Return-Path: <linux-kernel-owner+willy=40w.ods.org@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id <S261295AbSJHRqt>; Tue, 8 Oct 2002 13:46:49 -0400
Received: (majordomo@vger.kernel.org) by vger.kernel.org
	id <S261298AbSJHRqt>; Tue, 8 Oct 2002 13:46:49 -0400
Received: from mailsorter.ma.tmpw.net ([63.112.169.25]:21537 "EHLO
	mailsorter.ma.tmpw.net") by vger.kernel.org with ESMTP
	id <S261295AbSJHRqt>; Tue, 8 Oct 2002 13:46:49 -0400
Message-ID: <61DB42B180EAB34E9D28346C11535A780112FE40@nocmail101.ma.tmpw.net>
From: "Holzrichter, Bruce" <bruce.holzrichter@monster.com>
To: "'linuxguruguy'" <linuxguruguy@aaahawk.com>, linux-kernel@vger.kernel.org
Subject: RE: email I received
Date: Tue, 8 Oct 2002 12:52:15 -0500 
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: linux-kernel-owner@vger.kernel.org
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 1246
Lines: 35


> 
> I recently got an email from some one with a windows binary file
> attached it seems to have come from linux-kernel-owner@vger.kernel.org
> below is the email (minus the attachment)if anyone could help with
> determining who did this behavior it would be greatly appreciated

This would be the BugBear Virus you received.  BugBear is running rampant,
so you'll likely see more from your windows friends.

Check for details on:
http://www.cert.org/current/current_activity.html#W32BugBear

You can rest assured, I bet everyone on the list got it as a consequence of
it being sent to a list address, probably someone has linux-kernel in their
address book, on their windows machine.

Check the e-mail header you posted, and the following IP.  That is the
original sender. 

>Received: from [217.81.46.31] (helo=meinserver) by
>mrvdomng.kundenserver.de
>	with smtp (Exim 3.35 #1) id 17ygKv-0004kj-00; Tue, 08 Oct 2002
00:26:49
>	+0200
>

Name:    pD9512E1F.dip.t-dialin.net
Address:  217.81.46.31
 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/