Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
X-Server-Uuid: 2d3b7162-db1d-11d3-b8ee-0008c7dfb6f1
Message-ID: <718198F862F1D411B10F0002A50A4DB1059FEBAE@e90wwce3.dx.deere.com>
From: "Polley Christopher W" <PolleyChristopherW AT JohnDeere DOT com>
Reply-to: cygwin AT cygwin DOT com
To: cygwin AT cygwin DOT com
Subject: RE: Viruses being transported with Cygwin messages
Date: Mon, 14 Oct 2002 08:23:10 -0500
MIME-Version: 1.0
X-WSS-ID: 11B41AB51079039-01-02
Content-Type: text/plain; 
 charset=iso-8859-1
Content-Transfer-Encoding: 7bit
Note-from-DJ: This may be spam

Robert,

It's probably not your system that is infected -- Bugbear, like KLEZ, uses
addresses harvested from the infected system in spoofed "From" headers.

The only way I've been able to guess at the real identity for
bugbear-infected mail that I've received (from friends/family) is to search
through my mailbox for the first Received header's domain, and from that,
look for a common association with the name in the "from" line.  On a
mailing list, that wouldn't work very well.

Warm regards,
Chris

>-----Original Message-----
>From: Gregg C Levine [mailto:drwho8 AT worldnet DOT att DOT net]
>Sent: Sunday, October 13, 2002 8:38 PM
>To: Robert Collins
>Cc: cygwin AT cygwin DOT com
>Subject: Re: Viruses being transported with Cygwin messages
>
>
>Hello from Gregg C Levine
>Gladly, if I can find it. It's a message in ugly HTML format, 
>and it arrived
>at my other address.
>Gregg C Levine drwho8 AT worldnet DOT att DOT net
>"Oh my!" The Second Doctor's nearly favorite phrase.
>----- Original Message -----
>From: "Robert Collins" <rbcollins AT cygwin DOT com>
>To: "Gregg C Levine" <drwho8 AT worldnet DOT att DOT net>
>Cc: <cygwin AT cygwin DOT com>
>Sent: Sunday, October 13, 2002 4:36 PM
>Subject: Re: Viruses being transported with Cygwin messages
>On Mon, 2002-10-14 at 05:04, Gregg C Levine wrote:
>> Hello from Gregg C Levine
>> Folks, don't roar at me, but I am seeing a number of 
>messages arrive here,
>> infected. One came with a message via Robert Collins, twice,
>
>Can you point me at the message with the virus? And the virus? I email
>from UNIX, so am *very* surprised at this.
>
>
>
>--
>Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
>Bug reporting:         http://cygwin.com/bugs.html
>Documentation:         http://cygwin.com/docs.html
>FAQ:                   http://cygwin.com/faq/
>
>


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/