Hello all, Reports of Viruses being attached to RootsWeb messages are FALSE. Read the below to see what is actually happeing, and be sure to not open ANY attachment without first checking with the supposed sender to see if they actually sent it, even if it looks like it came from someone you know. I just received one myself, supposedly from my husband, but using my email address instead of his as reply address. So who ever's computer is infected & sent it has our original email for him, but he now has his own. Since he is not subscribed to any rootsweb lists, it is impossible for his name to be on a message originating from rootsweb. Also, when I "view, properties, details" of the message with the attachment, it appears to have come thru my server (c2i2.com) but the next section says it came from jop.janics.com "Received: from mail.c2i2.com (jop52.janics.com [206.102.191.52])" whoever that might be. (and that may be fake also) Courtney tompkin@c2i2.com Cheatham County List "owner" ----- Original Message ----- From: Tim Pierce <twp@rootsweb.com> To: <listowners-announce@rootsweb.com> Sent: Wednesday, December 15, 1999 10:41 PM Subject: Recent Virus Reports > Hi, folks - > > We've had a lot of reports tonight about a virus being passed > around on RootsWeb lists. I have looked into these reports > and it does NOT appear that the viruses have actually been > sent through our lists. > > I've included a semi-technical explanation of what I have been > able to find out, for those of you who are curious. The only > important message here is that RootsWeb's lists are NOT the > source of recent virus reports. > > What seems to be happening is that the current flock of viruses > do the following things when they infect a new computer: > > * The virus sends a copy of itself to everyone in the > computer's address book; > > * It forges its own return address to look like it was sent by > someone *else* in the address book; > > * and it uses the Subject line from a message that was recently > sent from that machine. > > So if an infected person sent mail to BUMBLEROTTER-L@rootsweb.com, > the virus might send out mail like this to someone else in the > victim's address book: > > From: BUMBLEROTTER-L@rootsweb.com > To: joe@example.com > Subject: [BUMBLEROTTER] looking for Fred and Wilma Bumblerotter > > <http://stuart.messagemates.com/index.html>http://stuart.messagemates.com/in dex.html > > Hypercool Happy New Year 2000 funny programs and animations... > We attached our recent animation from this site in our mail ! Check it out ! > > Even though the mail never was sent to RootsWeb, the return address > is forged to make it appear as if it came from us. > > I will continue to work on figuring out if there is anything that > we can do about this; in the meantime, please assure any concerned > subscribers that subscribing to a RootsWeb list is not dangerous. :-) > > -- > Regards, > Tim Pierce > RootsWeb.com lead system admonsterator > and Chief Hacking Officer >