Re: suspicious email

Hi Bill,

At 11:29 -0700 2004-07-26, International & Area Studies Computer Support wrote:
>Hello
>I got 2 emails today, one with a text.scr file, the other with a
>mail.zip file...
>
>"From: "Automatic Email Delivery Software" <MAILER-DAEMON@uclink.berkeley.edu>
>Subject: Mail System Error - Returned Mail
>
>Dear user of uclink.berkeley.edu,
>We have detected that your account has been used to send a large
>amount of unsolicited commercial email during this week.
>Probably, your computer was compromised and now runs a trojan proxy server.
>We recommend that you follow instructions in order to keep your computer safe.
>Virtually yours,
>uclink.berkeley.edu user support team."
>
>This is just a heads up.
>Bill Gross

   This mail was likely generated by the variant of the MyDoom worm
that email system admins on campus have been seeing today (below).
One description:

<http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom.m@mm.html>

At 10:43 -0700 2004-07-26, Graham A. Patterson wrote:
>We are seeing the first MyDoom.M messages this morning. Symantec
>only issued an update on this today.

At 11:52 -0700 2004-07-26, Bernie Tower wrote:
>Just in case you weren't already painfully aware, a new strain of
>the MyDoom hit the campus. We do have updated signatures for it and
>are filtering, however a few did manage to sneak through. The
>message states that the user's computer is infected and to click on
>the attachment. Because of the big worm scare last week, we are
>worried that some users may consider this an official message and
>click. PLEASE spread the word and not allow them to do that!!

Aron Roberts
Workstation Software Support Group

------------------------------------------------------------------------
The following was automatically added to this message by the list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.berkeley.edu/>.
Received on Mon Jul 26 12:33:00 2004