Re: [APML] Virus with APML subject recieved...

[astropix@att.net]

 Here's the header info from the last one caught by Don, Robert and myself. (so 
far) Can anyone figure out whom among us has this on their machine? I feel safe 
with the layers of protection I'm running, but some here may not fare so well. 
Wish we could figure it out and stop them from continuing :-(

 GP

--
http://home.att.net/~astropix/

_______________________________________________________________________________

Return-Path: <beecherj92882@gbronline.com>
Received: from mtiwgwc15 ([127.0.0.1]) by mtiwgwc15.worldnet.att.net
          (InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with ESMTP
          id <20030702020036.CPGN27731.mtiwgwc15.worldnet.att.net@mtiwgwc15>
          for <astropix@worldnet.att.net>; Wed, 2 Jul 2003 02:00:36 +0000
Received: from mtiwgwc15.worldnet.att.net ([127.0.0.1])
          by mtiwgwc15.worldnet.att.net
          (InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with ESMTP
          id 
<20030702015420.CAZK27731.mtiwgwc15.worldnet.att.net@mtiwgwc15.worldnet.att.net>
          for <astropix@worldnet.att.net>; Wed, 2 Jul 2003 01:54:20 +0000
Received: from sccrmhc13.comcast.net ([204.127.202.64])
          by mtiwgwc15.worldnet.att.net (mtiwgwc15) with ESMTP
          id <2003070201542001500e3qe4e>; Wed, 2 Jul 2003 01:54:20 +0000
Date: Wed, 2 Jul 2003 01:54:16 +0000 (GMT)
X-Comment: Sending client does not conform to RFC822 minimum requirements
X-Comment: Date has been added by Maillennium.
Received: from c1210521-a (12-237-236-5.client.attbi.com[12.237.236.5]
(untrusted sender))
          by comcast.net (sccrmhc13) with SMTP
          id <2003070201540101600k30bhe>; Wed, 2 Jul 2003 01:54:13 +0000
From:  "John Beecher" <beecherj92882@gbronline.com>
Subject:  Don't buy anything from Don Lapre and his crooks
Message-Id: 
<20030702015420.CAZK27731.mtiwgwc15.worldnet.att.net@mtiwgwc15.worldnet.att.net>
Mime-Version: 1.0
Content-Type: multipart/mixed;
 boundary="HUDCGuyY16zFZgj6qvCeJIK6p0cCWXbFC3mY5pjdcfE9q7WOnswAuZp3DUcKylm4"
X-BLTSYMAVREINSERT: OMSLPEkCJT9BJMgrJUpKKl62iT0A

This is a multi-part message in MIME format.
--HUDCGuyY16zFZgj6qvCeJIK6p0cCWXbFC3mY5pjdcfE9q7WOnswAuZp3DUcKylm4
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

This message has been processed by Brightmail(TM) Anti-Virus using
Symantec's Norton AntiVirus Technology.

map.gif.scr was infected with the malicious virus W32.Bugbear.B@mm and has been 
deleted because the file cannot be cleaned.


For more information on anti-virus tips and technology, visit
http://www.brightmail.com/antivirus .
--HUDCGuyY16zFZgj6qvCeJIK6p0cCWXbFC3mY5pjdcfE9q7WOnswAuZp3DUcKylm4
Content-Type: message/rfc822
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Received: from mtiwgwc15.worldnet.att.net ([127.0.0.1])
          by mtiwgwc15.worldnet.att.net
          (InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with ESMTP
          id 
<20030702015420.CAZK27731.mtiwgwc15.worldnet.att.net@mtiwgwc15.worldnet.att.net>
          for <astropix@worldnet.att.net>; Wed, 2 Jul 2003 01:54:20 +0000
Received: from sccrmhc13.comcast.net ([204.127.202.64])
          by mtiwgwc15.worldnet.att.net (mtiwgwc15) with ESMTP
          id <2003070201542001500e3qe4e>; Wed, 2 Jul 2003 01:54:20 +0000
Date: Wed, 2 Jul 2003 01:54:16 +0000 (GMT)
X-Comment: Sending client does not conform to RFC822 minimum requirements
X-Comment: Date has been added by Maillennium.
Received: from c1210521-a (12-237-236-5.client.attbi.com[12.237.236.5]
(untrusted sender))
          by comcast.net (sccrmhc13) with SMTP
          id <2003070201540101600k30bhe>; Wed, 2 Jul 2003 01:54:13 +0000
From:  "John Beecher" <beecherj92882@gbronline.com>
Subject:  Don't buy anything from Don Lapre and his crooks
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------DB7OEY1WQFWACP"
Message-Id: 
<20030702015420.CAZK27731.mtiwgwc15.worldnet.att.net@mtiwgwc15.worldnet.att.net>

------------DB7OEY1WQFWACP
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit



> 
> > Just received another one. Sender: John Beecher
> > Subject: Don't buy anything from Don Larpe and his crooks
> > Norton caught it and the file is map.gif.zlq  Virus name W32Bugbear.b@mm
> >
> > Don SPencer
> 
> Same thing just bounced off my computer.  This makes the third Bugbear virus
> that has hit me today.  As far as I can tell, but I am not 100% positive,
> they seem to be coming through APML.  Either that or something that is
> mimiking mail from APML.  Southwestern Bell seems quite content to push them
> all through to me, but Norton's has been nailing them.
> 
> Robert Reeves                      reeves10@swbell.net
> 520 Rittiman Rd.                   www.robertreeves.com
> San Antonio, Texas 78209    210-828-9036
> USA                                     29.484  98.440  200 meters
> 
> 
> _______________________________________________
> Astro-Photo mailing list
> Astro-Photo@seds.org
> http://seds.org/mailman/listinfo/astro-photo

_______________________________________________
Astro-Photo mailing list
Astro-Photo@seds.org
http://seds.org/mailman/listinfo/astro-photo