ETSUWeb is scheduled to be rebooted on Sunday, 1/15, at 4:00 am. During this reboot, a chkdsk will run, which we estimate will keep web services on this machine down for > 2 hours. The following web services will be unavailable during this outage:

• Antivirus
• Child
• CPIS
• Faculty
• Heart
• Infosys
• Makeadifference
• Orientation
• Photolab
• Studentorgs
• Students
• Uschool
• WWW

We expect the downtime to be confined to our normal scheduled maintenance window, and web services will be available again later Sunday morning.

• The university faculty/staff email server will be upgraded to Exchange 2003. This will provide enhanced security and provide additional features. On-campus users of Outlook will not notice any differences. Users of the web-based email will find that it will now look very similar to Outlook 2003 and will provide many new advanced features previously unavailable to web-based users.
• The Blackboard server will be upgraded with additional disk storage. This will help the server accommodate the increased utilization and improve performance.
• The Systems Support group will be applying operating system patches to the Administrative AlphaServer cluster Sunday morning from 7:00 A.M. until 12:00 noon. Expect each system in the cluster to be unavailable at times during this period.

As part of an on-going effort to improve the campus network, connectivity to the Internet will be interrupted for a few moments on Tuesday, August 5, 2003 at approximately 5:00pm.

This time will be used to help make our Internet connection more fault-tolerant. We apologize for any inconvenience this may cause. If you have any questions or concerns, please notify the OIT Help Desk by phone (9-4648) or by email (oithelp@etsu.edu).

There have been several people who have received emails indicating their email account was about to expire. The message indicates the user should open the attachment to see the details. The attachment contains a virus (W32/Mimail@MM). VirusScan should detect and destroy this virus, but please do not attempt to open the attachment. OIT does not expire email accounts in this manner.

If you’d like more information on this virus, visit the following link:

http://vil.nai.com/vil/content/v_100523.htm

If you have any questions, please contact the OIT Help Desk by phone (9-4648) or by email (oithelp@etsu.edu).

Please use the @etsu.edu when ordering new business cards or stationary and on your email signature. If you have existing business cards, simply strike through the @access.etsu.edu.

If you are still not converted to Exchange or are having any problems with your email, please report the problem to the OIT Help Desk at x94648

The following is the original email:

We would like to remind everyone that every computer on the ETSU network should now be logging into the ETSU domain and no longer using pwrk12. It is very important that you use the ETSU domain consistently especially if you are using Windows 2000 or XP as your operating system. If you login to the old pwrk12 domain, any new documents that you create will be stored in different profile on your machine, making them hard to find. Additionally if you login to pwrk12, you will be unable to send emails through the exchange server.

A possible problem area involves classroom and non-OIT labs that are not logging into the ETSU domain. OIT must convert any Windows 2000 or XP machines, but Windows 95/98 machines can simply change the login domain. If you are unsure about the procedure or the details please contact the OIT help desk.

During spring break, March 17 - 21, we are planning on updating the Internet email reference servers to make @etsu.edu emails go to the Exchange server instead of Access. Anyone who is still using the Access server for their primary email needs to contact the OIT Help desk (x94648 or oithelp@mail.etsu.edu ) to let us know so that we can move your email to the Exchange system. Additionally any department servers or systems that use Access as a mail relay or SMTP gateway needs to contact OIT Technical Services. For the time being Access will stay active and @access.etsu.edu will still go to the Access server, but we do plan to deactivate the Access email server. The exact timetable on the server deactivation will be discussed at the next ITGC meeting on March 11.

Also those still using the Netscape calendar system must be off the old system and converted to the Exchange calendar by March 19. We will be deactivating the old CALServ which runs the Netscape calendar on that day. Again, if you are not converted to Exchange or need help in migrating your Netscape calendar appointments to an Exchange calendar, please contact the OIT Help Desk.

You can find a schedule for Exchange/Outlook training posted at http://ats.etsu.edu/registration.htm

As always, if you have any questions or concerns, please feel free to contact me.

Alan Baldwin
ETSU OIT Technical Director
423.439.8636

Mailing Component
The worm is capable of sending a reply to all new messages found in the user's inbox (Outlook and Outlook Express) by using its own SMTP engine and the server smtp.163.com.

The worm has capabilities of propagating through network shares. It enumerates network shares and copies itself recursively to folders/subfolders The worm drops a trojan component (77,824 bytes) with the following filenames: ILY.DLL, 1.DLL, REG.DLL and TASK.DLL. The backdoor opens port 10168 on the computer and will send an email notification to the hacker that the computer has been compromised. The following addresses are intended as the notification recipients: hacker117@163.com hello_dll@163.com

Information about the infected machine is also sent to the hacker. This information may include the system password. Detection for the backdoor is included in the 4249 DATs as BackDoor-AQJ.

