Mail Archives: cygwin/2002/10/14/09:23:23
Robert,
It's probably not your system that is infected -- Bugbear, like KLEZ, uses
addresses harvested from the infected system in spoofed "From" headers.
The only way I've been able to guess at the real identity for
bugbear-infected mail that I've received (from friends/family) is to search
through my mailbox for the first Received header's domain, and from that,
look for a common association with the name in the "from" line. On a
mailing list, that wouldn't work very well.
Warm regards,
Chris
>-----Original Message-----
>From: Gregg C Levine [mailto:drwho8 AT worldnet DOT att DOT net]
>Sent: Sunday, October 13, 2002 8:38 PM
>To: Robert Collins
>Cc: cygwin AT cygwin DOT com
>Subject: Re: Viruses being transported with Cygwin messages
>
>
>Hello from Gregg C Levine
>Gladly, if I can find it. It's a message in ugly HTML format,
>and it arrived
>at my other address.
>Gregg C Levine drwho8 AT worldnet DOT att DOT net
>"Oh my!" The Second Doctor's nearly favorite phrase.
>----- Original Message -----
>From: "Robert Collins" <rbcollins AT cygwin DOT com>
>To: "Gregg C Levine" <drwho8 AT worldnet DOT att DOT net>
>Cc: <cygwin AT cygwin DOT com>
>Sent: Sunday, October 13, 2002 4:36 PM
>Subject: Re: Viruses being transported with Cygwin messages
>On Mon, 2002-10-14 at 05:04, Gregg C Levine wrote:
>> Hello from Gregg C Levine
>> Folks, don't roar at me, but I am seeing a number of
>messages arrive here,
>> infected. One came with a message via Robert Collins, twice,
>
>Can you point me at the message with the virus? And the virus? I email
>from UNIX, so am *very* surprised at this.
>
>
>
>--
>Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
>Bug reporting: http://cygwin.com/bugs.html
>Documentation: http://cygwin.com/docs.html
>FAQ: http://cygwin.com/faq/
>
>
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Bug reporting: http://cygwin.com/bugs.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
- Raw text -