This virus is not a hoax! I just received it in my email a few minutes ago addresed from one of my lists at an address that isn't even subscribed to the list! Rootsweb sent out a notice to all listowners a couple of days ago concerning this virus. I've included that message below. Jerry W. Murphy jwmurphy@netease.net or jwm1960@hotmail.com Listowner: ALFRANKL-L@rootsweb.com Listowner: TNHARDIN-L@rootsweb.com Listowner: TNWAYNE-L@rootsweb.com Listowner: COCHRAN-L@rootsweb.com Listowner: PATTERSON-L@rootsweb.com Wayne County, Tennessee Web Page: http://www.netease.net/wayne Wayne County Computer Club: http://www.netease.net/waccc ----- Original Message ----- From: Tim Pierce <twp@rootsweb.com> To: <listowners-announce@rootsweb.com> Sent: Wednesday, December 15, 1999 11:41 PM Subject: Recent Virus Reports > Hi, folks - > > We've had a lot of reports tonight about a virus being passed > around on RootsWeb lists. I have looked into these reports > and it does NOT appear that the viruses have actually been > sent through our lists. > > I've included a semi-technical explanation of what I have been > able to find out, for those of you who are curious. The only > important message here is that RootsWeb's lists are NOT the > source of recent virus reports. > > What seems to be happening is that the current flock of viruses > do the following things when they infect a new computer: > > * The virus sends a copy of itself to everyone in the > computer's address book; > > * It forges its own return address to look like it was sent by > someone *else* in the address book; > > * and it uses the Subject line from a message that was recently > sent from that machine. > > So if an infected person sent mail to BUMBLEROTTER-L@rootsweb.com, > the virus might send out mail like this to someone else in the > victim's address book: > > From: BUMBLEROTTER-L@rootsweb.com > To: joe@example.com > Subject: [BUMBLEROTTER] looking for Fred and Wilma Bumblerotter > > <http://stuart.messagemates.com/index.html>http://stuart.messagemates.com/in dex.html > > Hypercool Happy New Year 2000 funny programs and animations... > We attached our recent animation from this site in our mail ! Check it out ! > > Even though the mail never was sent to RootsWeb, the return address > is forged to make it appear as if it came from us. > > I will continue to work on figuring out if there is anything that > we can do about this; in the meantime, please assure any concerned > subscribers that subscribing to a RootsWeb list is not dangerous. :-) > > -- > Regards, > Tim Pierce > RootsWeb.com lead system admonsterator > and Chief Hacking Officer >