Computer Security Bulletin

Protect Your Computer
NAI Info About W32/Bagle

March 3, 2004

(Check this web page for updated information about W32/Bagle viruses on campus.)

There is a new virus arriving via email that looks like a message sent from the Computing Center. (See samples below). These messages are not authentic. Instead, they spread a variation of the W32/Bagle virus. If you get a message similar to the samples below, DO NOT follow the included instructions.

DO NOT OPEN attachments that you receive via email unless you were expecting an attachment from that sender. If you are unsure if an attachment is legitimate, contact the sender. For more information about this topic or to learn how to best protect your computer see http://www2.haverford.edu/acc/protect/

If you have a Windows computer and you already opened an attachment similar to the samples below, your computer may be infected. Make sure your VirusScan antivirus has at least the 4332 NAI virus definitions, and then scan your drive. Your virus software should detect and remove the virus.

If you have a Macintosh computer running any version of the Macintosh operating system, your system cannot become infected with this virus.

If you have further questions about this, or any Computing Center bulletin, please contact the Helpdesk at 610-896-1480, your computing liaison (faculty/academic staff) or your RCC (students).

Sample threats arriving on campus via email.
These messages are not authentic. Please delete and do not follow the included instructions.

Hello user of Haverford.edu e-mail server,

Some of our clients complained about the spam (negative e-mail content) outgoing from your e-mail account. Probably, you have been infected by a proxy-relay trojan server. In order to keep your computer safe, follow the instructions.

For details see the attach.

Attached file protected with the password for security reasons. Password is 26243.

Best wishes,
The Haverford.edu team http://www.haverford.edu

---

Dear user, the management of Haverford.edu mailing system wants to let you know that,

Your e-mail account will be disabled because of improper using in next three days, if you are still wishing to use it, please, resign your account information.

Advanced details can be found in attached file.

For security purposes the attached file is password protected. Password is "26243".

Sincerely,
The Haverford.edu team http://www.haverford.edu