please check your systems for W32BadTrans.B infection; Perhaps if we can use the subject line as I did on this post we can get the message to those with infected machines? >From my machine, I can't even do reply to without getting the illegal performance message so I can't obtain the real address from File/Properties Just as it is important to work together to find our families and tear down our brick walls, I think it is important to try to help one another fight these danged virus/worms too! Have a great day everyone and remember to leave attachments alone! Dianna aka justpeachy@greenhills.net

I know some people don't like all this virus discussion, but I have a problem. Someone on another list I subscribe to (not this one) transmitted a virus to me, just like the one Diana was describing. The message line reads "re: " and I also get that illegal operations message. My problem is that whenever I try to either open the message or delete it, I get that illegal operations message and Outlook closes. So consequently, I can't get the dang thing off my email. Does anyone know how I can delete that infected message from my mail? I did download some virus software to protect against this happening again and it found 7 files infected with trans . . .worm or whatever that thing is called. Don't worry, that was on my computer at home, so this message is coming from a different computer. Plus, the software said that it deleted those 7 files. My apologies to those people who don't like to discuss the new virus, but it seems that my infection came from a genealogy list, so we need to protect ourselves. Janet Estep

On the post I sent with the subject line "OT/Concerning virus posts" I received a post back from the Mail Administrator informing me of the following: Recipient: <VARUSSELL-L@rootsweb.com> Reason: 5.1.1 <VARUSSELL-L@rootsweb.com>... User unknown Recipient: <ARHOTSPRING-L@rootsweb.com> Reason: 5.1.1 <ARHOTSPRING-L@rootsweb.com>... User unknown Recipient: <ARSEBASTIAN-L@rootsweb.com> Reason: 5.1.1 <ARSEBASTIAN-L@rootsweb.com>... User unknown Recipient: <KYELLIOTT-L@rootsweb.com> Reason: 5.1.1 <KYELLIOTT-L@rootsweb.com>... User unknown Recipient: <KYFLEMING-L@rootsweb.com> Reason: 5.1.1 <KYFLEMING-L@rootsweb.com>... User unknown Recipient: <KYGARRARD-L@rootsweb.com> Reason: 5.1.1 <KYGARRARD-L@rootsweb.com>... User unknown Recipient: <KYTRIMBLE-L@rootsweb.com> Reason: 5.1.1 <KYTRIMBLE-L@rootsweb.com>... User unknown This seems odd to me that I would be listed "User unknown" as I am getting mail FROM these lists. Curioser and curioser!

I know we have been asked not to discuss the virus situation on many of these lists so I am not asking for a discussion BUT I apparently been the recipient of the BadTrans.B worm numerous times since last Saturday. >>>Often arriving with a subject line of Re: and nothing else, the BadTrans.B worm can autolaunch itself onto your system using the one of the same vulnerabilities exploited by the Nimda worm. http://antivirus.about.com/library/weekly/aa112401a.htm <<< When I get these posts, I certainly don't open the attachment but the post will give me a flag message saying: Msimn This program has performed an illegal operation and will be shut down. If the problem persists, contact the program vender. The post will then freeze my Outlook Express and I will have to exit and then bring up OE again. (sometimes again and again and again before I can get off the post to delete it)! I cannot respond to the folks whose names are listed to let them know they have a problem. Is anyone else having this problem? I am certain that other than the idiots who seem to delight in causing problems for the rest of us with computers, NO ONE would knowingly and maliciously send these infected attachments. The batch this afternoon apparently has three infected machines involved. In an effort to alert those with a problem would it be okay to use "check for BadTrans.B" in the subject line and then list the parties the posts are coming from? The three I have this PM are from "Jones" "(null)" and "Chief" As I said, I am NOT opening any of the attachments and Symantec says my system is clean Thanks! Dianna Gilliam justpeachy@greenhills.net

