Re: Subject: [ST] Virus Alerts

["Mike Bostock" <sprint-st@xxxxxxxxxxxxxx>]

In your message regarding Re: Subject: [ST] Virus Alerts dated Wed, 9
Oct 2002 10:58:37 -0500 , Anderson, Neil G (CPR) said that ...

>ANG(-  Mike Bostock wrote:
>  
> >See my email just sent - Bugbear spoofs the From: address.  The attachment
> >would not be passed on by Eric's list-server - it is set to strip all
> >attachments and HTML
>ANG(-  
>ANG(-  The message with the virus attachment actually came from
>ANG(-  owner-st-digest@xxxxxxxxxx, not our beloved digest address of
>ANG(-  owner-st-digest@xxxxxxxxxxx  No idea how it created that address, but I've
>ANG(-  seen a few messages from various sources with the virus attached, so y'all
>ANG(-  be careful out there!

Bugbear uses the front part (ie the bit before the @) from one
address and the last part from another on the victim's PC to
formulate the From: address and then sends its payload to all the
email addresses it can find on the victim's machine!

- -- 
Mike Bostock
mike@xxxxxxxxxxxxxx
http://www.toothfairy.co.uk/
Wales and SW ST Riders
http://www.sprint-st.org/

'99 Red ST

     *   *   *   *   *   *   *   *   *   *   *   *   *   *   *   *   *   *   *
      The ST/RS Mailing list is sponsored by Jack Lilley Ltd.
          http://www.TriumphNet.com/st/lilley for more info
   http://www.TriumphNet.com/st for ST, RS and Mailing List info

=-=-=-= Next Message =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=