Hi cousins, I hope you're all having a WONDERFUL Wednesday! :) Since there wasn't a huge response to June's Challenge, I've decided to hold a roll call in lieu of July's Challenge... yep, right here in the middle of the year. So, come out.. come out... whoever you are! For the next two weeks everyone please be sure to keep your mailboxes emptied so we don't have a slew of bounced messages and you won't miss out on even one post. List members who are homebound ... be sure NOT to skip this roll call. One of the researchers here who travel might see your message and select it to incorporate with his/her research trip, providing you with the results! (yes, it DOES happen) Roll call? What IS she talking about now??? For those of you who are brand new to online genealogy, or just genealogy in general, this next part is for you: TO OUR NEWBIES and NOVICES ~~ (Print this out if you need to) ~~ ROLL CALL FAQs *** A roll call means EVERYONE in the family should post those lines they are looking for. It's kind of like reporting in to the list saying, "here I am ... looking for (whoever)." This is also the time our lurkers come out and "report in." *** You should expect message traffic to be heavier this week and possibly part of next. Although you can post a query anytime during the year, roll calls are special because everyone is expected to post... including our lurkers (those people who just monitor a list and don't participate). It's an important time and you don't want to miss out, but your mailboxes could get full fast. Please be sure to check them daily and keep them emptied so your mail won't bounce. *** Although the traffic is going to get heavier and may be a strain on your time to keep up, PLEASE STAY WITH US. This will only last about two weeks, if that. You don't want to unsubscribe just as an inline cousin is posting information you've been watching for, then end up missing the very message you've waited all this time for! :( *** Be sure to use ONLY that email address to post with that you signed up to the list with. Any other address will not be recognized by Rootsweb and their servers will kick your message out of the system. *** Send your roll call messages DIRECTLY TO THE LIST at <CTNEWHAV-L@rootsweb.com> Please DO NOT send them to me as I am only one person with one line when, what you want, is for everyone on the list to see who you're looking for. *** With exception of the subject line (see below), there is no special format. You just need to remember to include names, dates and places as best you can. If you're nervous about this, you might want to sit back a day or two and read some of the other researchers posts and see how they did it, then just do what they did. Everyone has their own style and preference for setting up a roll call message. *** If you're a newbie, the best thing you can do for yourself is to announce it first thing in your message! It alerts the rest of us to be especially watchful of your material. PLEASE MAKE YOUR SUBJECT LINE READ SOMETHING LIKE THIS: ROLL CALL: Doe, John (1782-1860/70, Branford, CT >OH >MI) ROLL CALL: Doe, John (England > New Haven Co., CT 1834) PLEASE DO **NOT** MAKE YOUR SUBJECT LINE READ LIKE THIS: John Doe (or) Doe family (or) Roll call Subject lines should have enough information so that a potential reader will know if they are interested before reading the message itself. This means, at the very least a place (a state/country preferably with county/region) and a time period. Even better is an actual name, but that's probably secondary unless he/she is the focus of the question. "ROLL CALL: Oxford Doe" is okay; "ROLL CALL: Wallingford Doe 1750+" is better. Help us to help you by giving clear subject lines, okay? Thanks. :) I hope this answers any questions you might have, but if not, go right ahead and ask! Your post is every bit as important as mine or any other researcher's. :) Colleen

