Security Log File - March 2004

Nachi.B Virus Warning - 03/10/04
The University network experienced a large volume of malicious network traffic beginning at 8:00pm Tuesday, 3/9/04. This attack included a number of off-campus computers in addition to approximately 300 student computers on-campus. Telecommunications staff brought the situation under control by restricting malicious traffic from the Internet, and turning off student Ethernet ports on the UNH campus that were the source of additional unacceptable levels of disruptive traffic. After a thorough investigation, CIS staff determined the Nachi.B worm to be the source of the problem. Help Desk staff are contacting students with information regarding this worm and offering removal assistance.

Additionally, approximately 70 faculty/staff computers are producing similar malicious network traffic which may be due to a Nachi.B infection. We are alerting faculty, staff and students of the situation and ask that you help ensure your machine is protected and patched against potential virus infiltration. We strongly urge any machine not in use be powered off to prevent further disruptive traffic on the network. A Stinger utility (available at http://www.virus.unh.edu) will remove the Nachi.B worm. Maintaining current Windows Updates and McAfee virus definitions will prevent further infections.

CIS is working to eliminate this threat as quickly as possible, and we apologize for any inconvenience that this may cause. If you have any specific questions or concerns, please contact the CIS Help Desk & Dispatch Center at 862-4242.

Virus Warning - 03/03/04
On March 2, a new variant of the "Bagle" virus began aggressively striking the UNH campus. CIS staff are aware of this problem and are working to stem the flow of bad e-mail and contain any infected machines. This virus is particularly annoying because it looks like it's coming from official UNH addresses such as:

		* administration@unh.edu
		* management@unh.edu
		* noreply@unh.edu
		* support@unh.edu
		* staff@unh.edu
	

E-mail infected with the virus contains a zip file attachment. DO NOT OPEN THIS ATTACHMENT!!

The subject line is one of the following:

		* E-mail account disabling warning
		* E-mail account security warning.
		* Email account utilization warning
		* Important notify about your e-mail account
		* Notify about using the e-mail account
		* Notify about your e-mail account utilization
		* Warning about your e-mail account
	

This variant of the virus infects computers running Windows. However, it's likely that the entire USNH community may receive massive quantities of e-mail generated by it. For more information please visit www.virus.unh.edu.