfs enter... (The misspellings and phraseology suggest that English is not the author's mother tongue.) The attachments I've received are called Midgets.scr (screen savers are ACTIVE code -- something I didn't know -- McAfee VShield saved my posterior), Sexy virgin.scr Dwarf4you.exe Joke.exe Others are branca de neve.scr anao porno.scr atchim.exe Since they're all the same size (23 k) I expect it's the same nasty payload with different names. Apparently it can infect even .ZIP files -- that's scary to me, since I have several hundred on my hard drive. News:alt.comp.virus is running over with discussions of HYBRIS. You can find more info at http://vil.mcafee.com/dispVirus.asp?virus_k=98873& http://www.symantec.com/avcenter/venc/data/w32.hybris.gen.html http://www.viruslist.com/eng/viruslist.asp?id=4112&key=00001000130000100044 http://www.sophos.com/virusinfo/analyses/w32hybrisb.html The thing we need to bear in mind most of all is never, NEVER, N*E*V*E*R activate the attachment on an email from someone you don't know. And even if you know the person, some worms will use his or her name in the From field -- if you're not expecting an attachment, query first before opening it. And ask why you were sent an executable (.EXE or other) attachment. And please keep your antivirus software up to date. I had updated mine just before this spate of attacks hit. Finally, I got bounced from NewBrunswick-L for posting this. No good deed goes unpunished. Eh, Jason? Yrs aye, Warren Wetmore