>Hi All, >Here's another virus alert, especially if you use Outlook for >email. Click >on the link for virus scan & repairs. ><http://www.mcafee.com/anti-virus/viruses/goner/default.asp?cid=2636> > >'Goner' Worm Hitting Corporate, Individual PCs >Updated: Tue, Dec 04 3:35 PM EST >By Elinor Mills Abreu and Bernhard Warner > >SAN FRANCISCO/LONDON (Reuters) - A new computer worm named >"Goner" was >spreading quickly through corporate and personal e-mail inboxes >on Tuesday, >deleting system files and clogging networks in what could be >the biggest >outbreak since last year's "Love Letter" virus, security >software vendors >said. > >"Goner is one of the most incredibly fast moving and >potentially dangerous >e-mail viruses we've seen," said Mark Sunner, chief technology >officer of >MessageLabs Inc. > >The worm, a virus that propagates itself to other computers >through the >Internet or other networks, is affecting users of Microsoft >Corp.'s Outlook >and Outlook Express, said Ian Hameroff, business manager of >security >solutions at Computer Associates International Inc. > >People using ICQ instant messenger and Internet Relay Chat also >are >susceptible to the worm because files can be transferred across >those >networks, Hameroff said. > >The Goner worm arrives in an attachment masquerading as a >screensaver, with >an e-mail subject line of "Hi" and text that says: "How are >you? When I saw >this screen saver, I immediately thought about you I am in a >harry (sic), I >promise you will love it!" > >Once the attachment is clicked, the worm sends itself to >everyone in the >user's e-mail address book, tries to close programs that are >running and >deletes certain system files, including security software, said >Hameroff. > >Goner also tries to install a denial of service script on >machines of IRC >users, said Symantec Corp. . That could turn PCs into launch >pads for denial >of service attacks, which malicious hackers use to flood Web >servers with >traffic from multiple PCs, effectively shutting down Internet >sites to >legitimate traffic. > >"This is at outbreak status, which is very rare," said April >Goostree, virus >research manager at McAfee.com. ><http://www.mcafee.com/anti-virus/viruses/goner/default.asp?cid=2636> >"The last outbreak we had was 'Love Letter' in May 2000." > >A virus is given outbreak status by McAfee.com if it is >determined to be >spreading quickly and affecting large corporate networks as >well as >individual computer users, Goostree said. > >One of the nastier aspects of the virus is its attempt to >disable antivirus >and firewall software, so that victims have to reinstall the >software in >order to prevent future infections, said Sunner of MessageLabs. > >SPREADING QUICKLY IN EUROPE, US > >UK-based e-mail security outsourcer MessageLabs Inc. said it >was receiving >more than 100 copies of the worm a minute, totaling about >23,000 worldwide >since early Tuesday morning, with users in 17 countries hit. > >Anti-virus software firm Trend Micro Inc. said it had recorded >infections in >17,000 work stations and 30,000 corporate e-mail accounts >across Europe, >primarily in France, Germany and the United Kingdom. > >The first report came from a French company on Tuesday >afternoon, said >Raimund Genes, Trend Micro's European vice president of sales. >The firm has >issued a "high risk" warning on Goner, the same rating it >assigned this >summer's virulent Code Red worm > >"I expect by tomorrow morning we will see something in Asia, >and then from >Asia, we'll see re-infections in Europe," Genes said. > >The origin of the worm remained unclear. Trend Micro and >McAfee.com said >they suspect it originated in France. But Mikko Hypponen, >manager of >anti-virus research for Finland-based F-Secure, said he had his >doubts, as >the first recorded infections came from the United States and >South Africa. > >Hypponen also said he thought it suspicious that some of the >victims were >ICQ instant messenger and Internet Relay Chat users. "It's most >likely >written by a teenager targeting other teenagers," he said. Betty Lou Riley Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, Wildbirds, & Butterflies Mailing Lists CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup

