John: In reply to your message regarding the virus: >Hi Leah, >I just saw your recent post. I'm curious how you knew those messages had the >W32/NewApt.Worm attached to them? Was there some indication that they had >the worm attached? And did you pick up the worm itself or were you lucky >enough to avoid it? I have McAfee AntiVirus on my computer and subscribe to their mailing list. I was pre-warned of the virus to watch for any E-mail containing the message shown after the dotted line below. The two messages I received had an immediate blue screen (with no message from a subscriber) but with the website and message shown below (after the dotted line). I received the following information from McAfee AntiVirus: Dear McAfee.com Dispatch Subscriber: W32/NewApt is an email worm. AVERT has given it a risk assessment of Medium--On Watch. This worm arrives as an email attachment. The body of the email appears differently depending on whether the email client reads HTML. If it does, the email text looks like this: Hypercool Happy New Year 2000 funny programs and animations... We attached our recent animation from this site in our mail ! Check it out If the email client is not HTML-capable, the message reads: he, your lame client cant read HTML, haha. click attachment to see some stunningly HOT stuff The worm is in the attachment, which has a name chosen randomly from the following list: baby.exe, bboy.exe, boss.exe, casper.exe, chestburst.exe, cooler1.exe, cooler3.exe, copier.exe, cupid2.exe, farter.exe, fborfw.exe, goal.exe, goal1.exe, g-zilla.exe, irngiant.exe, hog.exe, monica.exe, panther.exe, panthr.exe, party.exe, pirate.exe, s.exe, saddam.exe, theobbq.exe, video.exe. If the worm is run, the following dummy error message appears: The dinamic link library giface.dll could not be found in the specified path [list of directory names] Note the misspelling of the word "dynamic". If the worm detects that Outlook Express is installed, it will search for messages received and build a list of addresses. The next time Windows is booted, the worm waits an unspecified amount of time and then attempts to send itself to one of the addresses in its list, using the format described above. Leah The information below this line is what I received from the Woodford County, IL mailing list. (NOTE: Please do not click on the highlighted website.) - -------------------------------------------------------------------------- - ---------------------------------------------------- http://stuart.messagemates.com/index.html Hypercool Happy New Year 2000 funny programs and animations... We attached our recent animation from this site in our mail ! Check it out - -------------------------------------------------------------------------- ---------