Urgent warning

[*Ant*]

Yeh cheers Newt, didn't have a clue what I was doing but think I downloaded the patch.

 

BTW, maybe a silly question, but how do I know if I was infected or not?

[Newt]

What OS Ant?

 

Davy - ME could certainly get the critter but it wouldn't function or cause problems unless one of the new versions has an extra piece to it's package. The structures affected by MSBlast simply don't exist on ME.

[*Ant*]

2000 Pro

[Newt]

Your event logs would have a number of DCOM errors if you had been infected. Probably an RPC failure or two as well.

 

But if you were infected and didn't use a tool to remove the infection, you would probably be down by now and not able to run. Just loading the patch wouldn't have taken care of things after the fact.

[RUDD]

Good old IT dept

Paid stupid amounts of money and didnt see this coming!

The virus hit our servers.

From 12 noon until 5.30pm we couldnt do a thing, would they let me have the afternoon off to go for a fish?

No, we had to sit for 4 1/2 hours in very hot and humid conditions explaining to customers that we cant tell them a thing about a thing!!!!!!!!!

 

SEE EMAIL RECEIVED THIS MORNING :

Dear all,

 

Just to re-iterate Robs note.

 

For all PC and Laptop users please ensure you action the steps detailed in Rob's

note. (Copy below)

 

It is very important that you do this ASAP. The virus will slow your PC/Laptop

down and periodically shutdown your machine. There is also talk that the virus

will start bombarding the Microsoft web site from midnight tonight, if your

machine is infected this may then flood our network with requests being sent to

Microsoft.

 

On a happier note, we are configuring our generator at Chase Road tomorrow. This

will allow the Computer Room and network kit to run in the case of Power Failure

in Park Royal. We have been assured that the work will not effect supply to the

machines, however, there is always a risk. With this in mind the switch over has

been scheduled for Saturday afternoon.

 

Thanks for your understanding yesterday.

 

Paul Duke.

 

-----Original Message-----

From: Rob Nichol [mailto:nicholr@allport.co.uk]

Sent: Thursday, August 14, 2003 6:20 PM

To: outlook@allport.co.uk

Subject: Virus Update

 

 

Afternoon all,

As you are most likely aware, we have been hit with a rather

nasty virus today. We have now managed to get our main systems cleaned but

individual PCs are still at risk. The virus doesn't affect machines running

Windows 95/98 but it is worth updating your virus definitions anyway. (Running

the sdat4285.exe program). Could any PC or Laptop users please follow the

following steps.

 

 

If you follow the link below it will take you into a folder with three icons in

it. There will be one called windows2000.exe (For 2000 operating systems), and

one called WindowsXP.exe (For XP operating systems). If you run the correct

program for your operating system and just keep accepting the defaults until it

finishes. It will ask you to reboot, which you should accept. When the machine

comes back up you should go to the link again and double click on the icon which

says sdat4285.exe and accept the defaults until it finishes. This will install

the latest virus definitions. After this has finished you need to go to: START,

then PROGRAMS, then NETWORK ASSOCIATES, then VIRUSSCAN. This will bring up

another box. There should be a button which says Scan Now on the right. Press

this and the virus scan will start. If the virus is present the scanner will

pick it up and ask what action you wish to take. Select Clean File and it will

get rid of the virus.

 

<file://fileserv1avupdate> fileserv1avupdate

 

Please contact the helpdesk if you have any problems.

 

Thanks,

 

Rob Nichol

ITSupport

[RUDD]

Oh well we are not the only ones :

 

Dear all,

 

We have sent a couple of notes out to all staff to advise of steps to be taken to clean their PC/Laptops. Please can you assist in highlighting the importance to them to action the changes.

 

We have Virus protection in place that is updated daily at 04:00 AM. We checked that this had been updated with protection from this virus yesterday morning, it was, but the virus had already infiltrated. I have been talking to colleagues in the industry and we join the ranks of BMW, Vodafone, SAGA, The Gartner Group, some major banks in being hit. Although we update the virus protection daily there will always be the interim from the virus protection companies releasing the patches and the virus's themselves being released.

 

If there are any members of staff that you think will need help to apply the fix please advise and I'll ensure they are phoned or visited.

 

Thanks to you and your staff for their help and patience yesterday.

 

Paul.

[Newt]

Possible reply to Paul -

 

Dear Paul,

 

Since all the major computer security organizations passed along Microsoft's URGENT warning about the DCOM/RPC weakness and the location of a patch for it in mid-July, could one ask what planet you were visiting at the time?

 

RUDD

[davidP]

My current employers (v.large medical insurance company) got hit with it Thursday afternoon knocking out all sales & customer support. So all Thursday afternoon & Friday everybody has been charging around trying to patch all servers & 2500+ PCs. Friday afternoon a raft of self-congratulatory e-mails appeared praising how well they'd done to limit the effects. They rather spoilt it however by stating they'd known about the problem since 16th July and had been thinking about what to do about it since then. Personally I'd sack whoever hadn't made a decision in 4 weeks thus allowing a known potential problem to become a genuine emergency!

[Riley]

It wasnt in my history, I hadn't downloaded it. But I still couldnt find it to download! It has just popped up as an automatic update! that a bit late too, isnt it, if Microsoft have know about it for so long? Will a standard Norton Virus check pick it up?

[Newt]

Norton will find and block it if you have at least

Defs Version: 50811s

Sequence Number: 24254

Extended Version: 8/11/2003, rev. 19

 

I strongly recommend you (and any others) turn off the Microsoft update alerts and download/install BigFix as it sends the same information - although usually sooner than Microsoft does - and is easier to use for managing updates. The consumer version is free and you can set it for whatever OS you run from 98 and up.

 

Or if you want to leave the M$ update service running, you can compare when the two apps let you know of a patch. I did that for about a month before turning off the M$ service.