Well I don't know about everyone else but I appreciate hearing from anyone when there's a potential problem. I don't want to get any viruses. I'd rather be safe than sorry. Thank you Betty Lou, it's nice to know some people care. Barb Weinel ----- Original Message ----- From: "Dennis V Carter" <dvcarter2001@hotmail.com> To: <KYLEWIS-L@rootsweb.com> Sent: Tuesday, November 27, 2001 3:49 PM Subject: [ KYLEWIS] Virus Warnings are Redundant > hi, > > i didn't join this list to have the list administrator issue virus > warnings... if you can't stick to the subject of genealogy then i'll gladly > unsubsribe. > thanx > dennis > > "Once, on this earth, on this familiar spot of ground, walked other men and > women, as actual as we are today, thinking their own thoughts, swayed by > their own passions, but now all are gone, one generation vanishing after > another, gone as utterly as we ourselves shall shortly be gone like ghosts > at cockcrow." -- G M Trevelyan > > in reply to: > > >From : > Betty Lou Riley <chipmunk@bright.net> > > To : > KYLEWIS-L@rootsweb.com > > Subject : > [ KYLEWIS] Virus Warning From List Owner > > Date : > Mon, 26 Nov 2001 18:47:12 -0500 > > As many of you have already found out, there is a new virus out there > and it > is spreading like a raging fire. > > Do not open any attachments!!! it pops up right away to open > the attachment. The message area of the email is blank. It is attaching > itself to everyone in the address book and sending the virus to them. > > Rootsweb is virus free but if your name is in address book of a person who > uses a rootsweb web mail list it will attach itself to that list. > > Please, Please be careful opening attachments. > > Spare yourself the grief of infecting yourself with this > nasty virus!! Upgrade your virus programs immediately. > > > > Betty Lou Riley > Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, > Wildbirds, & Butterflies Mailing Lists > CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup > > ______________________________ > > Previous Next | Close > > >From : > Betty Lou Riley <chipmunk@bright.net> > > To : > KYLEWIS-L@rootsweb.com > > Subject : > [ KYLEWIS] New Virus is loose! See Help insturctions > > Date : > Tue, 27 Nov 2001 06:33:02 -0500 > > New virus is loose! Uses attachments! Do NOT Open any attachments till > it cools down! > > Check Here!!!! > >From http://www.symantec.com/avcenter/venc/data/pf/w32.badtrans.b@mm.html > Symantec Security Response > http://securityresponse.symantec.com > W32.Badtrans.B@mm > Discovered on: November 24, 2001 > Last Updated on: November 24, 2001 at 12:19:48 PM PST > W32.Badtrans.B@mm is a MAPI worm that emails itself out as one of several > different file names. This worm also drops a backdoor trojan that logs > keystrokes. > Type: Worm > Virus Definitions: November 24, 2001 > Threat Assessment: > > Wild: > Medium Damage: > Low Distribution: > High > > Wild: > Number of infections: 50 - 999 > Number of sites: 3 - 9 > Geographical distribution: Medium > Threat containment: Easy > Removal: Easy > Damage: > Payload: > Large scale e-mailing: Sends email from addresses found in the default MAPI > program. > Compromises security settings: Installs keystroke logging Trojan. > Technical description: > This worm arrives as an email with one of several attachment names and a > combination of two appended extensions. > The list of possible file names is: > HUMOR > DOCS > S3MSONG > ME_NUDE > CARD > SEARCHURL > YOU_ARE_FAT! > NEWS_DOC > IMAGES > PICS > The first extension that is appended to the file name is one of the > following: > .DOC > .MP3 > .ZIP > The second extension that is appended to the file name is one of the > following: > .pif > .scr > The resulting file name would look something like this: > CARD.DOC.PIF > NEWS_DOC.MP3.SCR > etc. > When executed, this worm copies itself as kernel32.exe in the > "\windows\system" directory. It then adds the following registry value: > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Kernel3 > 2=kernel32.exe. > Prevention methods: > 1. Corporate email filtering systems should block all email that have > attachments with the extensions .scr and .pif. > 2. Users should not open any emails with an attachment that matches the > names listed above. Any email that has such an attachment should be deleted. > > > Removal instructions: > > > 1. Run LiveUpdate to make sure that you have the most recent virus > definitions. > 2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to > scan all files. For instructions on how to do this, read the document How to > configure Norton AntiVirus to scan all files. > 3. Run a full system scan. > 4. Delete all files that are detected as W32.Badtrans.B@mm. > 5. Remove the registry value listed above. > > > > > Write-up by: Patrick Martin > > > Here is the URL for a tool that can be used to removed the W32/SirCam virus: > http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.removal.tool.h tml > > Here is the URL for a webpage that can be used to remove most viruses: > http://securityresponse.symantec.com/ > > http://www.snopes.com/inboxer/virus/virus.htm > > > > At 04:10 PM 11/26/01 -0500, you wrote: > Dear chipmunk@bright.net, > > bright.net's anti-virus software has detected that "Jim & Donna Stewart" > <_jimndonna@eritter.net> has sent you > a virus via email. bright.net has stopped the virus before it has reached > your system. > > > Betty Lou Riley > Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, > Wildbirds, & Butterflies Mailing Lists > CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup > > > > _________________________________________________________________ > Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp > > > ==== KYLEWIS Mailing List ==== > > Messge Board: http://boards.ancestry.com/mbexec?htx=board&r=rw&p=localities.northam.usa.st ates.kentucky.counties.lewis&o=1&maxrows=25&dir=next >