W32/Lovgate@M is a MEDIUM-ON-WATCH mass-mailing worm, that
spreads via network shares, and drops a remote-access trojan.
The worm is also capable of sending a reply to all new
messages found in the user's inbox (Outlook and Outlook
Express). The infected email can come from addresses that
you recognize and may contain the following information:

Subject: [content varies]

Body: [content varies]

Attachment: [It will attach itself to the message
using one of the following names:]

fun.exe, images.exe, news_doc.exe, s3msong.exe,
pics.exe, billgt.exe, midsong.exe, PsPGame.exe,
hamster.exe, setup.exe, tamagotxi.exe, joke.exe,
docs.exe, searchurl.exe, card.exe or pics.exe

Current and up-to-date VirusScan users are protected from
this threat.

Learn More about W32/Lovgate@M:
==> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=4977

Scan for W32/Lovgate@M:
==> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=4978

Alan Baldwin
ETSU OIT Technical Director
423.439.8636
abaldwin@mail.etsu.edu

TNII Security Advisory
Date: 02-04-2003/18:09:00 EST
Subject: Virus Advisory
Audience: TNII Operations Group (OIR, TBR, LLG and UT), TNII Partners
(EDS PMO Personnel and BellSouth)
Severity: Major
EDS SPPS Global Information Assurance Services has received information that US Department of Defense is warning employees to be on the look out for a new email chain letter with a malicious payload. The email contains the subject line: "War with Iraq" or some variation thereof. While GIAS engineers have not seen a public release today in our search, it still may bear watching. Even if you recognize the sender it should not be opened and should be deleted, unless you have specific business requirements for receiving email on the impending conflict with Iraq. Please ensure that all virus software contains the latest Virus Definitions published by the Virus software vender.
Description:
No new Virus or Worm has been specifically identified. However, several Viruses/Worms were released in 2002 related to the possible US action in Iraq; VBS.Melhack@mm is a Visual Basic script worm that spreads by emailing itself to all the contacts in the Windows Address Book.: Also Known As: I-Worm.Melhack [AVP], VBS/VBSWG.at [McAfee], VBS/Kamil.B.Worm [CA]
Type: Worm
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Macintosh, UNIX, Linux
EDS TNII Security Response:
EDS SPPS Global Information Assurance Services engineers are passing this information on to the EDS Malicious Code Team; GSOC Enterprise Services for further research. Additional Technical Information: A Malaysian virus writer who is sympathetic to the cause of the al-Qaeda terrorist group and Iraq and who has been connected to at least five other malicious code outbreaks is threatening to release a mega-virus if the U.S. launches a military attack against Iraq.
The virus writer, is thought to have written or been involved in the development of the VBS.OsamaLaden@mm, Melhack, Kamil, BleBla.J, Nedal, Tanatos and W32/Bugbear. It has been widely reported that he has developed and tested a "three-in-one" megaworm code-named Scezda that combines features from the well-known SirCam, Klez and Nimda worms.

Solomon Masembwa
EDS U.S. Government Solutions
GIAS SPPS "An ISO 9001:2000 Organization"
TNII Project

Like other Internet computer worms in the past year, Sobig has spread less among corporate users and more among home users — many of whom are uneducated about computer security. Network Associates ranked the Sobig virus as a medium threat to both corporate and home users.

The virus can infect all versions of Microsoft's Windows operating system. PC users will likely encounter the Sobig virus first as a PIF (process interchange format) e-mail attachment from big@boss.com. The subject will typically be Re:

ALIAS: Iraq_oil, Datrix, W32.Lioten, W32/Lioten, I-Worm.Lioten

Lioten, also known as Iraq_Oil, is a Windows network worm spreading through shared folders. It was found on December 16th, 2002 in the wild. Lioten does not spread through e-mail at all. Instead, it scans the internet for Windows 2000 and Windows XP machines which have shared folders with other users and are not protected by a firewall. Once a suitable machine is found, the worm guesses a password, logs in to the machine, copies itself over as an EXE file (usually named iraq_oil.exe) and executes it. After this the worm restarts spreading.

There is no further information on what the worm does in addition to spreading. Also the reason for the reference to Iraq is unclear. The worm exploits the Windows Server Message Block (SMB) service at a port 445. Basic firewall techniques prevent access to this port. The worm launches 100 threads each of which starts generating random IP numbers using the system clock to generate a seed value. For every generated IP a connection is made to the port 445.

If the connection is successful, it tries to list the list of users in the machine and tries to guess their password, using passwords from an hardcoded internal list which contains a blank password and the following words:

admin
root
111
123
1234
123456
654321
1
!@#$
asdf
asdfgh
!@#$%
!@#$%^
!@#$%^&
!@#$%^&*
server

These passwords are tried both in plain text and in Unicode. If the file is copied successfully, a remote task is scheduled so that the process will be run on the remote machine. The executable is packed with UPX.

As always if you have any questions or comments please feel free to contact me.

Alan Baldwin
ETSU OIT Technical Director
423.439.8636
abaldwin@mail.etsu.edu