Thanks for the help and Happy Hunting! Rachel -----Original Message----- From: Bob Martin [mailto:bob.martin36@attbi.com] Sent: Monday, June 30, 2003 12:19 AM To: CTNEWHAV-L@rootsweb.com Subject: RE: [CTNEWHAV] FW: 1910 Federal Census index? It's a continuation from the prior Census page. There was a Hotel Martin on Court Street. Bob Martin, CSG #17217 Tolland, Ct. USA Visit my site at http://worldconnect.rootsweb.com/cgi-bin/igm.cgi?db=martinrf -----Original Message----- From: Rachel Conner [mailto:rachel.conner@insightbb.com] Sent: Sunday, June 29, 2003 11:18 PM To: CTNEWHAV-L@rootsweb.com Subject: [CTNEWHAV] FW: 1910 Federal Census index? I found them but still can't read the name of the street. They're in ward 6, enumeration district 397, sheet 15B. Does anyone know why the name of institution says Hotel Martin? Rachel Conner -----Original Message----- From: Rachel Conner [mailto:rachel.conner@insightbb.com] Sent: Sunday, June 29, 2003 10:13 PM To: CT New Haven message board Subject: 1910 Federal Census index? Does anyone have access to an index for the 1910 federal census for New Haven County, CT? I'm looking for the whereabouts of two Rowen (possibly Rowan) sisters, Bridget S and Maria A. In the 1920 census they were living together in New Haven's 6th ward between Olive St and St John's St, but the name of their street is illegible and no one else is listed as living with them or on their street. In the 1910 census this little street isn't there. The details from the 1920 New Haven City census are below: Rowen Bridget S, head, Owned, Mortgaged, Female, white, 67, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, nurse, illegible, works on own account Rowen Maria A, sister, ..., ..., female, white, 63, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, illegible, works at home, works on own account I believe these to be the sisters of Alice S Rowen, my g-grandmother, who married Thomas Robert O'Connell. I found their names on the burial card for my O'Connell family at St. Lawrence Cemetery in New Haven County so I don't have any other info. By the way, St Lawrence refused to make a copy or let me take a photo of the card. They did, however, let me write down EVERY word written on it. Does that make sense to anyone? Thanks for the help! Rachel Conner Lexington, KY USA ==== CTNEWHAV Mailing List ==== Please do not send messages with attachments, HTML, MIME, or any other enhanced text to the list. RootsWeb does not allow messages with those settings through their servers and will only return them to you. ============================== To join Ancestry.com and access our 1.2 billion online genealogy records, go to: http://www.ancestry.com/rd/redir.asp?targetid=571&sourceid=1237

It's a continuation from the prior Census page. There was a Hotel Martin on Court Street. Bob Martin, CSG #17217 Tolland, Ct. USA Visit my site at http://worldconnect.rootsweb.com/cgi-bin/igm.cgi?db=martinrf -----Original Message----- From: Rachel Conner [mailto:rachel.conner@insightbb.com] Sent: Sunday, June 29, 2003 11:18 PM To: CTNEWHAV-L@rootsweb.com Subject: [CTNEWHAV] FW: 1910 Federal Census index? I found them but still can't read the name of the street. They're in ward 6, enumeration district 397, sheet 15B. Does anyone know why the name of institution says Hotel Martin? Rachel Conner -----Original Message----- From: Rachel Conner [mailto:rachel.conner@insightbb.com] Sent: Sunday, June 29, 2003 10:13 PM To: CT New Haven message board Subject: 1910 Federal Census index? Does anyone have access to an index for the 1910 federal census for New Haven County, CT? I'm looking for the whereabouts of two Rowen (possibly Rowan) sisters, Bridget S and Maria A. In the 1920 census they were living together in New Haven's 6th ward between Olive St and St John's St, but the name of their street is illegible and no one else is listed as living with them or on their street. In the 1910 census this little street isn't there. The details from the 1920 New Haven City census are below: Rowen Bridget S, head, Owned, Mortgaged, Female, white, 67, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, nurse, illegible, works on own account Rowen Maria A, sister, ..., ..., female, white, 63, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, illegible, works at home, works on own account I believe these to be the sisters of Alice S Rowen, my g-grandmother, who married Thomas Robert O'Connell. I found their names on the burial card for my O'Connell family at St. Lawrence Cemetery in New Haven County so I don't have any other info. By the way, St Lawrence refused to make a copy or let me take a photo of the card. They did, however, let me write down EVERY word written on it. Does that make sense to anyone? Thanks for the help! Rachel Conner Lexington, KY USA ==== CTNEWHAV Mailing List ==== Please do not send messages with attachments, HTML, MIME, or any other enhanced text to the list. RootsWeb does not allow messages with those settings through their servers and will only return them to you. ============================== To join Ancestry.com and access our 1.2 billion online genealogy records, go to: http://www.ancestry.com/rd/redir.asp?targetid=571&sourceid=1237