I don't think the mention of the road change was referring to a town named Maddux. It probably referred to the land or farm of Mr. Maddux.

Richland Creek is still called by that name. It originates somewhere near Orangeburg, crosses Ky. 57 southwest of Tollesboro and flows easterly into the North Fork of Licking. There was once a Richland Baptist Church and a Richland school house.

Betty Lou Riley Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, Wildbirds, & Butterflies Mailing Lists CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup

Linda thanks for your reply. Jim

One of the identifiable characteristics of this worm that I did not mention yesterday is that the email affected will have a _ at the beginning of the address. Like this _chipmunk@bright.net Betty Lou Riley Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, Wildbirds, & Butterflies Mailing Lists CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup

who cares

Dear Whomever, This IS a Genealogy list and yes, most of us are cousins and we are family or we become good friends.. when Betty tells us to look out for this? She is helping us .. Evidently you do not belong on this list nor any other either, as they "ALL" tell us to look out for them .. they know about them before they hit us or we are aware. Sorry you think you are better than us .. I personally applaud the list owners for their Help to us .. Thank You for your help and making us aware, Betty. One who does appreciate you helpfulness. Regards, Derre Southworth Maybury searching RILEY-STAMPER-SMITH ----- Original Message ----- From: Dennis V Carter <dvcarter2001@hotmail.com> To: <KYLEWIS-L@rootsweb.com> Sent: Tuesday, November 27, 2001 2:49 PM Subject: [ KYLEWIS] Virus Warnings are Redundant > hi, > > i didn't join this list to have the list administrator issue virus > warnings... if you can't stick to the subject of genealogy then i'll gladly > unsubsribe. > thanx > dennis > > "Once, on this earth, on this familiar spot of ground, walked other men and > women, as actual as we are today, thinking their own thoughts, swayed by > their own passions, but now all are gone, one generation vanishing after > another, gone as utterly as we ourselves shall shortly be gone like ghosts > at cockcrow." -- G M Trevelyan > > in reply to: > > >From : > Betty Lou Riley <chipmunk@bright.net> > > To : > KYLEWIS-L@rootsweb.com > > Subject : > [ KYLEWIS] Virus Warning From List Owner > > Date : > Mon, 26 Nov 2001 18:47:12 -0500 > > As many of you have already found out, there is a new virus out there > and it > is spreading like a raging fire. > > Do not open any attachments!!! it pops up right away to open > the attachment. The message area of the email is blank. It is attaching > itself to everyone in the address book and sending the virus to them. > > Rootsweb is virus free but if your name is in address book of a person who > uses a rootsweb web mail list it will attach itself to that list. > > Please, Please be careful opening attachments. > > Spare yourself the grief of infecting yourself with this > nasty virus!! Upgrade your virus programs immediately. > > > > Betty Lou Riley > Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, > Wildbirds, & Butterflies Mailing Lists > CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup > > ______________________________ > > Previous Next | Close > > >From : > Betty Lou Riley <chipmunk@bright.net> > > To : > KYLEWIS-L@rootsweb.com > > Subject : > [ KYLEWIS] New Virus is loose! See Help insturctions > > Date : > Tue, 27 Nov 2001 06:33:02 -0500 > > New virus is loose! Uses attachments! Do