To: UCOP Personnel
From: Patrimpas Prapuolenis, Manager, IR&C Desktop Computing Services
A new e-mail worm, a variant of Bagle, began circulating around 10
a.m. this morning. If you receive an e-mail message with the following
characteristics, do not open the attachment. Delete the message immediately.
If you inadvertently open an attachment, immediately turn off your
computer and contact your PC Coordinator.
Characteristics of the New Worm
--A blank "subject" line.
--A ZIP file attachment with a random name that contains the word
"price" and ends with a ".zip" extension, e.g.,
"newprice.zip," "new__price.zip," "08price.zip,"
etc.
--The attachment is approximately 6KB in size.
Because this worm is so new, antivirus vendors have not yet published
any countermeasures for it. At 11 a.m., IR&C implemented an interim
countermeasure to block infected attachments at the e-mail server.
However, the messages will continue to be delivered--without the attachments--until
the antivirus vendor supplies the tools to counter the worm. At that
point, it is likely we will be able to stop delivering these messages
entirely. Please note that any messages delivered prior to
implementation of this interim countermeasure will contain the infected
attachment.
If you have questions or concerns, please contact Desktop Computing
Services at 987-0457.
