info: New Variant of the Beagle Worm - W32.Beagle.K@mm

["Mike Argo" <MikeArgo@its.msstate.edu>]

There has been many reports of the receipt of official looking  emails containing
a zip file as an attachment.  Email characteristics are:
 
The email has the following characteristics:
*------------------------------------------------------------------------
From: (May be one of the following) 

management@<recipient domain> 
administration@<recipient domain> 
staff@<recipient domain> 
noreply@<recipient domain> 
support@<recipient domain>

Subject: (One of the following)
 
E-mail account disabling warning. 
E-mail account security warning. 
Email account utilization warning. 
Important notify about your e-mail account. 
Notify about using the e-mail account. 
Notify about your e-mail account utilization. 
Warning about your e-mail account.

Message: (One of the following lines) 

Dear user of <domain>, 
Dear user of <domain> gateway e-mail server, 
Dear user of e-mail server "<domain>", 
Hello user of <domain> e-mail server, 
Dear user of "<domain>" mailing system, 
Dear user, the management of <domain> mailing system wants to let you know that,

Followed by one of the following paragraphs: 

Your e-mail account has been temporary disabled because of unauthorized access. 
Our main mailing server will be temporary unavaible for next two days,
to continue receiving mail in these days you have to configure our free
auto-forwarding service. 
Your e-mail account will be disabled because of improper using in next
three days, if you are still wishing to use it, please, resign your
account information. 
We warn you about some attacks on your e-mail account. Your computer may
contain viruses, in order to keep your computer and e-mail account safe,
please, follow the instructions. 
Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software. 
Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.

Followed by one of the following lines: 

For more information see the attached file. 
Further details can be obtained from attached file. 
Advanced details can be found in attached file. 
For details see the attach. 
For details see the attached file. 
For further details see the attach. 
Please, read the attach for further details. 
Pay attention on attached file.

Followed by: 

The <domain> team                        http://www.<domain>

Followed by one of the following lines: 

The Management, 
Sincerely, 
Best wishes, 
Have a good day, 
Cheers, 
Kind regards,

If the attachment is a zip file, the message will include one of the following lines: 

For security reasons attached file is password protected. The password is "<password>". 
For security purposes the attached file is password protected. Password is "<password>". 
Attached file protected with the password for security reasons. Password is <password>. 
In order to read the attach you have to use the following password: <password>. 
*---------------------------------------------------------------------------------------------

This is a new variant of the recent Beagle worm.  To learn more go to the URL http://www.symantec.com/avcenter/venc/data/w32.beagle.k@mm.html 
Please delete any such emails received.  These types of worms are just another reason for assuring you have anti-virus software with updated definitions
operational on your desktop.

Thanks!


Mike Argo                                              
Security and Compliance Officer                                                      
Information Technology Services                
Mississippi State University                     
mikeargo@its.msstate.edu
Phone: 662-325-9311
Fax: 662-717-4011