NOT Open any attachments till > it cools down! > > Check Here!!!! > >From http://www.symantec.com/avcenter/venc/data/pf/w32.badtrans.b@mm.html > Symantec Security Response > http://securityresponse.symantec.com > W32.Badtrans.B@mm > Discovered on: November 24, 2001 > Last Updated on: November 24, 2001 at 12:19:48 PM PST > W32.Badtrans.B@mm is a MAPI worm that emails itself out as one of several > different file names. This worm also drops a backdoor trojan that logs > keystrokes. > Type: Worm > Virus Definitions: November 24, 2001 > Threat Assessment: > > Wild: > Medium Damage: > Low Distribution: > High > > Wild: > Number of infections: 50 - 999 > Number of sites: 3 - 9 > Geographical distribution: Medium > Threat containment: Easy > Removal: Easy > Damage: > Payload: > Large scale e-mailing: Sends email from addresses found in the default MAPI > program. > Compromises security settings: Installs keystroke logging Trojan. > Technical description: > This worm arrives as an email with one of several attachment names and a > combination of two appended extensions. > The list of possible file names is: > HUMOR > DOCS > S3MSONG > ME_NUDE > CARD > SEARCHURL > YOU_ARE_FAT! > NEWS_DOC > IMAGES > PICS > The first extension that is appended to the file name is one of the > following: > .DOC > .MP3 > .ZIP > The second extension that is appended to the file name is one of the > following: > .pif > .scr > The resulting file name would look something like this: > CARD.DOC.PIF > NEWS_DOC.MP3.SCR > etc. > When executed, this worm copies itself as kernel32.exe in the > "\windows\system" directory. It then adds the following registry value: > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Kernel3 > 2=kernel32.exe. > Prevention methods: > 1. Corporate email filtering systems should block all email that have > attachments with the extensions .scr and .pif. > 2. Users should not open any emails with an attachment that matches the > names listed above. Any email that has such an attachment should be deleted. > > > Removal instructions: > > > 1. Run LiveUpdate to make sure that you have the most recent virus > definitions. > 2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to > scan all files. For instructions on how to do this, read the document How to > configure Norton AntiVirus to scan all files. > 3. Run a full system scan. > 4. Delete all files that are detected as W32.Badtrans.B@mm. > 5. Remove the registry value listed above. > > > > > Write-up by: Patrick Martin > > > Here is the URL for a tool that can be used to removed the W32/SirCam virus: > http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.removal.tool.h tml > > Here is the URL for a webpage that can be used to remove most viruses: > http://securityresponse.symantec.com/ > > http://www.snopes.com/inboxer/virus/virus.htm > > > > At 04:10 PM 11/26/01 -0500, you wrote: > Dear chipmunk@bright.net, > > bright.net's anti-virus software has detected that "Jim & Donna Stewart" > <_jimndonna@eritter.net> has sent you > a virus via email. bright.net has stopped the virus before it has reached > your system. > > > Betty Lou Riley > Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, > Wildbirds, & Butterflies Mailing Lists > CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup > > > > _________________________________________________________________ > Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp > > > ==== KYLEWIS Mailing List ==== > > Messge Board: http://boards.ancestry.com/mbexec?htx=board&r=rw&p=localities.northam.usa.st ates.kentucky.counties.lewis&o=1&maxrows=25&dir=next > >