I found them but still can't read the name of the street. They're in ward 6, enumeration district 397, sheet 15B. Does anyone know why the name of institution says Hotel Martin? Rachel Conner -----Original Message----- From: Rachel Conner [mailto:rachel.conner@insightbb.com] Sent: Sunday, June 29, 2003 10:13 PM To: CT New Haven message board Subject: 1910 Federal Census index? Does anyone have access to an index for the 1910 federal census for New Haven County, CT? I'm looking for the whereabouts of two Rowen (possibly Rowan) sisters, Bridget S and Maria A. In the 1920 census they were living together in New Haven's 6th ward between Olive St and St John's St, but the name of their street is illegible and no one else is listed as living with them or on their street. In the 1910 census this little street isn't there. The details from the 1920 New Haven City census are below: Rowen Bridget S, head, Owned, Mortgaged, Female, white, 67, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, nurse, illegible, works on own account Rowen Maria A, sister, ..., ..., female, white, 63, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, illegible, works at home, works on own account I believe these to be the sisters of Alice S Rowen, my g-grandmother, who married Thomas Robert O'Connell. I found their names on the burial card for my O'Connell family at St. Lawrence Cemetery in New Haven County so I don't have any other info. By the way, St Lawrence refused to make a copy or let me take a photo of the card. They did, however, let me write down EVERY word written on it. Does that make sense to anyone? Thanks for the help! Rachel Conner Lexington, KY USA

Hi Rachel, Found them in new haven. Will send Census page off line to you in .PDF format. Bob Martin, CSG #17217 Tolland, Ct. USA Visit my site at http://worldconnect.rootsweb.com/cgi-bin/igm.cgi?db=martinrf -----Original Message----- From: Rachel Conner [mailto:rachel.conner@insightbb.com] Sent: Sunday, June 29, 2003 10:13 PM To: CTNEWHAV-L@rootsweb.com Subject: [CTNEWHAV] 1910 Federal Census index? Does anyone have access to an index for the 1910 federal census for New Haven County, CT? I'm looking for the whereabouts of two Rowen (possibly Rowan) sisters, Bridget S and Maria A. In the 1920 census they were living together in New Haven's 6th ward between Olive St and St John's St, but the name of their street is illegible and no one else is listed as living with them or on their street. In the 1910 census this little street isn't there. The details from the 1920 New Haven City census are below: Rowen Bridget S, head, Owned, Mortgaged, Female, white, 67, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, nurse, illegible, works on own account Rowen Maria A, sister, ..., ..., female, white, 63, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, illegible, works at home, works on own account I believe these to be the sisters of Alice S Rowen, my g-grandmother, who married Thomas Robert O'Connell. I found their names on the burial card for my O'Connell family at St. Lawrence Cemetery in New Haven County so I don't have any other info. By the way, St Lawrence refused to make a copy or let me take a photo of the card. They did, however, let me write down EVERY word written on it. Does that make sense to anyone? Thanks for the help! Rachel Conner Lexington, KY USA ==== CTNEWHAV Mailing List ==== Please do not send messages with attachments, HTML, MIME, or any other enhanced text to the list. RootsWeb does not allow messages with those settings through their servers and will only return them to you. ============================== To join Ancestry.com and access our 1.2 billion online genealogy records, go to: http://www.ancestry.com/rd/redir.asp?targetid=571&sourceid=1237

Does anyone have access to an index for the 1910 federal census for New Haven County, CT? I'm looking for the whereabouts of two Rowen (possibly Rowan) sisters, Bridget S and Maria A. In the 1920 census they were living together in New Haven's 6th ward between Olive St and St John's St, but the name of their street is illegible and no one else is listed as living with them or on their street. In the 1910 census this little street isn't there. The details from the 1920 New Haven City census are below: Rowen Bridget S, head, Owned, Mortgaged, Female, white, 67, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, nurse, illegible, works on own account Rowen Maria A, sister, ..., ..., female, white, 63, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, illegible, works at home, works on own account I believe these to be the sisters of Alice S Rowen, my g-grandmother, who married Thomas Robert O'Connell. I found their names on the burial card for my O'Connell family at St. Lawrence Cemetery in New Haven County so I don't have any other info. By the way, St Lawrence refused to make a copy or let me take a photo of the card. They did, however, let me write down EVERY word written on it. Does that make sense to anyone? Thanks for the help! Rachel Conner Lexington, KY USA

