IT Employment

Ask something
Discussion Locked

Fun with Novarg

0 helpful
12 replies

by jellimonsta

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We had a small number of users infected with the Novarg virus. Regardless of the precautionary Email I sent out, some users still opted to open attachments to Emails they thought 'may' be valid.
Did anyone else see some effects of this latest outbreak? Anyone still battling the aftermath?

12 replies

by guruofdos

Spotted the alert on the Symantec web-site and read the spiel. Had one infected machine and cleaned it. So far, so good :-)

by jellimonsta

We had 4 systems infected yesterday (all sales users). Not too bad considering the virus definitions did not come out until 1 hr after end of day yesterday.
The updated defs catch the virus now (at least this strain).

by mmbarreca

I find it funny that you cited your sales users as the ones that contracted the virus. It seems that one of the only people get a virus in our office is our sales person. Of course, I've always questioned whether our sales person can read or not anyway. ;-)

by mrafrohead

We started to see it right before it was announced... The ironic part was that I was reading about a different virus as calls started to come in that is JUST like it. I bothered the network guys and told them they may want to get their definitions updated as we were going to have a big problem and phooey... We got it nice... I thought it was funny, that I was telling them that we were getting hit with virus A, and they better get their stuff going, when we were actually gettig hit with virus B, which is damn near the same thing... Wierdness, B turns out is a little worse than A. I wish I woulda been right on that one... ;)

Sent out an e-mail to users notifying them of what was going on, and needless to say, they still open it. I think that as IT people, we should be allowed, by law, to taze people that ignore us... ;p

But we got it contained and eliminated, and now just have to deal with the calls from users. What do I do when I get this e-mail. Well, read the e-mail that we already sent to you. It tells you exactly what to do.

I just don't get it... :)

Mrafrohead

by maecuff

Good idea. My network guy was out sick today, so I had to send the email, give instructions on making sure their virus protection is up to date, sent a link that would virtually update for them and still got 20 emails saying, I got infected email, should I send it to you? How do I know if my virus protection is up to date? How do I update. You know, it's hard to direct them to the email you JUST sent them without sounding like a smart ass. What I want to tell them is this: We just installed Voicemaster Virus Protection, say 'HELLO' loudly and clearly to intialize the system, then say 'PASSWORD' to assign your password. The system will walk you through the rest. I guarantee you, I could get 5 - 8 people to talk to their PC's. I'd get fired...but it'd be funny, eh?

by oz_media

Users that talk to thier PC's, I find it scary though as opposed to funny.

These users argue with themselves, drink some wierd new alcohol named 'Lysol'or something and ferret through the office garbage cans at lunchtime.

I don't even know if they are really employees, perhaps I should ask them for ID one day, they may be spies from another company. I should send them to my last employer, I had a shower in my office and they could get rid of that awful smell!

Users, who needs 'em. We do.

by joseph moore

I saw the alerts from Symantec's site last night at a little past 5PM when I turned my laptop on. I am on vacation this week, and I hadn't been online until then.
On my laptop's Desktop, I keep a small HTML file that points to a .JS script file from Symantec, the "Symantec Security Alerts". It lists the 10 most recent viruses detected, with their severity rating. Needless to say, after my laptop came online, and I saw the category 4 for this new virus, I was concerned.
I called work, and told the one guy who was still in the office that something big was just starting.
I waited until the Symantec antivirus definitions came out, dialed into the office, and updated our NAV server. This was around 7PM.
I then started checking McAfee's FTP site for updates for McAfee Groupshield (runs on a central Domino server we use for mail routing). Their definitions didn't come out until around 11PM Monday night.
By the time I got the McAfee definitions installed on the box with Groupshield, Symantec on the SMTP server had already stripped 300+ copies.
This morning, the Domino box had stopped an additional 150 mails.
Now, the place I work for is not a large corporation; 1000 users worldwide max. So, numbers like these for me are huge. We didn't get this large of a mass of infected mails during the Sobig.F outbreak, nor of the Swen virus either. So, for us, this is a big outbreak. The mail servers kept under the strain, though. My NAV server has ran hot all day, though, with all the blocking on the mail servers and the alerts its been sending out due to the large amounts of mails it's stopping.
But so far, only 2 mails got to user desktops (that were sent before all of the antivirus programs were updated), and their local desktop copies of Symantec caught them then.
So, a multi-layered antivirus approach works again!
I just have hundreds of "virus caught" messages to delete when I go back to work!

by oz_media

A new AntiSpam package I recently added to a client network has caught them all day.

The AV scanner works OUTSIDE the MTA and decrypts reads and analyzes the email before MTA transfer.

Not a one so far, knock on wood.

As for being on holiday, I refuse to even wear my watch while on vacation, yet alone give someone a way to contact me.

by joseph moore

"As for being on holiday, I refuse to even wear my watch while on vacation, yet alone give someone a way to contact me"
That must be a nice trick! Where I go, the cell phone goes. And I brought it upon myself. I was the one who saw the notices on this virus first at my employer, since I was at home, surfing my wirless network.
Then I took it upon myself to call into the office, talk to the one person still there, send e-mail about this, and update my servers personally. I'm all power-hungry like that!
Or is it obsessive?
Not sure which, and I try not to spend any time deciding upon which is correct!

by mrafrohead

"Users, who needs 'em. We do."

Not all of them.. Just the smart ones... :)

The rest are expendable. Targets to flick rubber bands at on down time...

Mrafrohead

by oz_media

I thrive on idiotic users who will open anything over their company's network. Who will click YES without any concernand who constantly add sharware to their PC.

These dummies write my paycheck, I bow to the idiots of the world.

by oz_media

I have a very tight contract with my two main employers. It would be easier for them to fire a union worker for drinkin coffe on his break than to get out of my contract. I also have the fortune of having a pretty high power corporate laywer in the family so I have tools available that would normally cost me tens of thousands.

The people I am contracted to rely on my brothers business (he also is majority share holder of on e of Canada's largest communications and broadcasting companies) each day so they are not in a hurry to replace me or rock the boat so to speak.

If I am on holiday, they WILL get my voice mail and I MAY return the call, but if not, they can wait for me or farm out the problem to some other joint, in which case I still get paid (partially).

Sweet deal, took a year and a half to refine and rerefine a contract and has served me well.

No watch, NO Cellphone, no laptop (OK I do take my laptop everywhere, even camping as it is great to watch DVD's on rainy days, shhhh). It isn't a vacation if people are calling you and bringing you back to reality all day.

OM

This discussion is closed to new replies.