Update on delayed email delivery

Google has released some information regarding the delayed email deliver that occurred last week.

The problem with Postini Services should be resolved. We apologize for the inconvenience and thank you for your patience and continued support.A copy of the quarantined messages will start to be reprocessed in the next hour. Engineers will start to redeliver messages in small batches. It's then expected that it will take several hours until all messages are reprocessed. Messages unaffected by the original issue and already properly classified as spam will also be reprocessed. A new copy of the affected messages will go through a full regular Postini scan using proper customer configuration settings and filters, as present at the re-delivery time. Reprocessed messages that are still considered as spam will be placed in quarantine again, creating a duplicate entry in the quarantine. The process will not clear out the Postini quarantine of affected message copies; message copies already quarantined will remain quarantined.

Based on this, it appears that in addition to email messages which were intentionally quarantined due to virus or spam, some (many) messages that should not have been quarantined were being incorrectly quarantined.

You can read more about this particular incident at http://www.google.com/appsstatus#hl=en&v=issue&sid=11&iid=f4d40ff81521acea4e58014d7a83ffeb

Although this was the result of what Google considers an error, we still get notifications on a daily basis of virus and spam outbreaks which Google stops from being delivered. These can also cause delayed delivery because Google blocks the offending IP address, and that IP address may be the source of legitimate emails as well. In fact, it's possible that email messages from OSD staff are originating from the offending IP address, due to the globally distributed nature of Gmail's infrastructure.

Action: block '550 mailbox unavailable'
Source: 113.162.75.147
Time: 2014/03/13 10:01:21 GMT

As always, if you have more questions you can contact the IT department.

Email virus outbreaks detected and blocked

There have been a couple of email virus outbreaks detected and blocked. These were NOT in the Oregon domain, but were sent to OSD email addresses from an external sources. Our email security/anti-virus sends a message back to the sender in these cases claiming the destination is unavailable.

Action: block '550 mailbox unavailable'
Source: 217.76.69.114
Time: 2013/02/18 16:27:29 GMT

Action: block '550 mailbox unavailable'

Source: 79.106.15.113
Time: 2013/02/18 16:29:39 GMT

Bogus email

A number of people have received the following message:

------Original Message------
From: Webmail Administrator
To: undisclosed-recipients:;
Subject: Webmail Upgrade
Sent: Apr 29, 2010 2:50 AM

Dear Email User,

We are upgrading our Email system to enable us reduce the occurrence of spam .
You are to clink on the Link below to Upgrade your Email.
[link has been removed so we don't infect anybody]

Signed,
Webmaster Administration

 This is false message and is not from us. You can tell this is a fake easily because the originating email address is not from the district, and the URL it asks you to click is not from the district.

Our content filter identifies the linked site as a virus site. If you clicked on the link, please submit a helpdesk ticket so we can check your computer for virus infections.

What's the most annoying thing of the day? Opachki A

The annoying pest/virus/trojan malware that it driving us nuts has been identified. Not solved, but at least identified. At least we now know what to call it when we curse under our breath: Opachki A.

Update on Conficker C virus and April 1

UPDATE: Thanks to Lon Levy for this article: April Fool's Conficker Threat is Likely Hype. It's true, but just not as dire as reporters would like us to believe. Remember- panic sells papers. Or ads, or electrons, or whatever.

===========
I have received more questions today about the Conficker C virus thanks to a "60 Minutes" piece last night. Unfortunately, the report was more alarmist than informative.

Here are a couple facts:

• It affects only Windows computers.
  
• It probably won't activate on April 1, because everybody is expecting it.
  
• An infected computer is already receiving instructions from the P2P botnet, so it probably won't drastically change on April 1.
  
• There is now a way to detect infected computers. 

Read more at http://blogs.zdnet.com/security/?p=3043&tag=nl.e539

The practical steps you can take:

1. If you must use Windows, make sure you have automatic updates turned on, and that they are installed. 
2. Use virus protection and make sure it's up-to-date.
3. Turn off your computer when you aren't using it. If it's not on, it can't be infected. Or infect others.  Plus, it will save electricity.

Conficker C virus warning

Our friends at UW-Madison pass along this warning about a particularly powerful and complex virus. We (IT) are looking into our district computers, but owners of Windows computers at home should check for infection as well. It is estimated to have infected millions of computers.

OCIS is aware of increased media coverage of a specific instance of malware, Conficker C, that may have infected many vulnerable Microsoft operating systems.  This malware may have logic set to activate (on already compromised machines) on April 1, 2009. Currently, the full details of what may happen on this date are not known.  However, IT staff should be alert for possible issues.  In addition, IT staff may consider verifying that Windows machines under their control (do not forget virtual ones) have been recently updated as information suggests infected machines may turn off automatic Windows updates. 

More information can be found at the following sites:
In plain English:

http://www.cnn.com/2009/TECH/03/24/conficker.computer.worm/index.html?eref=r

For the technically minded:
http://mtc.sri.com/Conficker/addendumC/

2008-12-18 Viruses in email, and IE security risks

Every holiday brings a new rash of viruses because people are more careless during the holidays. Three have hit us today- attachments to email messages claiming to be a Hallmark e-card for you, or a coupon for McDonald's, or a coupon for Coca-cola.

These are all meant to trick you into opening the attachment, which you should never do. 

Virus and spyware threat: "Statement of fees"

Some users have received an email message with a zip file attached. The subject is "statement of fees." Please do not open the file or forward to us. Just DELETE immediately. Here's a screen shot of the mail received:

 

 

Some indications that this is an attack:

• the return address is from a foreign domain (bradteal.com.au)
• wording is pretty vague and generalized, but implies some time-sensitive pressure "this will be posted today"
• you have no idea who "Cherry Sylvester" is

Be extra cautious of viruses and spyware during MAP testing

MAP testing will occur September 15 - October 6 in all buildings except OHS. During this time, due to the design of the MAP test applicaiton, virus protection must be turned off on desktops and servers that are used for MAP testing. Please be extra cautious about opening any email attachments that you are not expecting during this time, and report any suspicious or unusual computer behavior immediately.

If you have been infected with a virus

Anyone who has been affected by the malware that is circulating via email please read on. 

 

If you have been affected on a school computer please submit a helpdesk ticket asap.

http://helpdesk.oregonsd.org/

 

If you have been affected on a home computer don't fret; we have found a program that will remove it quite efficiently. 

 

This is the link to download this program: 

http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

 

To remove the malware

1 download and install the program

2 update when it asks if you want to update

3 run a full scan and delete all infected files that it finds.

 

Here is a more in-depth description of those directions if needed:

http://www.bleepingcomputer.com/malware-removal/remove-antivirus-xp-2008