At 8:35 PM 11/26/01, Teresa wrote: >This system may work on most worms and trojans, but the unique thing >about this latest bug, which is a new version of Badtrans, is that it >replies to unopened mail it finds in your mailbox, instead of just >going into the address book and starting at the A's like most of them >do. This means the subject of the infected letter will be re: + the >subject of the mail it replied to. It looks like perfectly legitimate >mail coming in from someone you know, and the attachment may have a >common extension like .txt or .doc, too, which makes it more likely to >be opened. Very sneaky. And that is why it is proliferating so fast. >Sometimes the attachment is just a blank page of a notepad file. The >email address of the sender will be changed to include an underscore >( _ ) at the front of it, so watch out for that, too. > > Teresa is correct, the latest version of Badtrans, as well as some of the older viruses or worms, may show up in your mailbox as a message from a fellow genealogist, and may have a subject line that looks like a genealogy message. Say you sent a message to NCROOTS with the subject line "SMITH family in NC". Jane Doe's infected computer gets your message on the NCROOTS list, and then replies to it, sending you the virus or worm, without her knowing about it, with the subject line Re: [NCROOTS] SMITH family in NC You'll think it's a legitimate response from Jane, whom you may or may not know. The subject line leads you to believe that the message is about genealogy, and may cause you to think that you got the message from this list. I just got a message on McAfee's virus alert system this morning, but it didn't deal specifically with the new form of Badtrans, whose hallmark is that address with the underscore: <[email protected]> rather than <[email protected]>. If and when I get that information, I'll make it available to anyone on this list who wants it. BUT - please contact me PRIVATELY for this information, so we don't get into a protracted discussion of viruses on the list. Also, I use a Macintosh and am therefore not affected from the current crop of viruses that work off Microsoft Outlook Express on PCs. If you're in doubt about a message you've received, especially if you think it came from this list, then send me (<[email protected]>) a copy of the whole message, including the headers. If someone on the list is infected, I'll contact him or her for you and forward instructions on virus removal. Elizabeth Harris NCGenWeb project: http://www.rootsweb.com/~ncgenweb/ Winston-Salem NC area genealogy: http://users.erols.com/fmoran/