Alert: Computer Security Problem Affecting Email

Protect Your Computer
About the Goabot Virus
Other Bulletins

COMPUTER SECURITY BULLETIN
5/10/04
(updated 5/11/04 12:30pm)

*********
ALERT: You may have noticed some problems with email starting Sunday, May 9 and persisting through Monday, May 10. Virus/spam activity on campus adversely affected the college's official mail server. High volumes of sent sent unwittingly from compromised systems caused various mail server problems.

This increased spam activity was created by the programs taking advantage of known security vulnerabilities in the Windows operating system on computers that have not installed the most recent patches issued by Microsoft. We have determined the Goabot virus as a primary source of this problem.

WHAT YOU SHOULD DO:

Many computers on campus are already infected with this virus. Academic Computing sent emails to those with computers believed to be infected or at risk.

However, all Windows XP, NT and 2000 users should follow the instructions below.

1. CRITICAL TO DO FIRST: Open INTERNET EXPLORER and go to http://windowsupdate.microsoft.com/
   (Note: You must use Internet Explorer; Netscape will not work.) Follow the instructions to scan for updates and install all **critical** updates identified (recommended updates and driver updates are not necessary).
2. Update your virus definitions.
   1. From the Start Menu, go to Programs, Network Associates and VirusScan Console.
   2. Highlight AutoUpdate.
   3. Click on the green arrow button on the menu bar.
3. Boot into Safe Mode.
   1. Restart you computer, holding down the F8 key while it reboots.
   2. Select "safe mode" as your boot option. Faculty and Academic Staff should start in "safe mode with network access"
   3. You will know that you are in safe mode because your icons will look bigger, your desktop grainy, and your computer will tell you that it has booted into safe mode.
4. Run a scan in safe mode.
   1. From the Start Menu, go to Programs, Network Associates and VirusScan Console.
   2. Click Scan All Fixed Disks once.
   3. Click on the green arrow button on the menu bar.
5. If you received an email saying you likely have the virus, contact your RCC or helpdesk (610-896-1480) verify that your machine is ok.

For more information see http://www2.haverford.edu/acc/protect/ .

WHAT COMPUTING SERVICES IS DOING:

To prevent large amounts of spam being generated by this attack, we have blocked those computers believed to be at risk or already infected from sending mail through our server. The block only impacts outgoing mail with Eudora, Outlook, or a similar pop-based program. Blocked computers can continue to get email as usual, as well as send mail with webmail.

If you are using a computer that is being blocked, you will receive this error message in the Eudora status bar when trying to send email:

Mail access DENIED. Try WEBMAIL or contact compctr@haverford.edu or telephone 610-896-1480.

QUESTIONS?

If you have further questions about this please contact the Helpdesk at 610-896-1480.