Information Security

Virus/Worm progress report

by Chris Russel

Information regarding the worm and current status at York

Nachi/Blaster compromises continue to be the main threat for Windows computers on campus. While SoBig infections have significantly decreased, there is still a risk of infection from these as well. Information Security is contacting the owners of known infected machines and will continue to do so as new infections are found.

To reduce the risk of exposure for your computer:

1. Keep your machine patched. In addition to the RPC vulnerabilities, Microsoft has issued recent patches for Internet Explorer, Direct X and MDAC. You may want to consider utilizing the Windows Update feature for automatic downloads of patches. If your computer is managed by departmental IT staff, check with them for the latest patching information.

2. Use anti-virus software on your computer and keep it updated with the latest virus definitions. Norton Anti-virus is available free of charge to students, faculty and staff:

http://www.cns.yorku.ca/computing/apps/nortonantivirus/index.html

If you suspect you may be infected, the following are removal tools for each of the virus/worms:

Welchia/Nachia:
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

Blaster:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Sobig-f:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.removal.tool.html

Contact information
General inquiries:  infosec@yorku.ca
Network and computer abuse reports:  abuse@yorku.ca
Email spam reports: antispam@yorku.ca