hi, i didn't join this list to have the list administrator issue virus warnings... if you can't stick to the subject of genealogy then i'll gladly unsubsribe. thanx dennis "Once, on this earth, on this familiar spot of ground, walked other men and women, as actual as we are today, thinking their own thoughts, swayed by their own passions, but now all are gone, one generation vanishing after another, gone as utterly as we ourselves shall shortly be gone like ghosts at cockcrow." -- G M Trevelyan in reply to: >From : Betty Lou Riley <chipmunk@bright.net> To : KYLEWIS-L@rootsweb.com Subject : [ KYLEWIS] Virus Warning From List Owner Date : Mon, 26 Nov 2001 18:47:12 -0500 As many of you have already found out, there is a new virus out there and it is spreading like a raging fire. Do not open any attachments!!! it pops up right away to open the attachment. The message area of the email is blank. It is attaching itself to everyone in the address book and sending the virus to them. Rootsweb is virus free but if your name is in address book of a person who uses a rootsweb web mail list it will attach itself to that list. Please, Please be careful opening attachments. Spare yourself the grief of infecting yourself with this nasty virus!! Upgrade your virus programs immediately. Betty Lou Riley Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, Wildbirds, & Butterflies Mailing Lists CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup ______________________________ Previous Next | Close >From : Betty Lou Riley <chipmunk@bright.net> To : KYLEWIS-L@rootsweb.com Subject : [ KYLEWIS] New Virus is loose! See Help insturctions Date : Tue, 27 Nov 2001 06:33:02 -0500 New virus is loose! Uses attachments! Do NOT Open any attachments till it cools down! Check Here!!!! >From http://www.symantec.com/avcenter/venc/data/pf/w32.badtrans.b@mm.html Symantec Security Response http://securityresponse.symantec.com W32.Badtrans.B@mm Discovered on: November 24, 2001 Last Updated on: November 24, 2001 at 12:19:48 PM PST W32.Badtrans.B@mm is a MAPI worm that emails itself out as one of several different file names. This worm also drops a backdoor trojan that logs keystrokes. Type: Worm Virus Definitions: November 24, 2001 Threat Assessment: Wild: Medium Damage: Low Distribution: High Wild: Number of infections: 50 - 999 Number of sites: 3 - 9 Geographical distribution: Medium Threat containment: Easy Removal: Easy Damage: Payload: Large scale e-mailing: Sends email from addresses found in the default MAPI program. Compromises security settings: Installs keystroke logging Trojan. Technical description: This worm arrives as an email with one of several attachment names and a combination of two appended extensions. The list of possible file names is: HUMOR DOCS S3MSONG ME_NUDE CARD SEARCHURL YOU_ARE_FAT! NEWS_DOC IMAGES PICS The first extension that is appended to the file name is one of the following: .DOC .MP3 .ZIP The second extension that is appended to the file name is one of the following: .pif .scr The resulting file name would look something like this: CARD.DOC.PIF NEWS_DOC.MP3.SCR etc. When executed, this worm copies itself as kernel32.exe in the "\windows\system" directory. It then adds the following registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Kernel3 2=kernel32.exe. Prevention methods: 1. Corporate email filtering systems should block all email that have attachments with the extensions .scr and .pif. 2. Users should not open any emails with an attachment that matches the names listed above. Any email that has such an attachment should be deleted. Removal instructions: 1. Run LiveUpdate to make sure that you have the most recent virus definitions. 2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files. 3. Run a full system scan. 4. Delete all files that are detected as W32.Badtrans.B@mm. 5. Remove the registry value listed above. Write-up by: Patrick Martin Here is the URL for a tool that can be used to removed the W32/SirCam virus: http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.removal.tool.html Here is the URL for a webpage that can be used to remove most viruses: http://securityresponse.symantec.com/ http://www.snopes.com/inboxer/virus/virus.htm At 04:10 PM 11/26/01 -0500, you wrote: Dear chipmunk@bright.net, bright.net's anti-virus software has detected that "Jim & Donna Stewart" <_jimndonna@eritter.net> has sent you a virus via email. bright.net has stopped the virus before it has reached your system. Betty Lou Riley Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, Wildbirds, & Butterflies Mailing Lists CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

Jim, I don't know if there is a connection or not!! I'll keep your email and if I ever find anything more about the Gray boys, I'll let you know. Linda

