I received this from someone on the Stone list and thought I would pass it on. I know it is accurate because, I had received four of these messages today from either the Pauley list or Perry. My Norton picked it up in time, it had no attachment to it but could still be destructive. So be careful what you are opening from whatever list or if it has attachments or not. Rosemary Honaker Researching; Stone, Berry, Perry, Basham, Hudnall, Romine, Walton, Pauley, Honaker, Cochran Web Page; http://home.earthlink.net/~roseh1550 GOD BLESS AMERICA GO... BROWNS -----Original Message----- From: John D Stone [mailto:johndstone@earthlink.net] Sent: Monday, November 26, 2001 11:26 AM To: STONE-L@rootsweb.com Subject: [STONE-L] W32.Badtrans.B@mm VIRUS ON STONE LIST I just received an email from: Rita Tulliani powerpuf@videotron.ca with the subject line: Re: [STONE-L] My Rememberer This blank message containes code that attempts to open a file called: S3MSONG.DOC.SCR This email HAD the W32.Badtrans.B@mm virus. THIS IS A NEW VIRUS and you need to ensure that you immediately update your virus software immediately! I found this this morning: --------------------------------- Badtrans virus spreading quickly Answers all unread e-mail to trick recipients By Bob Sullivan MSNBC Nov. 26 - Computer security experts say a fast-spreading e-mail worm called Badtrans infected computers across Europe on Monday and is now spreading around the United States. The worm uses several clever methods of duping a victim into infection - in some cases, users don't even have to open an e-mail. After infection, the malicious program attempts to steal private information. THE WORM WAS first discovered during the holiday weekend in the U.S., but was given a low-risk rating then. With a wide outbreak of infections occurring early Monday, most anti-virus firms have now raised their risk assessment. "It's by no means a 'Nimda' or a 'Code Red,' but it is catching an awful lot of people," said Roger Thompson, virus expert at TruSecure Corp. E-mail filtering firm MessageLabs Inc. said it had trapped nearly 11,000 copies of the worm by Monday morning, and the rate was climbing quickly. The worm employs clever social engineering tactics to trick users into infecting themselves. Once it infects a machine, it replies to any unanswered e-mail in the victim's Microsoft Outlook in-box. The subject line will mirror the original subject line, and the message body is a "reply-to" of the original sender's message, giving the infected e-mail a look of authenticity. It then asks the recipient to "take a look at the attachment." The attachment can have one of several names, according to F-secure. Pics.ZIP.scr images.pif README.TXT.pif New_Napster_Site.DOC.scr news_doc.scr hamster.ZIP.scr YOU_are_FAT!.TXT.pif searchURL.scr SETUP.pif Card.pif Me_nude.AVI.pif Sorry_about_yesterday.DOC.pif s3msong.MP3.pif docs.scr Humor.TXT.pif fun.pif McAfee.com suggested in its press release that the attachment file names might trick home users sending holiday e-mail to family and friends because the names include words like "Pics," "News," "Cards" and "Images." The worm also exploits a flaw in older versions of Microsoft's Outlook Express that automatically runs programs contained in e-mail as soon as they are view in Outlook's preview pane. That accounts for some of the worm's success in spreading, Thompson said. After infection, the worm attempts to send the victim's IP address to an anonymous e-mail account that likely belongs to the worm's author. The worm also installs a "keylogger" program, according to McAfee.com, which can capture and store personal data, such as credit card numbers and passwords. The Badtrans virus was first discovered in January, Thompson said, but this new variant - Badtrans.B - was released in compressed form, meaning it evades detection by older antivirus software. Corporations and home users need to update their antivirus programs to protect against the worm. ==== STONE Mailing List ==== Please remember that the list archives are available on the web and that all sources should be listed in each e-mail. Archive search engine is available at: http://searches.rootsweb.com/cgi-bin/listsearch.pl ============================== Search over 1 Billion names at Ancestry.com! http://www.ancestry.com/rd/rwlist1.asp --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.286 / Virus Database: 152 - Release Date: 10/9/01 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.286 / Virus Database: 152 - Release Date: 10/9/01