The question was asked about the following. I received the same message regarding animation. The return address was the Highland list. But it was strange as I get everything in digest form and this was a single message. So I deleted because it didn't seem right. Later receive the explanation given below from another list. It would seem that Pat has received the virus (actually a worm) - if she activated it. Certainly someone on the Highland list may be UNWITTINGLY passing it. Or the virus/worm is using Pat's address book, or someone on the Highland list address book, to propagate. Even though I deleted without activating this virus I was told to run my virus scan, then do a full scan disc, followed by a disc defrag. I know I did not spread it as I have myself in my address book and it did not come back to me. Kathleen Rizer in Dayton. Pat wrote >I keep getting a blue background with an address for Stuart Message Mates >being sent to my address using the OHHIghland -l rootsweb list. Can someone >please explain to me what is going on? Thats all I get is this address with >something about animation. If someone is advertising on the list would you >please cut it out. Pat ---------- HERE IS THE EXPLANATION. > This is an FYI message. The rootsweb mailing list guru explains how a > recent virus operates, and that despite appearances, assures that it > cannot be passed along via the mailing list. If you receive any > messages with attached programs, it is good practice to check with the > apparent sender to make sure that they did send it. Remember Happy99. > This new virus is very similar. > > ======= > Message from Tim Price, AT Roostweb: > > Hi, folks - > > We've had a lot of reports tonight about a virus being passed > around on RootsWeb lists. I have looked into these reports > and it does NOT appear that the viruses have actually been > sent through our lists. > > I've included a semi-technical explanation of what I have been > able to find out, for those of you who are curious. The only > important message here is that RootsWeb's lists are NOT the > source of recent virus reports. > > What seems to be happening is that the current flock of viruses > do the following things when they infect a new computer: > > * The virus sends a copy of itself to everyone in the > computer's address book; > > * It forges its own return address to look like it was sent by > someone *else* in the address book; > > * and it uses the Subject line from a message that was recently > sent from that machine. > > So if an infected person sent mail to [email protected], > the virus might send out mail like this to someone else in the > victim's address book: > > From: [email protected] > To: [email protected] > Subject: [BUMBLEROTTER] looking for Fred and Wilma Bumblerotter > <http://stuart.messagemates.com/index.html>http://stuart.messagemates.com/in dex.html > > Hypercool Happy New Year 2000 funny programs and animations... > We attached our recent animation from this site in our mail ! Check it > out ! > > Even though the mail never was sent to RootsWeb, the return address > is forged to make it appear as if it came from us. > > I will continue to work on figuring out if there is anything that > we can do about this; in the meantime, please assure any concerned > subscribers that subscribing to a RootsWeb list is not dangerous. :-) > > -- > Regards, > Tim Pierce > RootsWeb.com lead system admonsterator > and Chief Hacking Officer ----------