W32.Beagle.*

Richard deJongh forwarded me the following notice of the W32.Beagle worm:

This virus will have an attached Zip file that is password-protected, and will have the password for the protected zip file in the body of the message. Do not attempt to open the attachment

Virus Name: WORM_BAGLE.G (and variants)
Message Subject Line: %random%
From: %random%
Message Body: %random%

URGENT ACTION IS REQUIRED:

IF YOU HAVE RECEIVED A SUSPECT MESSAGE:

Do not open the message and delete immediately.
Do not open any password-protected zip attachment with the password from the message body of the email.
If you have already received a message matching this description, even if it is from a trusted source, DELETE IMMEDIATELY and EMPTY THE TRASH! DO NOT OPEN THE MESSAGE OR THE ATTACHMENT.

IF YOU HAVE NOT RECEIVED A SUSPECT MESSAGE:
Be alert, it may be on the way.

The "From:" is spoofed to appear as though its coming from the one of the following addresses at the recipient's domain:

management
administration
staff
noreply
support

and the attachment is supposedly password protected, and the "password" is a five-digit, random number contained in the body of the message.

Previous TCS Virus Alerts:

Tulsa Computer Society

Don Singleton, President
don@donsingleton.com