[SOC] Re: Virus Alert

Thu, 24 Oct 2002 18:56:15 -0700

This sounds like the Bugbear virus at work.  It will search email and
address books on an infected computer and pick a username and domain
separately to create the From address.  It also picks subjects at
random.  Don't worry about your password, chances are it wasn't
compromised.  Of course we should all change our passwords regularly
but that wouldn't be second-class, would it?

73, Bob N7XY

On Thu, Oct 24, 2002 at 11:55:24PM +0100, Paul Bartlett wrote:
> Hi Gary/All,
> 
> I'm looking into this right now. As I type, the machine is being virus
> scanned
> using virus data files updated about half an hour ago. (Previous update was
> last Sunday).
> 
> I'm particularly concerned that the offending email comes from:
> 
> "gaz.bradley5*at*fulking.freeserve.co.uk " since anything *at*
> fulking.freeserve.co.uk is me and there's no gaz.bradley here.
> 
> I'll keep you posted....
> 
> *** stop press ***
> 
> The virus scan reported my machine to be clean.
> 
> The implication is that somehow my password for the smtp server at freeserve
> has been compromised. This was changed about 5 minutes ago.
> 
> ** Advice **
> 
> If you receive any mail from anything other than
> paul*at*fulking.freeserve.co.uk
> please delete immediately without reading.  I'd be grateful also if you
> could
> post me a brief note advising me that you've had to do this.
> 
> Sorry for the inconvenience.
> 
> Paul :-(
> 
> p.s.
> 
> Thanks for the quick alert Gary.
> 
> P
> 
> 
> ----- Original Message -----
> From: "Gorsuch, Gary" <[email protected]>
> To: <[email protected]>
> Sent: Thursday, October 24, 2002 10:51 PM
> Subject: FW: Virus Alert
> 
> 
> > You or someone on your email list may be infected.
> > Gary
> >
> > -----Original Message-----
> > From: [email protected] [mailto:[email protected]]
> > Sent: Friday, 25 October 2002 7:51 AM
> > To: [email protected]
> > Subject: Virus Alert
> >
> >
> > The mail message to you from [email protected] (on
> > 10/25/2002 07:51:09) contained the virus 'WORM_BUGBEAR.A' in the file
> > 'Classeur1.xls.exe'.  The virus has been removed.  [Telstra Networking
> > Tasmania MTS]
> >
> 
> _______________________________________________
> SOC mailing list
> [email protected]
> http://mailman.qth.net/mailman/listinfo/soc

-- 
Bob Nielsen, N7XY                          [email protected]
Bainbridge Island, WA  
IOTA NA-065, USI WA-028S 