Re: [Security] ZIP file attachments temporarily blocked on CalMail

Here's the info. Very nasty little thing that'll infect a lot of students.

http://vil.nai.com/vil/content/v_101071.htm

[Sample Message Bodyies]
# Your e-mail account has been temporary disabled because of unauthorized
access.
# Our main mailing server will be temporary unavaible for next two days,
to continue receiving mail in these days you have to configure our free
auto-forwarding service.
# Your e-mail account will be disabled because of improper using in next
three days, if you are still wishing to use it, please, resign your
account information.
# We warn you about some attacks on your e-mail account. Your computer may
contain viruses, in order to keep your computer and e-mail account safe,
please, follow the instructions.
# Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.
# Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by a
proxy-relay trojan server. In order to keep your computer safe, follow the
instructions.

~---------------------------------~
           Allen Chang
 Lead Network Security Coordinator
  Office of Residential Computing
           UC Berkeley
~---------------------------------~

On Tue, 2 Mar 2004, Aron Roberts wrote:

> Messages containing ZIP file attachments will soon be blocked on
> the CalMail email system, at least temporarily.
>
> From what I understand, messages with virus-containing attachments
> purporting to come from "The Berkeley.edu Team" and support@socrates,
> and using various techniques of social engineering -- such as telling
> users that important instructions are included in these attachments,
> or warning users that their accounts will be deactivated unless they
> open these attachments -- have started appearing.
>
> This situation is being investigated, and as an interim protective
> measure, messages containing ZIP files will temporarily be blocked.
>
> Aron Roberts
> Workstation Software Support Group
> (for the CalMail team)
> -------------------------------------
> Sent via the ucb-security mailing list.
>

------------------------------------------------------------------------
The following was automatically added to this message by the list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.berkeley.edu/>.
Received on Tue Mar 2 16:11:51 2004