I just got a copy of Bugbear that I believe came from IP 64.228.183.129
which appears to be a Montreal-area dial-up line:
Montreal-ppp42029.qc.sympatico.ca.  Unfortunately gerry.vanagon.com doesn't
seem to do reverse DNS lookups

The message was an excerpt from a Vanagon list message and the infected
attachment was named 4972perronenglish.doc -- so if you have a document
resembling that on your machine (I don't know if Bugbear scrambles the
names at all) it seems likely that you've been infected.  If your virus
scanner is mysteriously not running that's another good clue, as I believe
that Bugbear will attempt to shut down antivirus programs.

david

Norton AntiVirus removed the attachment:     4972perronenglish.doc.zl9.
The attachment was infected with the W32.Bugbear.B.Dam virus.

Received: from tomts5-srv.bellnexxia.net
(tomts5.bellnexxia.net[209.226.175.25])
           by prserv.net (in7) with ESMTP
           id <2003060921590210703pn8ace>; Mon, 9 Jun 2003 21:59:08 +0000
Received: from xxx-w4c9ieommsy ([64.228.183.129])
           by tomts5-srv.bellnexxia.net
           (InterMail vM.5.01.05.32 201-253-122-126-132-20030307) with SMTP
           id
<20030609215834.TWLB23587.tomts5-srv.bellnexxia.net@xxx-w4c9ieommsy>;
           Mon, 9 Jun 2003 17:58:34 -0400

--
David Beierl - Providence RI USA -- http://pws.prserv.net/synergy/Vanagon/
'84 Westy "Dutiful Passage"
'85 GL "Poor Relation"