Security

Ask something
Discussion Locked

Panic Protocal

0 helpful
4 replies

by cmooney

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I need to provide users on our network a quick checklist of things to do and not to do, when they think they have a virus. Should they shut off their computer, physically disconnect from the network? I'm not IT trained, just the person who got stuckwith the job. I downloaded several policy guidelines, but they all address what to do before you get a virus. Someone who panics could cause more harm than the virus?!

4 replies

by jack

If you think you have a virus, run a manual virus scan. End of panic protocol.

If the anti-virus software is up to date, trust it to tell you that you have a virus using the "Alert" screen. On Norton AV, you can pop-up a message that says "Virus detected, Call the help desk at x123". I assume other anti-virus tools have similar tools. If users don't see that message, there is some other problem.

Your Help Desk (even if it is just you) should have the tools and knowledge to either fix the problem or escalate. Norton can also forward a copy of the alert to you, since some users may ignore the virus alert. They often do this when they did something improper to get the virus in the first place.

Read the manual on your AV software on how to set up alerts and alert forwarding services.

by davidpmartin

Chris I can feel your pain --- this recently happened in our organization, but because the user didn't panic all the way, we recovered from it.

I immediately sent out the following instructions to everyone in the organization - to include top management!

-----
WHAT TO DO IF YOU THINK YOU HAVE A VIRUS.
1. Notify a designated computer personnel immediately(you must have someone designated even if they are not pro's)
2. Be as descriptive of the problem as possible (it may be a hoax - the computer folks must be able to research it on line).
3. DO NOT DO ANYTHING WITH THE COMPUTER - the computer folks will make the determination what to do

Bottom line for user:
NOTIFY, DESCRIBE, LEAVE ALONE
-- The computer folks (even the part timers) will be the ones to determine if you have a virus (running an virus scan with a updated virus signature will do the trick).
For the computer folks.
1. Isolate the computer from network if you are reasonablly sure its not a hoax
2. Run a scan
3. For detected virus, go to www.symantec.com to find out how to disinfect computer

Follow this protocol and ensure users know what to do, and you will have less panic

by netpronetworks

You metion it in your second section "for computer folks" disconnect the LAN connection immediately as many viruses attack any network shares they can find. The user can do this easily and with no harm to the system until an administrator has a chance to get there.

This discussion is closed to new replies.