In a message dated 3/14/99 1:28:06 PM Pacific Standard Time,
[log in to unmask] writes:

> Steve (and everyone):
>
>          The way a worm virus (like happy99) works is by sending
>          itself from an infected system.
>
>          While Eddy's spam to TechNet addresses is well known, he
>          is not sending the virus conciously.  His system is in-
>          fected and therefore it is either attaching itself to
>          his outgoing mails or perhaps reading his address book
>          and sending itself.  I forget which exact form this virus
>          takes.

Hi Jeff!

    Sends itself? Wow, I never knew that...might explain why there was no
other text in the email. Hmmmmm, now I feel like maybe I WAS a little too
harsh. Still, I haven't recieved a reply from Eddy saying he never sent the
email.

   Basically the biggest reason I sent the original email to the list was
because I knew that Happy99.exe is real virus, a worm. I had it sent to me and
suspected that the file might have been sent to others on the list because of
the email subject; "Evergreen PCB"...this has since proved to be true. Whether
Eddy himself sent the email, or his computer did, I wanted to warn everybody
to not download the file. A lot of us know about these files, but I think
there's a good number that don't.

     I'm also aware that there are a number of hoaxes out there that seem to
go on forever and almost become "virus like" themselves merely because
everybody keeps emailing each other warning one another about something that
doesn't really exist...it just keeps pyramiding and pyramiding.

    I guess I got a little carried away with giving a blow-by-blow description
of my 'Net detective work...BUT I learned something new, didn't know viruses
could spread themselves...THAT'S kinda' scary!!

-Steve Gregory-

################################################################
TechNet E-Mail Forum provided as a free service by IPC using LISTSERV 1.8c
################################################################
To subscribe/unsubscribe, send a message to [log in to unmask] with following text in the body:
To subscribe:   SUBSCRIBE TechNet <your full name>
To unsubscribe:   SIGNOFF TechNet 
################################################################
Please visit IPC's web site (http://www.ipc.org) "On-Line Services" section for additional information.
For technical support contact Hugo Scaramuzza at [log in to unmask] or 847-509-9700 ext.312
################################################################