We also see this ramping up. _M | -----Original Message----- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of | ISPhuset Visual Web Norge | Sent: Tuesday, October 01, 2002 11:39 AM | To: [EMAIL PROTECTED] | Subject: RE: Re: [Declude.Virus] Bugbear forged? | | | Same her we have caught about 500 of it today so far | | Benny | | > -----Original Message----- | > From: [EMAIL PROTECTED] | > [mailto:[EMAIL PROTECTED]]On Behalf Of Ken Lizotte | > Sent: 1. oktober 2002 17:22 | > To: [EMAIL PROTECTED] | > Subject: DSN:Re: [Declude.Virus] Bugbear forged? | > | > | > Hello All, | > | > Just to give you some update. Thanks for your comments | Scott. We did | > not see any Bugbear yesterday or last night, but starting | this morning | > Declude and F-Prot have stopped over 12 copies and they are now | > appearing about every 10 to 15 minutes. | > | > Looking at what the payload does, I'm just glad this virus | did not get | > into our customer base. | > | > Thanks for the GREAT Product. | > Ken | > ----- Original Message ----- | > From: "R. Scott Perry" <[EMAIL PROTECTED]> | > To: <[EMAIL PROTECTED]> | > Sent: Tuesday, October 01, 2002 10:49 AM | > Subject: Re: [Declude.Virus] Bugbear forged? | > | > | > > | > > >I've seen here only a few messages infected by Bugbear. Are this | > > >worm forging the sender's emailadress? Some | virus-warnings returns | > > >with a NDR, other seems to be delivered succesfully... | > > | > > It seems that it isn't known yet whether or not it forges | the return | > address. | > > | > > We haven't seen a single copy here yet, so I'm guessing | this one was | > > hyped a bit more than it should have been. It also | appears to use | > > the Outlook MIME Headers vulnerability, so it would get caught | > > automatically with any mailserver AV program that detects the | > > vulnerabilities (such as Declude | > > Virus) as well as a number of content scanners. | > > -Scott | > > | > > --- | > > [This E-mail was scanned for viruses by Declude Virus | > (http://www.declude.com)] | > > | > > --- | > > This E-mail came from the Declude.Virus mailing list. To | > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and | > > type "unsubscribe Declude.Virus". The archives can be found | > > at http://www.mail-archive.com. | > > | > > | > | > --- | > [This E-mail was scanned for viruses by Declude Virus | > (http://www.declude.com)] | > | > --- | > This E-mail came from the Declude.Virus mailing list. To | unsubscribe, | > just send an E-mail to [EMAIL PROTECTED], and | > type "unsubscribe Declude.Virus". The archives can be found | > at http://www.mail-archive.com. | > | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
