|
CIAC Advisory Notice
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
________________________________________________________________
THE COMPUTER INCIDENT ADVISORY CAPABILITY
CIAC
ADVISORY NOTICE
________________________________________________________________
The nVIR virus has recently infected significant numbers of Macintosh
systems at several DOE sites. There are different strains of this virus. Each
strain causes somewhat different symptoms such as printing errors on laser
printers, slow system response time, or unpredictable system crashes.
The exact mechanisms by which nVIR spreads have recently been determined.
Removable media (e.g., disks) are the primary means by which nVIR spreads.
Thus, if a disk used in an infected Macintosh is removed and inserted in a
second Macintosh, the other machine will become infected if any application on
that disk is executed in the second machine. In addition, any method used to
transfer programs between Macintoshes will spread the nVIR virus. This
includes transfer via shareware over a network. However, nVIR cannot spread
via a print network's hardware.
nVIR is initially difficult to detect. It spreads quickly and frequently
affects backups before eradication procedures can be initiated.
Disks brought in from off-site are the most common source of nVIR infections.
Unauthorized copies of commercial software brought from off-site or exchanged
within a site also present a substantial risk of nVIR infection. Vendor
demonstration programs are another suspected source of the nVIR virus.
We urge you first of all to review your site's policy on sharing disks and
using and distributing non-licensed software. Another essential damage
prevention measure is to have good anti-viral software available at your site.
CIAC recommends that you test any suspect disk with Disinfectant 1.2, a
freeware package which also eradicates viruses. Virus Detective, a
shareware package, also tests disks to see if they are clean of nVIR and
several other viruses. Although it is tedious to use, Gatekeeper, another
shareware program, will provide several protection mechanisms. It is
important to educate users about the importance of using only software
from trusted sources to reduce the possibility of virus infections. Finally,
CIAC recommends that your site uses dedicated machines for on-site vendor
demonstrations.
For further information or to obtain copies of Disinfectant, Virus Detective
and/or Gatekeeper, contact CIAC at (415) 422-8193 or (FTS) 532-8193. CIAC's
e-mail address is:
[email protected]
|
|
