On Sat, 27 Mar 1999, karen wrote: > Or hoax? > > http://www.msnbc.com/news/253803.asp Definitely a new worm. It hit this university this week. Here is the latest from our IT folks: Subject: E-mail virus/worm spreading rapidly at IU If you receive an e-mail message with the subject: "Important Message From ..." Do NOT open it, and DELETE it immediately. The message contains a Microsoft Word file attachment, which contains a dangerous macro "worm" (similar to a virus). If you open this file, the macro will send multiple copies of the file and worm to many other users, hence causing it to spread extremely rapidly. It will also infect your machine with a version of itself that will be present in any new Microsoft Word documents you create. This is not a hoax. The Indiana University IT Security Office and UITS have determined that the Microsoft Word macro "worm" is loose on the IU-Bloomington and IUPUI campus. This worm is also infecting other sites around the world. See the last section of this message for further technical details. WHAT WE'RE DOING We have reconfigured the main IUB and IUPUI mail relay systems to attempt to detect possible copies of the macro, and to return the message to the sender rather than allowing it be delivered. Although this may be limiting some legitimate mail, it has arrested the propagation outside of the campus Microsoft Exchange systems, which many faculty and staff use as their primary e-mail service. We disabled the Microsoft Exchange system for a period early Friday evening in order to temporarily halt propagation of the worm, and to allow time for a solution to be found to the problem. The Microsoft Exchange system will be returning to service shortly, although it may be necessary to configure it to permit sending messages to only one recipient at a time. We hope to have access to a better solution sometime over the weekend. Symantec (the company responsible for Norton AntiVirus) is working on protection and "disinfectants" for this problem. Once this update is available, we will send out another message to all IU e-mail addresses notifying users of the steps they should take to "disinfect" a machine that has been affected. In the mean time, if you haven't already, you should download and install Norton AntiVirus as soon as possible. It is available from SoftServe, or from IUWare: http://iuware.ucs.indiana.edu/ FURTHER TECHNICAL DETAILS A worm replicates itself by trying to send multiple copies of itself to other recipients, who, in turn, execute the worm and do the same. This particular worm is in the form of a Microsoft Word macro. An unsuspecting user receives a message with an attached Word document that contains the macro. If the user opens the document and allows the macro to execute (either by having disabled this protection in MS Word, or by confirming on a dialog box), the macro will execute and propagate itself. This macro also modifies your default document template to cause all new documents that you write to contain the worm. If you later send someone one of these documents, the recipient could start the propagation again, using your document as the base. HOW TO FIND OUT MORE C/Net's news.com has a story on this virus/worm: http://www.news.com/News/Item/0,4,34334,00.html?st.ne.fd.gif.e Updates specific to the situation at Indiana University will be provided at the following location: http://www.indiana.edu/~itiu/