Rachel, I think the street is "Artizan St.". It runs north and south between Court and St. John. Check out a map of New Haven on Yahoo Maps. The Hotel Martin may just be in reference to those lodgers on Court St. Hope this helps. Pam FL Rachel Conner <rachel.conner@insightbb.com> wrote: I found them but still can't read the name of the street. They're in ward 6, enumeration district 397, sheet 15B. Does anyone know why the name of institution says Hotel Martin? Rachel Conner -----Original Message----- From: Rachel Conner [mailto:rachel.conner@insightbb.com] Sent: Sunday, June 29, 2003 10:13 PM To: CT New Haven message board Subject: 1910 Federal Census index? Does anyone have access to an index for the 1910 federal census for New Haven County, CT? I'm looking for the whereabouts of two Rowen (possibly Rowan) sisters, Bridget S and Maria A. In the 1920 census they were living together in New Haven's 6th ward between Olive St and St John's St, but the name of their street is illegible and no one else is listed as living with them or on their street. In the 1910 census this little street isn't there. The details from the 1920 New Haven City census are below: Rowen Bridget S, head, Owned, Mortgaged, Female, white, 67, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, nurse, illegible, works on own account Rowen Maria A, sister, ..., ..., female, white, 63, single, can read, can write, born CT, father born Ireland, mother born Ireland, speaks English, illegible, works at home, works on own account I believe these to be the sisters of Alice S Rowen, my g-grandmother, who married Thomas Robert O'Connell. I found their names on the burial card for my O'Connell family at St. Lawrence Cemetery in New Haven County so I don't have any other info. By the way, St Lawrence refused to make a copy or let me take a photo of the card. They did, however, let me write down EVERY word written on it. Does that make sense to anyone? Thanks for the help! Rachel Conner Lexington, KY USA ==== CTNEWHAV Mailing List ==== Please do not send messages with attachments, HTML, MIME, or any other enhanced text to the list. RootsWeb does not allow messages with those settings through their servers and will only return them to you. ============================== To join Ancestry.com and access our 1.2 billion online genealogy records, go to: http://www.ancestry.com/rd/redir.asp?targetid=571&sourceid=1237

Do you havw a link to the New London Ct marriages???? I would like to look for a John Brannon and Rebecca Baldwin mar in abt 1764/5/6/7 -. He was in Pa and met her and they mar but we can't find where to prove her last name. We beleive it to be Baldwin and a dau of Jehiel Baldwin and she was in Meridian, New Haven or New london Co Ct. Are any Marriages on Net or accessable from abt 1760. In CT.??? Maxine Wilton mmwaw@sprynet.com ----- Original Message ----- From: <Ireneftw@aol.com> To: <ARMSTRONG-L@rootsweb.com> Sent: Sunday, June 29, 2003 4:58 PM Subject: [ARMSTRONG-L] lost A > As I searched the New London Co., CT, data base (Marriages) I located a > "Sarah Armstrong" who married James Payne 1/14/1734. Any ideas? > irene >

I found this interesting site : Jewish Historical Society of New haven. <A HREF="http://pages.cthome.net/hirsch"> http://pages.cthome.net/hirsch</A> it has cemetery listings and a lot of interesting information.Judy

I have finally found my Mack family in the 1870 census in Guilford, New Haven County. But, only part of the puzzle is solved. My family has always said Abraham and Mary Mack were the parents of Mary E., Charles B., Lottie, Frank, and Francis. There could be another child, Henry, with whom I found the family living in Guilford. The rest of the family fable is that the father and kids moved to Chicago after the death of his wife. After chasing that fable for awhile, and searching Chicago City Directories, it is true they went to Chicago about 1872. At least all of the kids did. In the 1870 census: Mack, Henry H., 28 CT, wife, Emma F., 24 MA, and children Mable E. and Jessie L., MA. Living with them: Mack, Sarah B. 46, Charles 14 and twin, Lottie 14, Fannie 11 and Frank 8. All born in CT. There is another daughter, Mary E. who married Horatio Evarts and is living in Guilford at this time. Sarah is in the 1880 census and it says she is a widow. There are two "others" living with her. I would like to learn who Sarah's parents were and who her husband was. If you can help, please let me know. Connie

I am looking for information on the family of Joseph Lipson who is found on the 1910 Federal census living in Waterbury, CT with his wife Eva and children Mary, Samuel and Sarah. According to that census Joseph was born in Russia in about 1881, he, Eva and Mary immigrated to America in about 1904, probably coming through England since that is where Mary was born in about 1902. Samuel born about 1907 and Sarah born about 1908 were both born in CT. The family is found in Bristol, CT on the 1920 census, not found so far in 1930. Any help would be appreciated. Thank you, Pam Lipson Jastremski FL

