This is a multi-part message in MIME format. --------------BDA9B10B6EA86867BB7607FA Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit --------------BDA9B10B6EA86867BB7607FA Content-Type: message/rfc822 Content-Transfer-Encoding: 8bit Content-Disposition: inline Received: from mail6.bellsouth.net (mail6.bellsouth.net [205.152.150.6]) by mail0.bna.bellsouth.net (3.3.5alt/0.75.2) with ESMTP id OAA26554 for <allenjm@bna.bellsouth.net>; Thu, 4 May 2000 14:20:16 -0400 (EDT) Received: from cj.egroups.com (cj.egroups.com [208.50.144.68]) by mail6.bellsouth.net (3.3.5alt/0.75.2) with SMTP id OAA14027 for <allenjm@bellsouth.net>; Thu, 4 May 2000 14:13:05 -0400 (EDT) X-eGroups-Return: sentto-317435-1748-allenjm=bellsouth.net@returns.onelist.com Received: from [10.1.10.37] by cj.egroups.com with NNFMP; 04 May 2000 18:01:51 -0000 Received: (qmail 25183 invoked from network); 4 May 2000 18:01:49 -0000 Received: from unknown (10.1.10.26) by m3.onelist.org with QMQP; 4 May 2000 18:01:49 -0000 Received: from unknown (HELO smtp.netease.net) (64.7.232.15) by mta1 with SMTP; 4 May 2000 18:01:48 -0000 Received: from default [64.7.224.112] by smtp.netease.net (SMTPD32-5.05) id AB11F58002E; Thu, 04 May 2000 13:01:53 -0500 Message-ID: <002201bfb5f3$908e79c0$70e00740@default> To: "TN-all" <TN-all@egroups.com>, "Lenoir List" <LENOIR-L@rootsweb.com>, "Linville List" <LINVILLE-L@rootsweb.com>, "Walraven List" <WALRAVEN-L@rootsweb.com>, "Linda Ledlow" <Geannie42@aol.com>, "Pat M. Mahan" <mahan@hiwaay.net>, "Mitzi Thornell" <thornell@netease.net>, <TNWAYNE-L@rootsweb.com>, <Jenalogy@aol.com> X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.3115.0 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 From: "Edgar D. Byler, III" <edby3@netease.net> MIME-Version: 1.0 Mailing-List: list TN-all@egroups.com; contact TN-all-owner@egroups.com Delivered-To: mailing list TN-all@egroups.com Precedence: bulk List-Unsubscribe: <mailto:TN-all-unsubscribe@egroups.com> Date: Thu, 4 May 2000 13:05:53 -0500 Reply-To: "Edgar D. Byler, III" <edby3@netease.net> Subject: [TN-all] Re: [TNWAYNE] Fwd: MAJOR VIRUS WARNING-NO HOAX Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Mozilla-Status2: 00000000 The following is on the ABCNews website at http://abcnews.go.com/sections/tech/DailyNews/virus_000504.html Quote> May 4 A massively destructive virus that clogs networks and erases graphics and music files has infected up to 90 percent of the corporations in the world, a virus expert said today. Computer users who receive the e-mail should just delete it without opening the attachment, and they wont be infected. The virus apparently originated in the Phillippines and hit Europe and Asia early this morning, said Eric Chien, chief researcher at the Symantec Antivirus Research Center in the Netherlands. Symantec and other virus companies have already come up with vaccination and cure programs, but their Web sites were swamped by users this morning. Clogs Up Networks The virus uses similar tricks to last years feared Melissa virus, but its even more widespread and destructive, Chien said. First, loveletter resets a users Internet Explorer Start Page to a Web page containing an executable file. The page has since been taken down, Chien said. He said researchers are unsure what the executable file does when launched. Then, the virus searches for all files with the extensions JPG, JPEG, MP2, and MP3 the most popular graphics and sound formats as well as other, more obscure extensions. It erases the files and replaces them with copies of itself under the same name, with the extension VBS tacked on. Chat room aficionados are extra-vulnerable. The virus infects the popular mIRC chat program, so the next time a user starts chatting, the virus goes out to everyone in the room. Finally, the program multiplies by hijacking Microsoft Outlook and e-mailing itself to everyone in an Outlook address book. Anyone running Windows 98, Windows NT 4.0, or both Windows 95 and Internet Explorer 5.0 is vulnerable, Chien said. The virus needs Microsoft Outlook to spread. Macintosh and Linux users are not vulnerable. The virus spreads through corporate firewalls because most are not configured to reject attachments with a .txt.vbs extension, a relatively uncommon type of file, information systems managers said. Bored Student? Two lines within the virus identify the author as Spyder, part of the @GRAMMERsoft Group from Manila, Philippines and say I hate go to school. He also offers his opinion of his work: simple but I think this is good ... The group name is not familiar, said security consultant Brian Martin. And Spyder is a common name in the electronic underground. But the virus contains an e-mail address that should make it easy to track him, Martin said. Officials at Spyders e-mail provider, mail.com, are working on the problem, a mail.com spokeswoman said. The virus appears to have been written by a student, probably 14 to 28 years old and probably male as well, Chien said, citing code within the virus and past experience with virus writers. He seemed to just write it