ABSOLUTELY, as already advised, turn off that Auto. add to address book. It is too easy to add them when you want to. The other question: With some virus' you can, with some you cannot. With this new virus, "W32/[email protected]" , you can, the sender is in fact the true sender. The one thing to watch out for is that it uses virus names for older virus', which can fool you into thinking you are dealing with a totally different virus. With the true SNOW-WHITE virus, you cannot determine who sent it, the only true fact you can find out is the domain name of the person who sent it. With the Happy99 virus, you cannot determine who sent it, the only true fact you can find out is the domain name of the person who sent it. This virus extracts an address from the infected comp.'s address book puts it into the "From" field of a new msg. with the virus file attached, extracts another address from the address book, puts it into the "To" field ,, then sends it. Many, many innocent people have been accused of being infected when they were not. SO ,,,,, be careful when telling someone they are infected, they just might not be. ALWAYS get a positive ID on the suspect virus and know its' characteristics before sending out a "You are infected" msg. Bob Hays _________________________________ ----- Original Message ----- From: "V. K. Nielsen" <[email protected]> To: <[email protected]> Sent: Sunday, April 22, 2001 3:21 PM Subject: [OE] Virus sender question > Is there a way to determine who is sending a virus to my e-mail address? (I > am running Windows 98 and OE5.) > > It goes in cycles, but sometimes I will get two or three a day and then go > for a couple of weeks and not get any. These always have the Snow White > subject line. > > Yesterday, about noon, I picked up my e-mail and there were three emails. > Two from a RootsWeb Digest and the third was Snow White. Luckily my anti > virus program (Norton) stops everything and asks what I want to do with the > silly thing, so I just delete the virus attachment. The e-mail is always > the same, but it will have different 'return path' addresses listed. > > But the scary part is when I clean out my address book (which is usually > once a month or so) there is the 'hahaha' address listed. > > Any thoughts (ideas? comments?) appreciated. > Kaylene > > > > ==== OUTLOOK-EXPRESS Mailing List ==== > To remove your email address from this list, visit this url: http://homepages.rootsweb.com/~cheps/maillist.htm >

Thank you to everyone who took the time to answer my question, (both on-list and off-list). Everyone suggested that I uncheck the "Automatically complete e-mail addresses when composing", which I have now done. I guess it was just laziness that I kept it that way. <g> I think it is very interesting how a virus works, but maybe even more interesting would be how the mind of the sender works. Thanks again, Kaylene

I made a message filter to move the take a look to my del folder, works good, but I have also been helping people all day on this who go it . Gads it seems we always get enough to deal with , all these danged virus's running amuck / Good thoughts Bob Dan ----- Original Message ----- From: Robert Hays <[email protected]> To: <[email protected]> Sent: Sunday, April 22, 2001 11:14 PM Subject: Re: [OE] Virus sender question > ABSOLUTELY, as already advised, turn off that Auto. add to address book. It is too easy to add them when you want to. > > The other question: > With some virus' you can, with some you cannot. > With this new virus, "W32/[email protected]" , you can, the sender is in fact the true sender. The one thing to watch out for is > that it uses virus names for older virus', which can fool you into thinking you are dealing with a totally different > virus