In a message dated 6/19/2003 3:05:26 PM Eastern Daylight Time, egodfrey@ttlc.net writes: > Subj:Re: [CTNEWHAV] William Potter > Date:6/19/2003 3:05:26 PM Eastern Daylight Time > From:<A HREF="mailto:egodfrey@ttlc.net">egodfrey@ttlc.net</A> > Reply-to:<A HREF="mailto:CTNEWHAV-L@rootsweb.com">CTNEWHAV-L@rootsweb.com</A> > To:<A HREF="mailto:CTNEWHAV-L@rootsweb.com">CTNEWHAV-L@rootsweb.com</A> > Sent from the Internet > > > > Does anyone have the whole Potter/Beecher line on line? I am related to the > Beechers in Woodbridge, Conn. Also the Downs family of Woodbridge. Sayy > Downs married David Cowell. > E Godfrey > egodfrey@ttlc.net > Beecher family website: http://worldconnect.rootsweb.com/cgi-bin/igm.cgi?op=GET&db=billjim&id=I4 Cary

Can you tell me some good resources for research in Woodbridge. I have a Linus GILBERT family that was there before they moved to Northfield, Litchfield Township, Litchfield County around 1801. Several of the births in the 1770's were recorded in New Haven--at Trinity Church I believe. Thank you, Ginny Echelberger "egodfrey" <egodfrey@ttlc.net> wrote: "I am related to the Beechers in Woodbridge, Conn. Also the Downs family of Woodbridge.

Does anyone have the whole Potter/Beecher line on line? I am related to the Beechers in Woodbridge, Conn. Also the Downs family of Woodbridge. Sayy Downs married David Cowell. E Godfrey egodfrey@ttlc.net ----- Original Message ----- From: "Nina Santoro" <ncsantoro@worldnet.att.net> To: <CTNEWHAV-L@rootsweb.com> Sent: Friday, April 12, 2002 8:58 AM Subject: Re: [CTNEWHAV] William Potter > Helen, > > Here's another descendant to claim William POTTER. > > He is my 8th great-grandfather in my maternal line. I descend through his > son Joseph who married Phebe IVES. > > I see you mentioned Joseph MANSFIELD. I also descend from his brother Moses > who married Mercy GLOVER [through daughter Mercy], so does my son-in-law > [through daughter Abigail]. It is amazing how these connections surface. > > Nina > > > > > ----- Original Message ----- > From: Helen C Davis <gertrude2@juno.com> > To: <CTNEWHAV-L@rootsweb.com> > Sent: Friday, April 12, 2002 8:21 AM > Subject: [CTNEWHAV] William Potter > > > > Good Morning, > > > > I've been lurking on this list, but thought I'd come out and claim > > William POTTER also. > > > > I descend from his daughter Mary who married Joseph MANSFIELD. > > > > I have information on this line that was sent to my by wonderful cousin, > > Dorothy Borne, <dotbnj@earthlink.net> > > Are there only Dorothy, Joanne, Harry and myself who are related to > > William? > > > > William Potter is the 4th great grandfahter of my 4th great grandmother, > > Harriet Ruggles GOLD who married Cherokee, Elias BOUDINOT. > > > > I see the surname BEECHER. Any relationship to Harriet Beecher Stowe? > > > > > > Helen Currie Davis > > Millington, TN > > gertrude2@juno.com > > > > > > ________________________________________________________________ > > GET INTERNET ACCESS FROM JUNO! > > Juno offers FREE or PREMIUM Internet access for less! > > Join Juno today! For your FREE software, visit: > > http://dl.www.juno.com/get/web/. > > > > > > ==== CTNEWHAV Mailing List ==== > > Please do not send messages with attachments, HTML, MIME, or any other > > enhanced text to the list. RootsWeb does not allow messages with those > > settings through their servers and will only return them to you. > > > > > > ============================== > > To join Ancestry.com and access our 1.2 billion online genealogy records, > go to: > > http://www.ancestry.com/rd/redir.asp?targetid=571&sourceid=1237 > > > > > > > ==== CTNEWHAV Mailing List ==== > Please do not send messages with attachments, HTML, MIME, or any other > enhanced text to the list. RootsWeb does not allow messages with those > settings through their servers and will only return them to you. > > > ============================== > To join Ancestry.com and access our 1.2 billion online genealogy records, go to: > http://www.ancestry.com/rd/redir.asp?targetid=571&sourceid=1237 > > >

