At 07:59 AM 05/16/2001 -0500, you wrote: >I wrote Tawasha Hubbard about this problem April 7th and have not received a >reply. The name on the one I received was "Cunningham". I Assume it to be >from that person but they may not be aware of it. Might just be passing it >along without knowing it. >David [email protected] has been infected with the virus since at least April 30, the first time I got it. I thought she had probably got it cleared up. I wrote to her directly last Saturday and didn't get the virus back. Gene Phillips

Thanks, I received it again this morning. The message was sent directly to my address not the list. David -------------------------------------- ----- Original Message ----- From: Gene Philips <[email protected]> To: <[email protected]> Sent: Wednesday, May 16, 2001 10:47 AM Subject: Re: [OKMCCURT] Virus!!!! > At 07:59 AM 05/16/2001 -0500, you wrote: > >I wrote Tawasha Hubbard about this problem April 7th and have not received a > >reply. The name on the one I received was "Cunningham". I Assume it to be > >from that person but they may not be aware of it. Might just be passing it > >along without knowing it. > >David > > [email protected] has been infected with the virus since at > least April 30, the first time I got it. I thought she had probably got it > cleared up. I wrote to her directly last Saturday and didn't get the virus > back. > > Gene Phillips > > > ==== OKMCCURT Mailing List ==== > CONTACT the list admin. at [email protected] > Visit the McCurtain county page at http://www.rootsweb.com/~okmccurt/mccurt.htm > > ============================== > Visit Ancestry.com for a FREE 14-Day Trial and enjoy access to the #1 > Source for Family History Online. Go to: > http://www.ancestry.com/subscribe/subscribetrial1y.asp?sourcecode=F11HB > >

I got it too. But not from the person you named in a previous email. The one I got it from, I tried to email back to warn him he had a virus, and the email returned to me. Guess he changed his email address. This virus was sneaky. I didn't open the thing, I knew what it was. I deleted it, and deleted the trash. I thought I had got it all. But when I got home tonight, when I started the computer up, it activated. We had to go through a lot to get it off. It was trying to send out emails when I stopped it. I will paste my husband's email below to help in case one of you don't know how to get rid of this thing. Peggy Hamlett I am sending you this notice that I discovered a VIRUS upon opening my email this afternoon. Thankfully it appears this one started out by selecting junk mail from the trash, stripped HTML formatting from it, then sent it back to the entity that sent it and also sent it to me. Cute but not something I want automatically accomplished, thank you very much. Anyway, I downloaded the latest definitions created yesterday for Norton as the initial scan using last weeks definitions showed nothing. The newest definitions revealed the virus as being in the file INETD.EXE and identified the virus as [email protected] Virus.. In other words the virus apeared within the past week so hopefully none of you have it. This is a heads up. Above describes how it acted on our system. On the emails it creates it recreates itself in an attachment. The names of the attachment differ. On the five it created and sent before we caught it today the names of the attachments were, card.pif , card.pif, hamster.zip.scr , README.TXT.pif , SETUP.pif ... As you can see the most common thread is the ".pif" extension. ".pif" is usually used on windows systems to indicate a product information file. These files are run to create a set of system variables and create an environment for a particular program to run. The icons on your desktop are this type of file, they include a shortcut method of reaching the actual programs location on your hard disk and may provide any necessary additional data in the run command initiated when you double click the desk top icon. The "scr" extension is reserved for screen saver programs. All of the files the virus creates as attachments are 13.3KB in size regardless of the name or "." extension. Another name it creates which is the one we received as a reply to a genealogy inquiry is "MeWord.avi.pif" and "Me_Nude.avi.pif" It too was 13.3KB in length. The virus checker did not catch that because it is too new. Anyway The GOOD NEWS, the thing is easily removed. If you notice that your out box is suddenly showing up as having messages to send when you have not created any and are not sending any then stop the internet connection by logging off. I'm uncertain that the "INETD.EXE" is the file name created by the virus in every instance but it is the name used by the program on our system. To remove it I took the following steps. >From the "Start" Menu, I opened "run" and entered "msconfig" then clicked "OK" This brings up the "System Configuration Utility" There are six tabs at the top of the utility, "General", "Config.sys", "Autoexec.bat", "System.ini", "Win.ini", and "Startup" The tab to select is "Startup" This brings up a list of program options to be started "run" each time the system initializes. Not all of the items may be checked and the list varies from computer to computer depending on the hardware configuration. I admonish you to not begin checking and unchecking boxes as this may enable or disable programs and functions you may not desire. What I looked for was something new in the list but if you have not done this before you will not have a reference for that. I found the "INETD.EXE" program file had been added and simply removed the check mark in the box on the left to disable it from being loaded next time I turned on the system. If the virus behaves in the same manner it did on my system and creates a file named "INETD.EXE" it will add itself to the startup list by creating a "run = C:/WINDOWS/INETD.EXE" entry. Uncheck that option in msconfig then click apply at the bottom of the "System Configuration Utility" window. When you close System Configuration it will prompt you to restart your computer. You should do this. When the system completes rebooting you can then open windows explorer to the Windows Directory or wherever the path statement in the list indicates it is, locate the INETD.EXE file and Delete it. That completes removing the virus from your system. You can remove it from the trash and be certain it is GONE. We received it yesterday. We closed down the system this morning and on rebooting this afternoon the virus began operating. In other words the virus does not begin affecting your system until the next time you turn the system on. That then allows the entry it makes in your startup list to take effect. Hope nobody else receives the thing but if you do, you now have some clues as to what it is, how it behaves, and best of all how to get rid of it. Getting rid of it easily is the best part. Hope this is useful. ----- Original Message ----- From: "David Reid" <[email protected]> To: <[email protected]> Sent: Wednesday, May 16, 2001 11:42 AM Subject: Re: [OKMCCURT] Virus!!!! Thanks, I received it again this morning. The message was sent directly to my address not the list. David -------------------------------------- ----- Original Message ----- From: Gene Philips <[email protected]> To: <[email protected]> Sent: Wednesday, May 16, 2001 10:47 AM Subject: Re: [OKMCCURT] Virus!!!! > At 07:59 AM 05/16/2001 -0500, you wrote: > >I wrote Tawasha Hubbard about this problem April 7th and have not received a > >reply. The name on the one I received was "Cunningham". I Assume it to be > >from that person but they may not be aware of it. Might just be passing it > >along without knowing it. > >David > > [email protected] has been infected with the virus since at > least April 30, the first time I got it. I thought she had probably got it > cleared up. I wrote to her directly last Saturday and didn't get the virus > back. > > Gene Phillips >