[comp.virus] nVirB infection at teesside poly, uk

XRJDM@SCFVM.BITNET (Joe McMahon) (06/01/89)

>The Apple Macintosh networks at Teesside Polytechnic Main Site Library &
>Flatts Lane Business School Library have been infected ...
>               ... Have used Disinfectant to scan for nVir resources and to
>remove nVir resources, Immunity to insert "fake" nVir=10 resources to
>prevent further infection...

If your users will really use it and not turn it off, try to convince
them that they should be running Vaccine. If you can, try to set up a
"cleanup station" as recommended by the Disinfectant doc. Other than
that, sounds like you've got it well under control. I only make these
suggestions in case someone shows up with Scores, which Immunity WON'T
block.

 --- Joe M.

milne@ICS.UCI.EDU (Alastair Milne) (06/04/89)

Though this is probably old news, I'd recommend adding GateKeeper to
your INITs.  Though it's absolutely transparent for all disc writes
you tell it to allow, it forbids completely any writes it doesn't know
to be authorised.  As soon as I discovered how effective it is, I
removed Vaccine from my system: GateKeeper is much more thorough (as
it checks the writing of *any* resource, not just CODE) and much less
intrusive.

Best of luck with your disinfection.

Alastair Milne

jvb7u@astsun.astro.virginia.edu (Jonathan V. Brinkmann) (06/06/89)

In article <0004.8906051718.AA01402@ubu.CC.Lehigh.EDU> you write:
>As soon as I discovered how effective it is, I
>removed Vaccine from my system: GateKeeper is much more thorough (as
>it checks the writing of *any* resource, not just CODE) and much less
>intrusive.

Where can I obtain a copy of GateKeeper?  It looks like the last word
in anti-Viral software.

=======================================================================
Jon Brinkmann		BITnet:		jvb7u@Virginia.EDU
Astronomy Department 	ARPA/Internet:	jvb7u@astsun1.acc.Virginia.EDU
University of Virginia	UUCP:		...!uunet!virginia!jvb7u
P.O. Box 3818		SPAN/HEPnet:	6654::jvb7u
Charlottesvile, VA  22903-0818
=======================================================================