|   | CIAC Advisory NoticeNOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
 
 ________________________________________________________________
 THE COMPUTER INCIDENT ADVISORY CAPABILITY
 
 CIAC
 
 ADVISORY    NOTICE
 ________________________________________________________________
 
 The nVIR virus has recently infected significant numbers of Macintosh
 systems at several DOE sites. There are different strains of this virus.  Each
 strain causes somewhat different symptoms such as printing errors on laser
 printers, slow system response time, or unpredictable system crashes.
 
 The exact mechanisms by which nVIR spreads have recently been determined.
 Removable media (e.g., disks) are the primary means by which nVIR spreads.
 Thus, if a disk used in an infected Macintosh is removed and inserted in a
 second Macintosh, the other machine will become infected if any application on
 that disk is executed in the second machine.  In addition, any method used to
 transfer programs between Macintoshes will spread the nVIR virus.  This
 includes transfer via shareware over a network.  However, nVIR cannot spread
 via a print network's hardware.
 
 nVIR is initially difficult to detect.  It spreads quickly and frequently
 affects backups before eradication procedures can be initiated.
 
 Disks brought in from off-site are the most common source of nVIR infections.
 Unauthorized copies of commercial software brought from off-site or exchanged
 within a site also present a substantial risk of nVIR infection.  Vendor
 demonstration programs are another suspected source of the nVIR virus.
 
 We urge you first of all to review your site's policy on sharing disks and
 using and distributing non-licensed software.  Another essential damage
 prevention measure is to have good anti-viral software available at your site.
 CIAC recommends that you test any suspect disk with Disinfectant 1.2, a
 freeware package which also eradicates viruses.  Virus Detective, a
 shareware package, also tests disks to see if they are clean of nVIR and
 several other viruses.  Although it is tedious to use, Gatekeeper, another
 shareware program, will provide several protection mechanisms.  It is
 important to educate users about the importance of using only software
 from trusted sources to reduce the possibility of virus infections.  Finally,
 CIAC recommends that your site uses dedicated machines for on-site vendor
 demonstrations.
 
 For further information or to obtain copies of Disinfectant, Virus Detective
 and/or Gatekeeper, contact CIAC at (415) 422-8193 or (FTS) 532-8193.  CIAC's
 e-mail address is:
 
 [email protected]
 
 |   |