2/17/2005  Any e-mail message claiming to be from the "Post Office", "Postmaster", "Mail Administrator", "Automatic Email Delivery Software", The Post Office", "Bounced mail", Returned mail", "MAILER-DAEMON", or "Mail Delivery Subsystem" and signed by the bsu.edu support team should be disregarded.  This message is not being sent by the BSU Computer Security Response Team or any other legitimate organization at Ball State.  This message is being generated by the MyDoom.AX worm.  The Mydoom.AX is a mass-mailing worm that uses it own SMTP engine to send e-mail to addresses that it retrieves from the Windows Address Book on the infected computer.

Systems Affected:  Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

To protect your PC from this worm you should be running Symantec virus definitions version 70216x (extended version 2/16/2005 rev. 24) or greater.   If you do not have Symantec AntiVirus already installed on your computer system please visit http://www.bsu.edu/antivirus/.  

The attachment name "DELETED0.TXT" is the generic name our e-mail system provides when it deletes an infected attachment.  The best thing to do is delete the message as soon as you receive it.  The message varies, but basically resembles the following:

Dear user of bsu.edu,

Your e-mail account was used to send a large amount of spam messages during this week.

Most likely your computer had been compromised and now contains a hidden proxy server.

Please follow our instructions in order to keep your computer safe.

Virtually yours,

bsu.edu support team.

All Windows computer users should be performing regular updates by going to http://windowsupdate.microsoft.com/ or by configuring the Windows Update Service to perform automatic updates to your computer.