Follow-up to March 3 Worm Attack

March 4, 2004

To: UCOP Personnel
From: Patrick Collins, Director, IR&C; Information and Communication Services

I would like to provide follow-up information to my March 3 memo, "Faked UCOP E-mail Messages." The spoofed e-mail some of us received contained a new variant of the Beagle worm, which allows unauthorized access to an infected computer. We are now able to identify and cleanse e-mail messages that contain this worm before delivering the mail. Because there often is a time lag between the emergence of new viruses or worms and the availability of tools to counter them, it will be useful for you to know how to recognize suspicious e-mail messages so that you do not open the attachments.

How to Recognize a Suspicious E-mail Message
The characteristics below may indicate a suspicious e-mail message or attachment.

• The subject line and message use bad grammar and have misspellings.
• The subject line has odd symbols and characters in it, or is in upper case.
• The message asks you to update or change your account.
• The message stresses urgency and immediate action.
• The attachment is from someone you do not know.
• The attachment has an uncommon file extension, such as .exe, .scr, or .pif.
• The attachment is described as an important software update or patch. (Note: IR&C; never distributes updates or patches as attachments. We either refer you to a secure internal Web site or coordinate with departmental PC coordinators for distribution.)

When you think you have received a virus-infected attachment, do not open it. Contact your departmental PC coordinator immediately.

IR&C; recommends that, contrary to the earlier advice in the March 3 memo, you should not delete infected attachments because of the risk of opening one by mistake. Your desktop virus protection software eventually will be updated to provide protection from the new virus. Virus protection software updates usually are available within 24 hours of the emergence of a new virus, and IR&C; works with departments to ensure timely installation of these updates. If you have questions, please contact your departmental PC Coordinator, or IR&C; Desktop Computing Services at 987-0457 or TechDesk@ucop.edu.