VIRUS ALERT: New e-mail virus on campus (04/27/04)

*** PLEASE exercise extreme caution in opening e-mail attachments ***

A new e-mail-based virus that infects Windows systems has been detected at Cornell. At this time (1:30 p.m. on Wednesday), neither the PureMessage/Sophos anti-virus filters on the central e-mail systems nor Symantec AntiVirus for Windows are catching this virus.

News flash 2:00 p.m.: An update to the PureMessage filters on the central mail servers for W32.Beagle.X@mm has arrived, and the worm is now being successfully blocked. A number of people around campus noted copies arriving earlier today.

Symantec AntiVirus for Windows also detects this worm if your virus definitions are updated to version 4/28/2004 rev.23 or later.

This virus can appear with a variety of subject lines and attachment names. In some cases, the attachment may be a password-protected file.

A preliminary description of the virus can be found on TrendMicro's Worm_Bagle.Z page.

For updated information from Symantec, see Symantec's W32.Beagle.X@mm page.

As is typical with these viruses, you may have received infected messages that appear to be from people you know at Cornell. That does not necessarily mean the sender's computer is infected. This virus, like many others, mails itself to any e-mail address it finds.

For more information about e-mail and viruses, see CIT's Warning about e-mail and viruses page.

---

If you need help removing a virus, please contact the CIT Contact Center (HelpDesk) by calling 255-8990, by sending e-mail to helpdesk@cornell.edu, or by visiting 119 CCC. The Contact Center is open Monday-Friday from 8:00 a.m. to 5:00 p.m., with extended phone hours Monday-Thursday from 5:00 p.m. to 8:00 p.m. during the academic year. If the Contact Center is closed and your problem is urgent, contact the Network Operations Center at 255-9900.

Last modified: June 04, 2007