Jack Campin wrote:
> I just got a copy of the bugbear virus that must have come from someone
> reading this list. It was not routed through scots-l itself. Here are
> the relevant parts of the header and body:
>
>
>>Received: from [80.40.54.94] (helo=aol.com)
>> by mk-smarthost-1.mail.uk.tiscali.com with smtp (Exim 4.10)
>> id 1817xM-0001sX-00
>> for [EMAIL PROTECTED]; Mon, 14 Oct 2002 17:20:37 +0100
>>From: "thelanes" <[EMAIL PROTECTED]>
>>To: [EMAIL PROTECTED]
>>Subject: Re: Re: [scots-l] The Border Gaitherin 2002 - May Weekend Coldstream
>>
> [...]
>
>></html>Content-Type: audio/x-wav;
>> name="HAMSTER.DOC.pif"
>>Content-ID: <EA4DMGBP9p>
>>
>
> The way bugbear works, that DID NOT come from anyone called "thelanes",
> but it *did* come from someone with a Tiscali account who had "thelanes"
> in their address book.
From some which I have seen, the 'from' address is a composite invented
from two randomly chosen addresses in the infected computer's address
book - so there is probably no '[EMAIL PROTECTED]' - I have received
bugbear messages saying I've sent stuff to people, which have my domain
and a someone else's personal identity - example,
'[EMAIL PROTECTED]' was one, and that address does not exist.
All of which makes bugbear 'senders' very hard to pin down and inform of
their problem.
David
Posted to Scots-L - The Traditional Scottish Music & Culture List - To
subscribe/unsubscribe, point your browser to: http://www.tullochgorm.com/lists.html
