LINGUIST List 13.2590

Wed Oct 9 2002

All: Virus Warning

Editor for this issue: Anthony Rodrigues Aristar <aristarlinguistlist.org>

Directory

1. linguist, Virus Warning

Dear Subscribers:

We would like to warn you that there is a new (and dangerous) virus
now out there that may affect you. This virus, called
W32/BugbearMM, propagates itself by mimicking valid messages from
valid addresses. 

One of the things this worm does is to construct valid-seeming
mail-addresses from the mail-messages it finds on the machine it has
infected. For example, if it finds a message from the LINGUIST list
and one from aaahotmail.com, it may send out a message which
seems to come from linguisthotmail.com, which is constructed from
both addresses. It may also send out messages that appear to come
from both of the valid addresses as well.

What this means is that when the message arrives it can look very
similar to a valid mail message, similar enough so that the
differences can escape a quick glance. 

There is a very easy way to tell the difference, however. LINGUIST
list *never* sends out any messages with attachments. If you receive a
message that seems to be from LINGUIST and contains an attachment,
delete it. It cannot be from us.

Most important: be wary of any messages with attachments, even if they
seem to come from a close friend.

For more information on this worm, go to the following site:

http://securityresponse.symantec.com/avcenter/venc/data/w32.bugbearmm.html

Our regards, and regrets

LINGUIST