tricky Bagel variant

[DVNT1]

Here's what we have recieved by many users today, but I substituted my domain with "TechIMO":

Dear user of "TECHIMO.com" mailing system,

Our main mailing server will be temporary unavaible for next two days, to continue receiving mail in these days you have to configure our free auto-forwarding service.

Pay attention on attached file.

For security reasons attached file is password protected. The password is "81828".

Kind regards,
The TechIMO.com team http://www.TECHIMO.com

Another variant of the same message:

Dear user, the management of Techimo.com mailing system wants to let you know that,

We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions.

Advanced details can be found in attached file.

In order to read the attach you have to use the following password: 01358.

Sincerely,
The Techimo.com team http://www.techimo.com

Notes:
* This came with an attached passworded ZIP file that contained an exe and pif infected with the Bagel virus/worm.
* the From Address was Administrator@TechIMO.com (again, I subst. the actual domain name).

With the passworded ZIP, it will bypass many email gateway scanners and make it to your desktop email client.

[DVNT1]

just added to NAI's site: http://vil.nai.com/vil/content/v_101071.htm

[Bill in SD, CA]

All I can say is: Damn.

Bill

[Detritus]

Same here...
again the company name has been changed to TechIMO

Dear user of "TechIMO" mailing system,

We warn you about some attacks on your e-mail account. Your computer may
contain viruses, in order to keep your computer and e-mail account safe,
please, follow the instructions.

Please, read the attach for further details.

Best wishes,
The TechIMO team

And

Dear user of e-mail server "TechIMO",

Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.

Pay attention on attached file.

Attached file protected with the password for security reasons. Password is 87365.

The Management,
The TechIMO team

[nomaxim]

KSU sent out a mass mailer warning to all accounts today.

Inclueded two sample messages, like above, and informing people that KSU DOES NOT send att. with e-mails.

Wonder if it will do any good?

[Optimus Prime]

Probably not nomaxim, stupidity is a marvelous thing.

[osprey4]

Shouldn't the poor grammar and misspelled words clue you in?

We had someone in my lab get hit Tuesday. It wasn't until yesterday that the system administrator sent out a broadcast message.