What is the web site for the Ct Historical Soc? ----- Original Message ----- From: <rdbhanna@rcn.com> To: <CTNEWHAV-L@rootsweb.com> Sent: Friday, March 29, 2002 2:31 PM Subject: [CTNEWHAV] Historical Catalogue of the members of the 1st church..New HAven > I went onto the website of the Ct. Historical Society. They also have this book in their library. I've never been there but I have always wondered...they list such great resources. Book title again: Historical Catalogue of the Members of the First Church of Christ New Haven, Connecticut, 1639-1914. MY computer is balking and has to be defragmented...may be a delay in response. Deb > > > ==== CTNEWHAV Mailing List ==== > Need to reach Colleen, the discussion coordinator? Send her an email > at <ladyaudris@earthlink.net>. > > > ============================== > To join Ancestry.com and access our 1.2 billion online genealogy records, go to: > http://www.ancestry.com/rd/redir.asp?targetid=571&sourceid=1237 > > >

www.chs.org Deb egodfrey <egodfrey@ttlc.net> wrote: What is the web site for the Ct Historical Soc? ----- Original Message ----- From: To: Sent: Friday, March 29, 2002 2:31 PM Subject: [CTNEWHAV] Historical Catalogue of the members of the 1st church..New HAven > I went onto the website of the Ct. Historical Society. They also have this book in their library. I've never been there but I have always wondered...they list such great resources. Book title again: Historical Catalogue of the Members of the First Church of Christ New Haven, Connecticut, 1639-1914. MY computer is balking and has to be defragmented...may be a delay in response. Deb > > > ==== CTNEWHAV Mailing List ==== > Need to reach Colleen, the discussion coordinator? Send her an email > at . > > > ============================== > To join Ancestry.com and access our 1.2 billion online genealogy records, go to: > http://www.ancestry.com/rd/redir.asp?targetid=571&sourceid=1237 > > > ==== CTNEWHAV Mailing List ==== Please do not send messages with attachments, HTML, MIME, or any other enhanced text to the list. RootsWeb does not allow messages with those settings through their servers and will only return them to you. ============================== To join Ancestry.com and access our 1.2 billion online genealogy records, go to: http://www.ancestry.com/rd/redir.asp?targetid=571&sourceid=1237 --------------------------------- Do you Yahoo!? SBC Yahoo! DSL - Now only $29.95 per month!

Judy, A guess would be febrile Respiratory but that's just a guess. Another Judy

what would fb/R be as a cause of death? I think it is probably respiratory. The complete entry is fb/R age six months. Thanks, Judy

I am in the process of switching from AT&T To Road Runner. We just moved into a new house and I am going to ask that if you need to email me please send email to me at MyFamHrtGen@yahoo.com Thank you so much. Tonya Gauthier-Kellum ~*~*~*~*~*~*~*~*~*~*~ My Family's Heart Genealogy - http://myfamhrtgen.tripod.com/index.htm Volunteer Random Acts of Genealogy Kindness - http://www.raogk.com Vote For Our Site Today - http://www.topsitelists.com/topsites.cgi?ID=1&user=myfamhrtgen&area=clans ~*~*~*~*~*~*~*~*~*~*~

