Same her we have caught about 500 of it today so far Benny
> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Ken Lizotte > Sent: 1. oktober 2002 17:22 > To: [EMAIL PROTECTED] > Subject: DSN:Re: [Declude.Virus] Bugbear forged? > > > Hello All, > > Just to give you some update. Thanks for your comments Scott. We did not see > any Bugbear yesterday or last night, but starting this morning Declude and > F-Prot have stopped over 12 copies and they are now appearing about every 10 > to 15 minutes. > > Looking at what the payload does, I'm just glad this virus did not get into > our customer base. > > Thanks for the GREAT Product. > Ken > ----- Original Message ----- > From: "R. Scott Perry" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Tuesday, October 01, 2002 10:49 AM > Subject: Re: [Declude.Virus] Bugbear forged? > > > > > > >I've seen here only a few messages infected by Bugbear. Are this worm > > >forging the sender's emailadress? > > >Some virus-warnings returns with a NDR, other seems to be delivered > > >succesfully... > > > > It seems that it isn't known yet whether or not it forges the return > address. > > > > We haven't seen a single copy here yet, so I'm guessing this one was hyped > > a bit more than it should have been. It also appears to use the Outlook > > MIME Headers vulnerability, so it would get caught automatically with any > > mailserver AV program that detects the vulnerabilities (such as Declude > > Virus) as well as a number of content scanners. > > -Scott > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
