Security Alert: New e-mail virus, attachments are being blocked (07/19/04)
This afternoon (Mon., 19 July 04) a new e-mail virus has made a widespread appearance on campus. As of July 19, 3:45 p.m., neither Symantec AntiVirus nor the PureMessage anti-virus filters on the CIT mail servers are able to detect or block it.
To protect campus against this threat, we are temporarily blocking delivery of e-mail with attachments that have suspect extensions (.exe, .com, .jpg, etc.). Please see the full list of the attachments being blocked. Once updates addressing this threat have been installed on CIT's mail servers, we will lift this temporary block.
Please note that the block includes ".zip" files, even though these are often legitimate attachments. We need to do this because ".zip" is one of the extensions being used by the virus.
Another message will go out to CIT Alert-L once we have more definitive information about this threat and specific remedies.
What to watch for:
The virus is contained in an e-mail attachment. There is typically no subject line and just a short message of one or two words. There are many variations in both the name of the attachment and the short message body. Do not open the attached files.
As always, please exercise caution when opening e-mail attachments. For more information about e-mail and viruses, see CIT's Warning about e-mail and viruses page.
Full list of attachment types temporarily being blocked:
*.ade
*.adp
*.bas
*.bat
*.chm
*.cla
*.class
*.cmd
*.com
*.cpl
*.crt
*.eml
*.exe
*.hlp
*.hta
*.inf
*.ins
*.jpg
*.jpeg
*.js
*.jse
*.lnk
*.msc
*.msi
*.mst
*.ocx
*.pcd
*.pif
*.reg
*.scr
*.sct
*.shb
*.shs
*.url
*.vb
*.vbs
*.vbe
*.wsf
*.wsh
*.wsc
*.zip
*.???.exe
*.???.lnk
*.???.pif
If you need assistance, please contact the CIT Contact Center (HelpDesk) by calling 255-8990, by sending e-mail to helpdesk@cornell.edu, or by visiting 119 CCC. The Contact Center is open Monday-Friday from 8:00 a.m. to 5:00 p.m., with extended phone hours Monday-Thursday from 5:00 p.m. to 8:00 p.m. during the academic year. If the Contact Center is closed and your problem is urgent, contact the Network Operations Center at 255-9900.
You can receive messages like this via e-mail by subscribing to the CIT-Alert-L mailing list, which is used to distribute announcements about significant disruptions or threats to the campus computing and telecommunications environment. Visit the CIT-Alert-L subscription page
Last modified: June 04, 2007