Hi all, This message is going out to all the lists I manage. If you receive this multiple times, please keep one and read it. Use your delete key on the rest... EFFECTIVE IMMEDIATELY... GIVE ME ADVANCE NOTICE and RECEIVE MY RESPONSE TO IT ***BEFORE*** you send me any material by way of attachment. Any data arriving before a notice will be deleted. ~@~@~@~@~@~@~@~@~@~@~@~@ NEWBIES AND COMPUTER NOVICES, PLEASE BE SURE TO READ **ALL** OF THIS MESSAGE... print this out if you have to, but understand that you need this information so you can protect your own computer, hence protect the rest of us... A new and dangerous version of the Tanatos Virus has hit cyberspace that all the major anti-virus houses have elevated to "red" on their scales and consider it "extremely dangerous." We are talking about one virus with TWO versions. ** Panda Anti-Virus Software has determined that this virus has already affected 23% of the computers globally. ** In just a few hours, this virus has already infected more computers than the Klez.I virus ~ the #1 virus since April 2002. I personally have already received 32 messages containing attachments with this virus. It is IMPERATIVE that you know about this one! The first thing I want to let you know is that YOU CAN NOT be infected by any messages coming from any of Rootsweb's lists. The threat to your computer DOES NOT come from the list itself. It comes OFF THE LIST from those friends, family members, acquaintances who have your email address in their computer's address books. They MAY OR may not belong to the same Rootsweb list(s) as you. That being said the following is important to remember when you read the information after the seven points I'll list below... 1. Rootsweb allows ONLY text messages through their filters. Attachments to messages are NOT allowed, nor can they get through those filters. 2. If you receive a message with an attachment that LOOKS like it came from the list, it's probably a virus-laden message (reread #1, above). DO NOT click on the attachment. Instead, either delete the message or email back to the person you received the message from and see if they sent you something by way of email. Just DON'T click on the attachment, particularly if it has a double extension (see #5). 3. Next, if you don't already have one, get yourself an anti-virus program IMMEDIATELY. A good, free one that I know of is AVG by Grisoft <http://www.grisoft.com>. Once you have it in your computer, be sure to update FREQUENTLY. 4. If you already have an AV program installed, update IMMEDIATELY. Norton AV has issued two AV updates in as many days. AVG has also issued updates and so has McAfee. 5. ANY file with a double extension (filename.pif.exe OR filename.gif.scr) is an excellent clue that you're sitting on an attachment with a virus in it. DO NOT OPEN IT!! Delete it immediately. 6. If your email program automatically opens attachments, go to your program options and find out how to stop that. You want to have to manually open them, especially now. 7. Quitting the Rootsweb lists you belong to isn't going to make your computer safe, nor will this virus "go away" tomorrow or even next week. Remember, it's whoever has you in their address books that you need to be concerned about. It IS wise at this point though, to be wary of any email list (for example, those at yahoogroups) that does allow attachments. Let's get started learning about this new virus... The new version of this malicious program, called Tanatos.b, has dangerously destructive capabilities for infecting computer files. Tanatos.a, also known as BugBear.a is a worm virus spreading via the Internet as an attachment to infected emails. The worm also copies itself over local networks to segments open for full access and runs backdoor and PSW trojan routines. Tanatos is a complex worm that contains many different elements: 1. Mass-mailer 2. Network Share Propagator 3. Keylogger 4. Remote Access Trojan 5. Polymorphic Parasitic File Infector 6. Security Software Terminator The Tanatos (BugBear) worm itself is a Windows PE EXE file about 50KB in length (it is compressed by the UPX utility), and written in Microsoft Visual C++. Aliases for the Tanatos virus are: Bugbear.B (F-Secure), PE_BUGBEAR.B (Trend), W32.Bugbear.B@mm (Symantec), W32.Kijmo, W32.Shamur, W32/Bugbear.b.dam, Win32.Bugbear.B (CA) ***HOT*** THE INFECTED MESSAGES HAVE DIFFERENT SUBJECTS, BODIES, AND ATTACHED FILE NAMES... The worm sends messages of two types (which it randomly selects). In first case, in order to run from the infected message the worm exploits the IFrame security breach (as a result the worm activates when a message is being opened or previewed in vulnerable (victim) systems). In the second case the worm does not use "breach tricks" and the attached worm copy activates from infected email only in case a user clicks on the attached file. The Tanatos worm got its name from the text string appearing in its code: Project Tanatos Installing While installing the worm copies itself to the Windows system directory under a random name and registers itself in the system registry auto-run key: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce The worm's EXE filename depends on the C: volume name, for example: FYOM.EXE YOK.EXE The worm also places a DLL file in the Windows system directory under a random name and uses this file to 'spy' on and record all keyboard input. The virus contains a long list of domain names (related to banking institutions). Strings within the virus suggest that if it determines the victim machine to belong to such a domain, the following Registry key is set: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings "EmableAutodial" = 00 00 00 01 For a list of the domains carried in the worm, go to the bottom of the page here: <http://vil.mcafee.com/dispVirus.asp?virus_k=100358> Mass-mailing ~ ***IMPORTANT!!!