[RC5] Virus alert !
toomas.aas at raad.tartu.ee
Thu Oct 10 15:36:04 EDT 2002
> ----- Original Message -----
> From: <PlasmaHH at gmx.net>
> To: <rc5 at lists.distributed.net>
> Sent: Thursday, October 10, 2002 3:45 AM
> Subject: [RC5] Virus alert !
> > this is important. I have just received an email with the New
> > Mail-Worm "Bugbear" attached. Someone (Probably Jeff Lawson) on
> > the list has been infected with this worm. So be carefull, keep
> > your virus-scanner up to date, and don't open attachments, the
> > attached file was an .xls.scr file...
In my experience, the From: address of bugbear is meaningless. Being a
postmaster of medium-sized network, I have received messages from
various virus scanners around the world claiming that user
somebody at my.domain has sent them bugbear, when I know that no such user
exists in my domain.
My hypotesis is that bugbear constructs its from: address using
addresses found on local machine, taking username part from one address
and domain part from another address.
Toomas Aas | toomas.aas at raad.tartu.ee | http://www.raad.tartu.ee/~toomas/
* A preposition is a bad thing to end a sentence with.
To unsubscribe, send 'unsubscribe rc5' to majordomo at lists.distributed.net
rc5-digest subscribers replace rc5 with rc5-digest
More information about the rc5