Virus/worm threat to undergraduate network

Yesterday - 12 May - the undergraduate computer network was compromised by a virus/worm. Please ensure you have the appropriate patch applied to your PC and scan your personal PC and/or USB sticks with anti-virus software

What's happening?

On Tuesday 12 May, the University began to observe intermittent problems on the undergraduate computer network, affecting undergraduate servers and classroom PCs. After the initial investigation it was concluded that the network had been compromised by a virus/worm, specifically the Conficker Worm. Conficker is a complex worm, able to self-replicate via the network or USB disk, hack other PCs, disable automatic updates (both Microsoft and Anti-Virus vendors), block access to popular security websites, encrypt itself and upgrade itself to new variants.

DIT have initiated security updates to all classroom PCs and are executing a removal tool to prevent further spread of the worm, however, this will only protect and disinfect classroom PCs.

At this time we have no evidence or suggestion that the worm has infected/infiltrated any corporate systems or PCs.  However, we recommend that any persons with a USB disk should Virus scan these at the first opportunity.  See below for instructions, however, if you are unable to scan your USB disk either due to lack of equipment or simply need assistance, please contact the DIT Service Desk or drop by the Service Desk at the Edward Wright Building, in Old Aberdeen or the Polwarth Building in Foresterhill

What should you do?

You should ensure that you have the appropriate security patch applied to your PC and you should scan your personal PC (and any USB keys/sticks that you have) with anti-virus software, with up to date signatures.

Windows Vista users can check whether the relevant Security Update has been applied by:

1. Click on the Start Menu and open Control Panel.
2. Double-click Programs and Features.
3. Under Tasks, on the left-hand side of the window, click View Installed Updates.
4. Click in the Search Bar at the top of the window and type KB958644, or copy and paste this into the search bar.
5. If the update is installed, you should see Security Update for Microsoft Windows (KB958644).
6. If your PC does not have the update, then you can download the relevant update here. Follow the instructions on how to apply it from the website.
7. You should now scan your PC (drive C) and any USB disk for viruses. See below for instructions on how to download the University's Virus scanner, if you do not have one.

Windows XP users can check whether the relevant Security Update has been applied by:

1. Click on the Start Menu and open Control Panel.
2. Double-click Add or Remove Programs.
3. Make sure that the option Show updates has been ticked.
4. Scroll down to Windows XP - Software Updates and search for Security Update for Windows XP (KB958644).
5. If your PC does not have the update, then you can download the relevant update here. Follow the instructions on how to apply it from the website.
6. You should now scan your PC (drive C) and any USB disk for viruses.  See below for instructions on how to download the University's Virus scanner, if you do not have one.

University anti-virus software

The University of Aberdeen has chosen Sophos anti-virus software to offer comprehensive virus protection across campus. Sophos can detect malware on your PC or on the network, runs on all current releases of Windows including Vista and can also disinfect infected items. In particular, it can

• check each file you access for viruses
• scan your computer or network for viruses and some other malware
• eliminate viruses
• be automatically updated to detect the latest viruses

Click here to download Sophos onto your personal PC/laptop. Our site licence permits our staff and students to use the product at home. Unless you have some other up-to-date Anti-Virus software installed (eg. Norton AntiVirus, McAfee Virusscan) you are encouraged to make use of this facility to ensure that your personal PC is protected.

Virus scan your USB disk

1. Place your USB disk into a free USB slot. Note the drive letter that your USB disk is assigned eg. E:
2. If prompted to run any automatic program (AutoPlay) click Cancel.
3. Click, Start, All Programs, Sophos, Sophos Anti-Virus. (If you have a Windows Vista PC, then you need to click Continue in the pop-up dialogue box).
4. Click File, New Scan.
5. Type in a name for your scan e.g. USB Drive E.
6. Select Removable Drive E:
7. Click Save & Start.
8. Sophos will now scan the USB drive.
9. If Sophos detects any viruses and is unable to remove it, contact the DIT Service Desk immediately.

Virus scan your hard disk drive

1. Click, Start, All Programs, Sophos, Sophos Anti-Virus. (If you have a Windows Vista PC, then you need to click Continue in the pop-up dialogue box).
2. Click Scan My Computer.
3. Sophos will now scan your computer for viruses.
4. If Sophos detects any viruses and is unable to remove it, contact the DIT Service Desk immediately

As always, should you have any concerns or queries please contact the DIT Service Desk:

Tel: 3636 (externally on: 01224 273636)
Web client: www.abdn.ac.uk/dit/servicedesk/self-service
E-mail: helpdesk@abdn.ac.uk, medit@abdn.ac.uk