Seems like the Bugbear virus takes the first part of the sender from one
place and the second part from another. I've never even heard of
teacher.com! My guess is that it doesn't do anything to the time
information, hence we can expect your actual sender to be somewhere in
eastern Brazil or Greenland (maybe it doesn't alter the message-id, and
that silva5.uol.com.br is somehow involved?), probably someone subscribing
to the ibobjects list receiving individual emails. It could fit with that I
myself received a message with the subject "Re: [IB-BR] Inc Search com
IBO", which probably contained this Bugbear as an attachment (seems like
Norton changes it into a text file with gibberish and I found two like this
this morning and Norton cleansed messages to 13 people at my workplace this
morning).

So I am not trying to contaminate you, and doubt I'm involved in any
spreading of this virus,
Set
(I'm sending a copy to ibobjects@yahoogroups.com, since someone on this
list may be infected without knowing)

At 02:47 05.10.2002 +1000, you wrote:

>Svein,
>Look what just arrived in my mailbox with the Bugbear virus attached!!
>(verbose header included...) -- Helen
>
>X-From_: svein.erling.tysvaer@... Sat Oct 5 01:54:03 2002
>Received: from silva5.uol.com.br (silva5.uol.com.br [200.221.4.52])
>by mail1.tpgi.com.au (8.11.6/8.11.6) with ESMTP id g94Fs1t08894
>for <helebor@...>; Sat, 5 Oct 2002 01:54:01 +1000
>Received: from siemp3 ([200.191.0.133])
>by silva5.uol.com.br (8.9.1/8.9.1) with SMTP id MAA20351;
>Fri, 4 Oct 2002 12:41:42 -0300 (EST)
>Date: Fri, 4 Oct 2002 12:41:42 -0300 (EST)
>Message-Id: <200210041541.MAA20351@...>
>From: Svein Erling Tysvaer <svein.erling.tysvaer@...>
>Subject: Re: [IBO] "Statement has not been prepared"