RE: Viruses being transported with Cygwin messages

["Polley Christopher W" <PolleyChristopherW at JohnDeere dot com>]

Robert,

It's probably not your system that is infected -- Bugbear, like KLEZ, uses
addresses harvested from the infected system in spoofed "From" headers.

The only way I've been able to guess at the real identity for
bugbear-infected mail that I've received (from friends/family) is to search
through my mailbox for the first Received header's domain, and from that,
look for a common association with the name in the "from" line.  On a
mailing list, that wouldn't work very well.

Warm regards,
Chris

>-----Original Message-----
>From: Gregg C Levine [mailto:drwho8@worldnet.att.net]
>Sent: Sunday, October 13, 2002 8:38 PM
>To: Robert Collins
>Cc: cygwin@cygwin.com
>Subject: Re: Viruses being transported with Cygwin messages
>
>
>Hello from Gregg C Levine
>Gladly, if I can find it. It's a message in ugly HTML format, 
>and it arrived
>at my other address.
>Gregg C Levine drwho8@worldnet.att.net
>"Oh my!" The Second Doctor's nearly favorite phrase.
>----- Original Message -----
>From: "Robert Collins" <rbcollins@cygwin.com>
>To: "Gregg C Levine" <drwho8@worldnet.att.net>
>Cc: <cygwin@cygwin.com>
>Sent: Sunday, October 13, 2002 4:36 PM
>Subject: Re: Viruses being transported with Cygwin messages
>On Mon, 2002-10-14 at 05:04, Gregg C Levine wrote:
>> Hello from Gregg C Levine
>> Folks, don't roar at me, but I am seeing a number of 
>messages arrive here,
>> infected. One came with a message via Robert Collins, twice,
>
>Can you point me at the message with the virus? And the virus? I email
>from UNIX, so am *very* surprised at this.
>
>
>
>--
>Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
>Bug reporting:         http://cygwin.com/bugs.html
>Documentation:         http://cygwin.com/docs.html
>FAQ:                   http://cygwin.com/faq/
>
>


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/