digital.forest Technical Support
New worm forging forest.net (and other) return addresses

A new, particularly annoying virus is going around the net today. Called W32.Beagle.K@mm, it is distributed via email and masquerades as a security warning from a site administrator. The version you may receive that appears to be from digital.forest looks like this:

From: administration@forest.net
Date: March 3, 2004 8:20:26 AM PST
To: info@forest.net
Subject: Email account utilization warning.

Hello user of Forest.net e-mail server,

Our  antivirus software has detected a large ammount of  viruses  outgoing 
from your  email  account,  you may use  our  free  anti-virus tool  to clean up
your computer  software.

For further  details  see the attach.

For security reasons attached file  is password  protected. The password is  "57242".

The Management,
     The  Forest.net team                                http://www.forest.net

There will be an attachment. Opening the attachment on an affected system (including most versions of Microsoft Windows) will result in a "back door" security hole being opened on the system, and the virus will then attempt to propagate itself from that system.

Further information on this virus can be found here. Once again, this mail did not come from digital.forest; the virus is simply spoofing official-looking return addresses in our domain, as well as many others.

posted by Bill D. at 11:34 AM on Wednesday, March 3, 2004
Categories: Worms and Virii