It struck Northwestern in the waning hours of Sunday night — moving from computer to computer, spreading with explosive speed. Students and faculty alike found their inboxes logjammed with e-mails bearing a simple message:
“Hi”
The “Bagle” or “Beagle” worm that has been leapfrogging around the world spread across NU’s network over the past three days, infecting at least 100 computers and landing itself in countless e-mail inboxes.
The worm is relatively benign, said Wendy Woodward, director of Technology Support Services for Northwestern University Information Technology. Its primary weapon is annoyance. But there is a possibility that if the attachment is executed, the worm could open a “back door” that could allow outside users to take control of an individual’s computer.
“This is a direct result of folks clicking attachments,” Woodward said. “And we warn folks repeatedly about not clicking on attachments from people they don’t know.”
Bagle reached McCormick freshman John Hanauer at precisely 12:02 a.m. Monday. That was when the first of 15 e-mails with the word “Hi” in the subject line crept its way into his inbox. Inside the message were the word “Test” and the symbol “=)”.
Hanauer was careful not to open the conspicuous attachments enclosed with the e-mails, many of which came from addresses he did not recognize.
He said he belongs to the WNUR-FM (89.3) and Helicon listservs, both of which helped in spreading the worm to his inbox.
“It was being passed around through everyone there,” he said. “Other college campuses were getting it too.” He listed a friend at the University of Virginia and a sister at George Washington University who he said found the worm in their inboxes as well.
Communication sophomore Aimee Lynn Ortiz had a close call after accidentally downloading the worm. Ortiz, the sophomore class chairwoman, runs the listserv for the class of 2006.
“It was blocked from the listserv,” she said, laughing. “I didn’t send it to anyone in the 2006 class.”
When the worm infects an individual’s computer, it scours the computer for any and all e-mail addresses, according to the Symantec Web site. It doesn’t limit itself to a person’s address book, like similar worms in the past.
It masks the address of the sender and shoots out e-mails with Bagle attachments to every address it finds, which explains its relentless speed.
Residential network consultants swiftly responded to Bagle. Many turned dry-erase boards into repair queues where students could ask for help for their infected computers. Others used listservs to spread the word on worm removal.
But even without a res con, Bagle is an easy worm to repair, Woodward said. She prescribed two steps: Run live update in Norton Antivirus — a program all students received upon their arrival at NU — then run the program’s hard drive scanner, which will extract the worm from a user’s computer.
But the best advice is preventative, she said: Update antivirus programs’ virus definitions every week and never download attachments from unknown addresses.