New virus is loose! Uses attachments! Do NOT Open any attachments till it cools down! Check Here!!!! From http://www.symantec.com/avcenter/venc/data/pf/w32.badtrans.b@mm.html Symantec Security Response http://securityresponse.symantec.com W32.Badtrans.B@mm Discovered on: November 24, 2001 Last Updated on: November 24, 2001 at 12:19:48 PM PST W32.Badtrans.B@mm is a MAPI worm that emails itself out as one of several different file names. This worm also drops a backdoor trojan that logs keystrokes. Type: Worm Virus Definitions: November 24, 2001 Threat Assessment: Wild: Medium Damage: Low Distribution: High Wild: Number of infections: 50 - 999 Number of sites: 3 - 9 Geographical distribution: Medium Threat containment: Easy Removal: Easy Damage: Payload: Large scale e-mailing: Sends email from addresses found in the default MAPI program. Compromises security settings: Installs keystroke logging Trojan. Technical description: This worm arrives as an email with one of several attachment names and a combination of two appended extensions. The list of possible file names is: HUMOR DOCS S3MSONG ME_NUDE CARD SEARCHURL YOU_ARE_FAT! NEWS_DOC IMAGES PICS The first extension that is appended to the file name is one of the following: .DOC .MP3 .ZIP The second extension that is appended to the file name is one of the following: .pif .scr The resulting file name would look something like this: CARD.DOC.PIF NEWS_DOC.MP3.SCR etc. When executed, this worm copies itself as kernel32.exe in the "\windows\system" directory. It then adds the following registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Kernel3 2=kernel32.exe. Prevention methods: 1. Corporate email filtering systems should block all email that have attachments with the extensions .scr and .pif. 2. Users should not open any emails with an attachment that matches the names listed above. Any email that has such an attachment should be deleted. Removal instructions: 1. Run LiveUpdate to make sure that you have the most recent virus definitions. 2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files. 3. Run a full system scan. 4. Delete all files that are detected as W32.Badtrans.B@mm. 5. Remove the registry value listed above. Write-up by: Patrick Martin Here is the URL for a tool that can be used to removed the W32/SirCam virus: http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.removal.tool.html Here is the URL for a webpage that can be used to remove most viruses: http://securityresponse.symantec.com/ http://www.snopes.com/inboxer/virus/virus.htm At 04:10 PM 11/26/01 -0500, you wrote: >Dear chipmunk@bright.net, > >bright.net's anti-virus software has detected that "Jim & Donna Stewart" ><_jimndonna@eritter.net> has sent you >a virus via email. bright.net has stopped the virus before it has reached >your system. Betty Lou Riley Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, Wildbirds, & Butterflies Mailing Lists CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup

>As many of you have already found out, there is a new virus out there and it >is spreading like a raging fire. > >Do not open any attachments!!! it pops up right away to open >the attachment. The message area of the email is blank. It is attaching >itself to everyone in the address book and sending the virus to them. > >Rootsweb is virus free but if your name is in address book of a person who >uses a rootsweb web mail list it will attach itself to that list. > >Please, Please be careful opening attachments. > > Spare yourself the grief of infecting yourself with this >nasty virus!! Upgrade your virus programs immediately. > Betty Lou Riley Admin: OHAdams, KYLewis, Kirkendall, McGovney, Murr, Rideout, Ridout, Wildbirds, & Butterflies Mailing Lists CC: OHAdams, KYLewis CA: OHAdams, KYLewis, & KYGreenup