because he was bored. He probably has no idea hed cause so much chaos, Chien said. But the writer does have a good idea of psychology. By adding the phrase kindly check the attached LOVELETTER coming from me to the e-mails, he makes users think it might be a personal message. If you send an attachment with, Im a virus, run me, people wont run it. But with this, people say, oh, look, its a love letter, I think I ll open it, Chien said. The answer, security experts said, is simple: Never, ever, ever, open an attached file that comes as a surprise, no matter who it seems to be from, or how loving it seems to be. Stunning Spread Experts said they were stunned by the speed and wide reach of the virus. Many, many tens of thousands of machines have been infected by it, said Symantec spokesman Richard Saunders. In the U.S., the virus has affected the Pentagon, the federal Department of Agriculture, the Florida Lottery, the Wisconsin Legislature, and media organizations including Time Warner Inc., according to employees of affected companies and officials of anti-virus companies. It is literally anybody who is running Microsoft Outlook, and that is the most common e-mail client in the world, said Richard Jacobs, president of anti-virus firm Sophos. The bug appeared in Hong Kong late in the afternoon, spreading throughout e-mail systems once a user opened one of the contaminated messages. It later moved into European parliamentary houses and through the high-tech systems of big companies and financial traders. I have to tell you that, sadly, this affectionate greeting contains a virus which has immobilized the Houses internal communication system, said Margaret Beckett, leader of Britains House of Commons. This means that no member can receive e-mails from outside, nor indeed can we communicate with each other by e-mail. Companies in Denmark, Norway, the Netherlands and Switzerland were also hit. ABCNEWS Sascha Segan and The Associated Press contributed to this story. Curing the Virus May 4 All the major anti-viral companies have released free trial versions of their software that can fix the new virus. Try going to www.symantec.com, www.mcafee.com, or www.sophos.com. Youll be cured, but you won't be able to get your JPEG and MP3 files back unless you've made backups. To prevent further infections by copycat viruses, Richard Jacobs of Sophos recommends you turn off your Windows Scripting Host. In Windows 98, that means go to your Start Menu and choosing Settings, then Control Panel. Double-click on the Windows Components control panel, and then choose the Accessories option. Uncheck the box for Windows Scripting Host, which should be the last one on the list. Melissa and ILOVEYOU both use Windows Scripting Host to propagate, but very few users need it in their day-to-day lives, Jacobs said. The number-one lesson, antiviral experts agree, is to scrutinize e-mail closely. Its so important for people to think about what theyre opening in their e-mail. Very few people get large numbers of love letters via email, Jacobs said. -----Original Message----- From: Jenalogy@aol.com <Jenalogy@aol.com> To: TNWAYNE-L@rootsweb.com <TNWAYNE-L@rootsweb.com> Date: 04 May, 2000 12:19 PM Subject: [TNWAYNE] Fwd: MAJOR VIRUS WARNING-NO HOAX > >--part1_9b.48a1908.26430ad9_boundary >Content-Type: text/plain; charset="US-ASCII" >Content-Transfer-Encoding: 7bit > > > >--part1_9b.48a1908.26430ad9_boundary >Content-Type: message/rfc822 >Content-Disposition: inline > >Return-path: <Jenalogy@aol.com> >From: Jenalogy@aol.com >Full-name: Jenalogy >Message-ID: <8e.4985175.26430a38@aol.com> >Date: Thu, 4 May 2000 13:15:36 EDT >Subject: MAJOR VIRUS WARNING-NO HOAX >To: TNWAYNE@Rootsweb.com >CC: DAVIS-L@rootsweb.com, NORMAN-L@rootsweb.coM, ROSE-L@rootsweb.com, > BRYANT-L@rootsweb.com, SCUNION@rootsweb.com, CASEY-L@rootsweb.com, > Tommoore@hcnews.com, roadbait@uswest.net, sjritter@Compworldnet.net, > PapaGroom@aol.com, StewartOK@aol.com, admbak@mtnhome.com, > Nghtswimer@aol.com, Casey81@juno.com, TOYOTA97@webtv.net, > C.Kinnear@worldnet.att.net, dmohler@gotec.net, ARSEARCY-l@rootsweb.com, > Tom.Norman@alliedsignal.com >MIME-Version: 1.0 >Content-Type: text/plain; charset="US-ASCII" >Content-Transfer-Encoding: 7bit >X-Mailer: AOL 5.0 for Windows sub 106 > >ON MY TELEVISION (ABC) JUST NOW APPEARED A "BREAKING NEWS FLASH" STATING THAT >IN OUR AREA (TULSA) MAJOR COMPANY'S HAVE SHUT DOWN THEIR SYSTEMS BECAUSE OF A >VIRUS CALLED "I LOVE YOU" >THEY CALLED IT A VERY DANGEROUS VIRUS CAUSING MAJOR EXPENSE. THEY WENT >FURTHUR TO SAY, THAT, DO NOT OPEN THIS AT ALL. THOSE OF YOU THAT ARE IN THIS >AREA, THERE WILL BE MORE ON CHANNEL 8 ON THE EVENINMG NEWS. >I KNOW NO NOTHING ELSE ABOUT THIS AND I WILL KEY INTO AOL "COMPUTER VIRUS" >AND I SUGGEST THAT YOU DO THE SAME. >WARN YOUR FRIENDS. > >WANDA NORMAN > >--part1_9b.48a1908.26430ad9_boundary-- > > Community email addresses: Post message: TN-all@onelist.com Subscribe: TN-all-subscribe@onelist.com Unsubscribe: TN-all-unsubscribe@onelist.com List owner: TN-all-owner@onelist.com --------------BDA9B10B6EA86867BB7607FA--