randy, i had same thing on my list CSA-History-L@rootsweb.com - forged from address. i rec'd 3 virus worms yesterday as attachments. all with .exe - i use Eudora mail, but there are some made for Outlook. caution do not click on any attachments that look suspicous. Attachment Converted: C:\EUDORA\panthr.exe" there are other names for this worm - gadget.exe is another i got yesterday. go to explorer and find them in your mail folder, delete them. I also had VBS.Freelink. Norton's has info. This site has info. and below is a msg from Rootsweb. josie http://stuart.messagemates.com/index.html a popup will appear: Important Notice We have just learned that an email worm has been found circulating the web referencing MessageMates.com. This worm file is in no way connected with MessageMates.com. If you have received an email with a message that reads: he, your lame client cant read HTML, haha. click attachment to see some stunningly HOT stuff or http://stuart.messagemates.com/index.html Hypercool Happy Year 2000 funny programs and animations . We attached our recent animation from this site in our mail! Check it out! then you have been passed the Worm in question. It is a worm that was created and set loose by someone whos trying to spoil all of our Holiday fun. Do not run the attachment included in the email and please delete the email message immediately! What we know about this Worm so far: Symantec has named this worm: W32.NewApt.Worm. Once opened/launched the worm will email itself out and reply to messages in your mailbox. The file being passed as an attachment is approximately 68K. The subject line of this message will vary and may appear to be a reply to something youve previously sent. The attachment is no way related to any MessageMates.com products. What you can do: Read the details of this worm virus by checking with Symantec at: www.symantec.com If you receive a suspect email with an .exe attachment from someone, first email them back and confirm that theyve intended to send you a MessageMate. What we can tell you about MessageMates.com: Our millions of loyal users are our number one priority and we are fully committed to providing software programs that are safe and fun. We never send out any unsolicited emails. We never send out attachments. Our files are 100% safe when downloaded directly from our web site. Please know that we at MessageMates.com have worked tirelessly to earn your trust and respect. We take great pride in our products and only want our users to have a positive and entertaining experience with them. Thank you for taking the time to read this very important notice. If you have any questions or comments, please email me directly at cheitmann@adtoolsinc.com Chris Heitmann Chief Operating Officer Message from Rootsweb Hi, folks - We've had a lot of reports tonight about a virus being passed around on RootsWeb lists. I have looked into these reports and it does NOT appear that the viruses have actually been sent through our lists. I've included a semi-technical explanation of what I have been able to find out, for those of you who are curious. The only important message here is that RootsWeb's lists are NOT the source of recent virus reports. What seems to be happening is that the current flock of viruses do the following things when they infect a new computer: * The virus sends a copy of itself to everyone in the computer's address book; * It forges its own return address to look like it was sent by someone *else* in the address book; * and it uses the Subject line from a message that was recently sent from that machine. So if an infected person sent mail to BUMBLEROTTER-L@rootsweb.com, the virus might send out mail like this to someone else in the victim's address book: From: BUMBLEROTTER-L@rootsweb.com To: joe@example.com Subject: [BUMBLEROTTER] looking for Fred and Wilma Bumblerotter <http://stuart.messagemates.com/index.html>http://stuart.messagemates.com/in dex.html Hypercool Happy New Year 2000 funny programs and animations... We attached our recent animation from this site in our mail ! Check it out ! Even though the mail never was sent to RootsWeb, the return address is forged to make it appear as if it came from us. I will continue to work on figuring out if there is anything that we can do about this; in the meantime, please assure any concerned subscribers that subscribing to a RootsWeb list is not dangerous. :-) -- Regards, Tim Pierce RootsWeb.com lead system admonsterator and Chief Hacking Officer At 04:14 PM 12/21/1999 -0800, you wrote: >>We always need to defend our computers against viruses. Right now, it is >>essential that we remember to do so, because there are worm viruses >>circulating. Remember that, once opened, worm viruses get into an innocent >>person's computer and send randomly, forging the FROM: address. The >>innocent person who unknowingly opened the virus and activated it usually >>does not even realize what has happened. > > >I just received a message from SANDIDGE-L@rootsweb.com that was titled >"Sandidge Family Bible" in the subject line. This email had a file attached >named goal1.exe and a hyper link to "Hypercool Happy New Year 2000 funny >programs". This is the latest worm virus! If you get this message, DON'T >opent it. > >Randy Martin >Pasadena, Texas > >jrmartin@pdq.net > >Visit my Home Page >http://freeweb.pdq.net/jrmartin/ > >Today I will gladly share my experience and advice, for there >are no sweeter words than "I told you so!" > > > > > > jbass@digital.net 216 Beach Park Lane Cape Canaveral, FL 32920-5003 Home of The *HARRISON* Repository & *MY FAMILY* http://moon.ouhsc.edu/rbonner/harintro.htm Our Family WWW: http://moon.ouhsc.edu/rbonner/index.htm LINDSAY & HARRISON Surnames & CSA-HISTORY Roots Mail List GENCONNECT: http://cgi.rootsweb.com/~genbbs/indx/FamAssoc.html Data Managed by beautiful daughter Becky Bass Bonner and me, Josephine Lindsay Bass