>>Today I got an email directly from Keith Mastin with a truncated quote >>from a previous email to the list and an attachment similar to the fake >>Dieter email above. ... > Could you please send me a copy of said email with full headers so I can > see if it actually has anything to do with my system, or is somehow > spoofing my email address?
It is a spoof. The mail headers did not have the owner's real address and route. We're seeing messages from an infected Microsoft machine out there which has SL messages in a mailbox, and the worm is harvesting from that local mailbox to emit its attacks. Several worms use similar techniques, although I suspect this happens to be Bugbear. I'm sure the infected machine has been reported several times to its ISP and in the worst case it will be off the Internet soon. The true worst case would be for it to remain on the net, reporting its owner's passwords, but I expect it won't survive long enough to be a bother to the rest of us. Not that the owner will think being guillotined will be better than the damage worms have done to the machine... ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf ------------------------------------------------------- (un)subscribe: http://lists.sourceforge.net/lists/listinfo/sql-ledger-users Archive: http://www.mail-archive.com/[email protected]/
