Windows Forum

Ask something
Discussion Locked

Virus Problem

0 helpful
14 replies

by wahhab

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
My question is ! I m working in an organization. where i m facing virus attacks of w32.Nimda and Klez . I also have downloaded its removal tools from symantec web sites. But the problem is still prevailing. This virus is coming from emails . when a client open his mail . virus alert appear and the users on clients are not much aware about computer operations. so they run all the files dont quaratine. So problem is going on . Plz give me useful suggestions if you have in this regard. Thnaks.

14 replies

by blackcurrant

Hi

The only way you can really ensure that virus infected emails and their attachments never reach your users is to purchase anti-virus software that will check these files as they are being downloaded. Or you could install a corporate version ofthe software so that every machine is protected. You are fighting a losing battle if you do have such protection in place, and also risk losing your network.

Depending on the number of emails you download each day, you could use a program (e.g. www.MailWasher.net) to preview them before they are downloaded, and delete those you consider a threat.

by khall3

The most simple answer would be to have a little training with your users. You need to tell them not to open attachments from people they don't know. Also show them an example of a suspicious e-mail and what to do if they get one. Users are stupid sometimes and will just click on anything wondering what it will do. You need to train them. Also if you host your email I would recommend putting a stop to e-mails messages containing virus like extension such as .exe, .pif, .scr, etc. and so on. If you don't host your e-mail get a virus software like Norton 7.6 corporate edition and load it onto your PC's and it will check the mail when it comes in. But you need to keep your virus definitions up-to-date.

by reference

Outlook Express 6.0 and Microsoft Outlook 2000 w/sp2 do a pretty good job at not allowing potentially harmful files types from being downloaded. You can also set your users' antivirus software to delete infected files, rather than have them promptedfor an action.
Also keep in mind that both klez and nimda spread throughout a network rather quickly. You may be running the removal tool, but if the appropriate patches are not applied as well, it could just be running back and forth as you go from one machine to the next! Try shutting-down your network, go to each machine, run the removal, apply the appropriate patch(s) from Microsoft, and set Antivirus protection to "delete infected files" rather than "prompt for action"
Hope it helps!

by reference

Just to emphasize one more point, If you don't shutdown the network, and wait till all systems have been cleaned, patched, and/or reconfigured before you bring the network back up, you run the risk of the virus re-infecting the systems that you justworked on. The best way I've found to accomplish this is to turn off all hubs/switches till the task is done.

by pierrejamme

Sorry to say, in this day and time, if you don't block or delete a virus before it gets to the user it's too late. We use McAfee's Webshield (Part of the Active Virus Defense Suite approx $4,000 for 50 users) running on an NT Server that blocks anddeletes all viruses before they go to our e-mail server. We currently are seeing four to eight viruses a day coming in. (Small network 50 users).
Part of the suite is also NetShield which is run on each server in the network (2 NetWare 2 Linux and5 NT/W2K). Tese are set to incoming only so workstations cannot infect the network.
In addition all workstations are automatically upgraded to the latest dats with E-Policy Orchestrator.
Part of the licensing allows users to use the same VirusScan software at home to protect the occasssional users bringing in a floppy! (They wouldn't do that would they?)Training is nice too, but why leave so many doors open. Nimda hit so fast and smartly that four of our users had it beforre it was on the news, that spurred us to go with this suite. If we would have been prepared, there is a good chance we wouldn't have had to format four workstations.
Viruses Trojans and Worms are here to stay and its WAR.

by cluseau1

I have had the same problem. PCCillin is terrific for catching those nasty emails. PCCillin will quarentine the email so you can delete it. works like a charm....

by wlbowers

Install a corporate antivirus software on your
server and client machines. Buy one with the
capilitiby to download updates and distribute
the updates to the client machines.

A good place to start is ca.com, they have
inoculate and etrust. Call them and they will
provide you with a total solution.

Once you have that solution in place clean
every machine. Then set some one down and
feed every floppy in to a machine and scan it
for virus. Also note that any backup tapes will
probibly be infected.

Set the server package to check for updates
every morning and to distribute those updates
to the client machines.

Set the client properties on the scan and
password the settings.

This is what I had to do on a 30 machine
network that had no virus protection. Once
this was in place I got a lot of red alerts on
incoming email but nothing got through.

Good Lucl

Lee

This discussion is closed to new replies.