I think bugbear harvests addresses from people's microsoft outlook
products.  So if the infected person is on a list, and the list has the
reply to address as the original sender, outlook may grab that address just
by receiving the email.  Or more likely it will put the address in the
address book if the person ever sends mail to them.  So not necessarily
malevolent.

Edward

At 10/5/02 12:41 AM, you wrote:
>Not with McAfee up to date I hope, but I didn't even need that, I saw the
>attachment and remembered that Bugbear attachment was 50 Kish Bytes and saw
>a strange Re: message with a 50.8 KB attachment
>- but as you say, never say never! I've had Nimda in the past on a server so
>know what its like, 14,567 files affected, took 2 days to clean and was
>never the same until I reformatted the thing and started over again.
>
>I said f*** because this was malevelant, someones collecting addresses from
>syncro.org and probably here as well. Guess they think it fun, sad sods.
>
>I've just had another one today - the BBC news is virtually giving a running
>commentary on the progress of Bugbear, hour by hour!
>Its IS a nasty thing if it gets on your machine without an active and fully
>updated scanner running - the subject line starts Re:  ????????
>
>Clive