*** This worm emails itself to addresses found on the local system (in files and email messages). This goes for both the TO and FROM fields. Thus the SENDER ADDRESS IS SPOOFED, OR FORGED, AND NOT A DIRECT INDICATION OF AN INFECTED USER. It extracts addresses from file names containing these strings: * .DBX * .EML * INBOX * .MBX * .MMF * .NCH * .ODS * .TBB Spreading: Emails To send infected messages Tanatos uses a direct connection to the default email server. Victim email addresses are gotten from the following file types: *.ODS, *.MMF, *.NCH, *.MBX, *.EML, *.TBB, *.DBX, *INBOX* This virus spreads over the network (via network shares) and by mailing itself (using it's own SMTP engine). The Tanatos worm searches for these files in the system and extracts email-like strings from them. The Subject field is selected from the following variants: Greets! Get 8 FREE issues - no risk! Hi! Your News Alert $150 FREE Bonus! Re: Your Gift New bonus in your cash account Tools For Your Online Business Daily Email Reminder News free shipping! its easy Warning! SCAM alert!!! Sponsors needed new reading CALL FOR INFORMATION! 25 merchants and rising Cows My eBay ads empty account Market Update Report click on this! fantastic wow! bad news Lost & Found New Contests Today Only Get a FREE gift! Membership Confirmation Report Please Help... Stats I need help about script!!! Interesting... Introduction various Announcement history screen Correction of errors Just a reminder Payment notices hmm.. update Hello! Additionally, the message Subject can be randomly selected by "Tanatos" from a randomly selected disk file. Filenames may also be taken from files found in the infected computer's personal folder. The message Body is randomly selected by Tanatos varies and may contain fragments of files found on the victim's system (including old email messsages). The attached file name is also randomly selected and it may have a double extension, for example: filename.XLS.SCR Spreading: Network Tanatos enumerates network resources shared for writing, looks for the startup folder and copies its file to this folder (if found). This routine has a bug and the worm also sends copies of itself to shared network printers. Backdoor - HOW TANATOS WORKS... Tanatos is a remote access trojan, which means if your computer is infected, the worm open a port on your computer where it then listens for "master" commands (from the person or people who are controlling it). The backdoor routine grants control over infected machines, giving those who control Tanatos the ability to send/receive/copy/execute files, terminate processes, send out user info. etc. Tanatos also opens the HTTP server on infected machines, doing this offers a WEB interface with which to manipulate infected machines. PSW Trojan The worm also has a trojan routine that sends user info and cached passwords to several email addresses that are encrypted in the worm body. Other Among many others, Tanatos looks for the following applications and tries to terminate them: zonealarm.exe blackd.exe lockdown2000.exe avwin95.exe avgctrl.exe anti-trojan.exe safeweb.exe navwnt.exe navlu32.exe navapw32.exe Recognize that these files are execution files to anti-virus software programs. A full list of the applications Tanatos tries to attack can be found at <http://www.viruslist.com/eng/viruslist.html?id=52245>. Yes, there is a way to remove the virus from your computer if you find that it's been infected. Depending on the AV program you use, you'll need to visit their web site to get the repair. Scan your computer OFTEN. Update to the MAX. Be alert and be cautious. I've emphasized heavily about Rootsweb in this "head's up" because so many messages come to us offlist that do, in fact, have viruses attached. I get them every day. They appear to come FROM the list, when they actually DON'T. So, don't worry about receiving list mail. It's those messages offlist you need to be concerned about ~ which leads me to reiterate... The Tanatos (Bugbear) virus sends 3rd party emails where the FROM: address is spoofed. Third party viruses have 2 victims, the receiving and the spoofed sender. Rarely does a person today receive a virus directly from the purported sender. The Tanatos virus spoofs email addresses. So, if you receive an infected message from your mom (for example), realize that it WILL NOT have come from her computer but from someone (could even be someone she barely knows) who has her email address it it. BE VIGILANT with regard to the attachment itself. This information isn't meant to scare half the computer life out of you. However, it IS meant to make you aware of this malicious virus that can cost you money to get your computer repaired, cause you to lose your files, AND make a lot of people cranky! It's vital that you protect your computer so you can protect OUR computers. Colleen Pustola List Manager Permission is given to pass this message along.