Yes, I have a copy of the lawsuit. Ruth and I copied everything in the courthouse with the Maddox name on it when we were there in August. I look forward to reading the Dr's article. I called him twice while in Lewis Co., but the first time he wasn't home, and the second time he line was busy then he rushed out the door apparently because there was no answer after he hung up. Oh well. I have a poster-sized topigraphical map of Lewis Co., plus a locally-produced nearly-as-large one. So will be well equipped when I read his article. Thank you again. Katheryn Katheryn ----- Original Message ----- From: Barbara Richards <barich@fuse.net> To: <KYLEWIS-L@rootsweb.com> Sent: Monday, November 26, 2001 10:15 AM Subject: [ KYLEWIS] Re: Zorobable Maddox's land > Katheryn > Re: Zorobable Maddox > Search KYLEWIS-L for Dr. Talley's article Jan 10, 2000 "1775 early travelers cross Lewis Co" > In it he is tracing the old Cabin Creek War Road - we would probably call an Indian trail. > Paragraphs 5-9 refers to court case by Marshall heirs re a very large tract of land.on North > Fork of Licking - Some of it in possession of Zorobabel Maddox who the Marshall heirs > in 1815 brought suit to eject. Read this with map in hand. > Barb > > > > > Subject: Re: [ KYLEWIS] Richland Creek > > Date: Sun, 25 Nov 2001 05:08:25 -0500 > > From: "K. Haddad" <khaddad@attcanada.ca> > > To: KYLEWIS-L@rootsweb.com > > > > Richland Creek is somewhere around Orangeburg since a road was laid out from > > Maddux to Williamsburg (Orangeburg) "as far as Richland Creek.". But I do > > not know which creek used to be known as Richland. > > > > I am trying to locate where Zorobable Maddox had his 500 acres. It was N. > > of the Licking and also touched Richland Creek - unless he had more than one > > parcel of land which could be. > > > > Katheryn > > > > > > ==== KYLEWIS Mailing List ==== > > Messge Board: http://boards.ancestry.com/mbexec?htx=board&r=rw&p=localities.northam.usa.st ates.kentucky.counties.lewis&o=1&maxrows=25&dir=next > >

Katheryn Re: Zorobable Maddox Search KYLEWIS-L for Dr. Talley's article Jan 10, 2000 "1775 early travelers cross Lewis Co" In it he is tracing the old Cabin Creek War Road - we would probably call an Indian trail. Paragraphs 5-9 refers to court case by Marshall heirs re a very large tract of land.on North Fork of Licking - Some of it in possession of Zorobabel Maddox who the Marshall heirs in 1815 brought suit to eject. Read this with map in hand. Barb > > Subject: Re: [ KYLEWIS] Richland Creek > Date: Sun, 25 Nov 2001 05:08:25 -0500 > From: "K. Haddad" <khaddad@attcanada.ca> > To: KYLEWIS-L@rootsweb.com > > Richland Creek is somewhere around Orangeburg since a road was laid out from > Maddux to Williamsburg (Orangeburg) "as far as Richland Creek.". But I do > not know which creek used to be known as Richland. > > I am trying to locate where Zorobable Maddox had his 500 acres. It was N. > of the Licking and also touched Richland Creek - unless he had more than one > parcel of land which could be. > > Katheryn >

I too would like some directions to the Bethel Cemetery. Sharon Morgan researching surnames: Jordan,Arms,Pruitt,Conn(have 2 seperate lines on this one)Horsley,Bloomfield,Rister,Cassidy(ty) ----- Original Message ----- From: <altcommlt@aol.com> To: <KYLEWIS-L@rootsweb.com> Sent: Wednesday, November 21, 2001 11:50 AM Subject: [ KYLEWIS] Cemetery Directions > Hi All, > A gentleman wrote me yesterday and wanted directions to some cemeteries as he > will be making the trip to Lewis Co. on Thursday. If you can help him, reply > directly to him to save time. > Thanks! > Lin > <<Wayne Johnson wrote ...... waynejohnson25701@yahoo.com > We are making plans to come to Lewis Co. on Thursday on Thanksgiving. I know > this is going to be short timing, but I was wondering if you could send me > directions to some cemeteries there in Lewis co. > > Bethel Cemetery > Carrington Farm Cemetery > Clarksburg Cemetery > Esham Cemetery > Fairmount Cemetery > Hackworth Cemetery > Mt Tabor Cemetery > Oak ridge Cemetery > Bivin Cemetery, Salt lick > East fork church cemetery, Cabin creek > valley cemetery>> > > > ==== KYLEWIS Mailing List ==== > > Messge Board: http://boards.ancestry.com/mbexec?htx=board&r=rw&p=localities.northam.usa.st ates.kentucky.counties.lewis&o=1&maxrows=25&dir=next >