Robert, It's probably not your system that is infected -- Bugbear, like KLEZ, uses addresses harvested from the infected system in spoofed "From" headers.
The only way I've been able to guess at the real identity for bugbear-infected mail that I've received (from friends/family) is to search through my mailbox for the first Received header's domain, and from that, look for a common association with the name in the "from" line. On a mailing list, that wouldn't work very well. Warm regards, Chris >-----Original Message----- >From: Gregg C Levine [mailto:[EMAIL PROTECTED]] >Sent: Sunday, October 13, 2002 8:38 PM >To: Robert Collins >Cc: [EMAIL PROTECTED] >Subject: Re: Viruses being transported with Cygwin messages > > >Hello from Gregg C Levine >Gladly, if I can find it. It's a message in ugly HTML format, >and it arrived >at my other address. >Gregg C Levine [EMAIL PROTECTED] >"Oh my!" The Second Doctor's nearly favorite phrase. >----- Original Message ----- >From: "Robert Collins" <[EMAIL PROTECTED]> >To: "Gregg C Levine" <[EMAIL PROTECTED]> >Cc: <[EMAIL PROTECTED]> >Sent: Sunday, October 13, 2002 4:36 PM >Subject: Re: Viruses being transported with Cygwin messages >On Mon, 2002-10-14 at 05:04, Gregg C Levine wrote: >> Hello from Gregg C Levine >> Folks, don't roar at me, but I am seeing a number of >messages arrive here, >> infected. One came with a message via Robert Collins, twice, > >Can you point me at the message with the virus? And the virus? I email >from UNIX, so am *very* surprised at this. > > > >-- >Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple >Bug reporting: http://cygwin.com/bugs.html >Documentation: http://cygwin.com/docs.html >FAQ: http://cygwin.com/faq/ > > -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/