>"Received: from [80.40.54.48] (helo=aol.com)
> by mk-smarthost-1.mail.uk.tiscali.com with smtp (Exim 4.10)
> id 181b7z-00046Y-00
> for [EMAIL PROTECTED]; Wed, 16 Oct 2002 00:29:33 +0100
>From: "thelanes" <[EMAIL PROTECTED]>
>To: [EMAIL PROTECTED]
>Subject: Re: [scots-l] Border Gaitherin - Coldstream 2002 - May 4-6th
>The Lanes - Janice and Phil, who I met on their visit to Scottish Borders
>in 2000 and the first Coldstream Gaitherin in May 2001, would be alarmed
>to think they have anything to do with the problem. I think this means
>that their PC must have the virus.
They do NOT. Bugbear assembles a fake sender address by randomly
combining a userid and sitename from the infected person's address
book.
The unfakeable information in that header is the sequence of Received:
lines (well, some of them can be faked, but in this case it looks like
you got something almost identical to my copy, where they were all for
real).
This all says the infected person:
(1) has a Tiscali account
(2) subscribes to scots-l
(3) knows the Lanes
(4) also knows somebody with an account on lineone.net (so does
everybody online in the UK, I should think; not very helpful)
(5) runs Outlook Express on Windows.
That lot should certainly pin down who it is.
Now I think about it, I *do* remember seeing somebody here post from
Tiscali, but can't remember who. Somebody with a more complete archive
than me care to do a search and warn them?
I have already emailed Tiscali's sysadmins, but from a company that
started out doing Usenet spamming themselves even before they started
their ISP business, you can't seriously expect them to do anything
about it.
=================== <http://www.purr.demon.co.uk/jack/> ===================
Posted to Scots-L - The Traditional Scottish Music & Culture List - To
subscribe/unsubscribe, point your browser to: http://www.tullochgorm.com/lists.html
