I'm late logging on today, unfortunately the rootsweb lists are awash with this virus subject. I have had 7 such mails myself, all with attachments,which I *never* open unless expected. They all appeared to be replying to my list message re the Lookup Exchange/Help Page, but see below. The virus is called W32/Badtrans-A - Details of the virus from www.sophos.co.uk W32/Badtrans-A is a worm which uses MAPI to spread. The worm arrives in an email message with the text "Take a look to the attachment" It includes an attachment filename which is randomly chosen from a list The infected computer sends an email in reply to any message received - *including List mail*. So if one of our list subscribers is infected, then a reply will be sent to the email address of *anyone posting to the list * ** How to recognise the W32/Badtrans-A virus ** If you receive a reply to a _Dyfed/CGN/PEM List_ message which contains several lines from your original message followed by this phrase: -Take a look to the attachment *What to do*; 1) Do not **under any circumstances** open the attachment 2) Send me a message at tirbach@clara.co.uk with *just* the email address of the sender in the *subject line* together with Dyfed/CGN or PEM to tell me which list it is, I *won't* read the body of the message so please don't give me chapter and verse, or expect a reply. 3) Delete the message I will immediately unsubscribe from the lists the addresses *originating* an infected message. I will tell the listers concerned what is happening and why, and that they mustn't re subscribe until they are 100% sure they have effectively cleaned their computer. Bear in mind, it is NOT their fault, and they may not know they are infected until someone tells them. Gareth List Administrator for Dyfed, CGN & PEM. tirbach@clara.co.uk Lookup Exchange http://home.clara.net/tirbach/lookup.html Help Page http://home.clara.net/tirbach/hicks.html