This article was recently in the Eastman's Online Genealogy Newsletter. I am posting it here, because I have received virii from some of you on the list. You may all want to be sure your computer is virii free. If you have any questions, please email me privately. jeanealogist@hotmail.com Ellen- Waukesha CC & Manitowoc CC - You May Have a Virus in Your Computer More than 300 readers of this newsletter have PCs infected with the new W32.BadTrans@mm virus. Are you one of them? You might wonder how I can tell the number of newsletter readers with virus problems. The answer is simple. I send thousands of e- mails every Sunday evening. Every week a handful of the e-mails bounce back to me as "undeliverable." These e-mails come back for a number of reasons. Often it is because someone has canceled his or her Internet account and the e-mail address is no longer valid. Sometimes it is because an e-mail server happens to be down or because a network connection some place in the world is inoperative for a bit. These "bounces" are normal, and I typically ignore them (the mailing list software automatically deletes the invalid addresses from the mailing list for me). However, after sending last week's newsletter, I started receiving an abnormal number of messages back. More than 300 e-mail messages were received in my Linux mail server over the next few days. When I looked at the messages received, I realized that they weren't the normal "bounces." In fact, almost every one of them carried the new W32.BadTrans@mm e-mail virus. That particular virus first appeared only a few days earlier. Such Windows viruses don't affect a Linux system such as my e-mail server, so no harm was done to my systems. However, it does show that more than 300 readers of this newsletter do have viruses on their Windows systems. Actually, the W32.BadTrans@mm infection is not a virus; it is a "worm." A "worm" is a piece of coding that gets into a computer as the user downloads an infected file or opens an infected email and then does some mischief. W32.BadTrans@mm is a mass-mailing worm that can infect any Windows computer. However, if that computer has Microsoft Outlook configured for its e-mail program, the W32.BadTrans@mm worm also looks for any unread e-mail messages, including this newsletter. The worm will then send replies to each of the unread e-mails, and each reply will include a copy of the W32.BadTrans@mm infection. That is what happened in the days following last Sunday's mailing of the newsletter: more than 300 computers sent virus-infected replies to my newsletter. Each of these computers had become infected sometime prior to the arrival of this newsletter. The computer owners involved probably never realized that their PCs were sending these e-mails. When run, the W32.BadTrans@mm worm displays a message box entitled, "Install error" which reads, "File data corrupt: probably due to a bad data transmission or bad disk access." There are several variants of this virus/worm; some of them will log keystrokes for the purpose of stealing personal information (such as credit card and bank account numbers and passwords). This information is later emailed to the virus author(s) via Microsoft Outlook. Again, the computer's owner probably will never know about the e-mail sent via Outlook. How about you: is your system infected? Are you sending virus- infected e-mails? Even worse, are you sending bank account information and other personal information to strangers? If you don't know, I would suggest that you better find out! 300 readers of this newsletter are doing just that. Unless you have a virus detection program, there is a strong possibility that your Windows system is infected. (Macintosh and Linux users need not worry.) Luckily, it is easy to determine if your system is infected or not, and it is also easy to remove the W32.BadTrans@mm virus. There are several free online scanning programs available that will detect the W32.BadTrans@mm virus as well as others. One I have used frequently is HouseCall, available at http://housecall.antivus.com. You can go to this site for a free scan of your hard drives. A small program will be downloaded to your PC, and it will scan all hard drives that you specify, looking for viruses. If a virus-infected file is found, HouseCall will remove it. Another free service is available from Panda Software at http://www.pandasoftware.com/activescan/activescan.asp?Language=2&Country=63&Partner=48&Ref=EN-PR-AS-107. I haven't used Panda, but I hear good things about it. I strongly suggest that you go to one of those sites right now and have your hard drive scanned for viruses. Both of these services are good for detecting viruses that already exist on your hard drive, but they do nothing to provide "up front" protection. There are numerous other programs that will look for viruses in every e-mail you receive. If found, the virus will automatically be deleted or neutralized before it can inflict any damage on your computer. The best-known anti-virus programs are produced by McAfee ( http://www.mcafee.com ) and the Norton division of Symantec ( http://www.norton.com ). These programs typically sell for $40 or so at your local computer store. They both are excellent programs and will provide top-notch protection. You can also find free anti-virus programs that will provide similar protection. While usually not as polished as McAfee or Norton's products, many people use them to provide virus and worm protection. Probably the best-known free anti-virus program is VCatch Virus Catcher at http://www.vcatch.com. Whether you use McAfee, Norton, VCatch, or some other anti-virus program, your computer is only protected against the viruses recognized by the program's definition files. The producers of these programs are constantly putting updates on their Web sites so that users can download them, keeping their protection current. Some of the programs automate this process for you, making it easy to keep your PC inoculated against the latest strains of viruses that proliferate across the Internet. The word to the wary is this: with any anti-virus program, you must make sure that you update the definition files (sometimes called "signature files") frequently to provide protection against new viruses. Keep in mind that the W32.BadTrans@mm virus/worm only infects Microsoft Outlook. It does not infect other e-mail programs. Many other viruses infect Outlook as well. Microsoft's popular free e- mail program has proven to have more holes than a pound of Swiss cheese. It is a virus writer's delight. While the above virus prevention programs are good, I would also suggest that another method of reducing your virus exposure is to switch to another e- mail program that isn't as risky. By using a different e-mail program you are still exposed to some viruses, but at least you won't be spreading them to your friends by some automatic re-mail process. You also won't be mailing your personal information to unknown virus authors. You do not need to spend any money to switch e-mail programs. Even though your Internet provider may specify that you use Outlook, you may be pleasantly surprised to learn that you can switch to almost any other modern e-mail program. The other e-mail programs work with almost all Internet providers except AOL. There are several free e-mail programs that are more powerful than Outlook, and they are much less likely to send viruses to all your friends. To be sure, there are no guarantees involved here. Theoretically, a virus writer could exploit a different e-mail program. However, history has proven that Outlook has been the major target of these outlaws. My favorite e-mail program is Eudora. It is very powerful and is available in a free version (although it will display advertising). It includes a spell checker as well as some very powerful e-mail filters. Eudora is easy to use, will run circles around Outlook, and has not yet been exploited by virus writers. Take a look at http://www.eudora.com to see what I mean. There are a number of other free e-mail programs as well, none of which are likely targets for virus writers. A combination of a free e-mail program and a free or low-cost anti-virus program can minimize your virus exposure. _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp