Current worm or virus attack

To search this document press { Ctrl}+{ f} or from the menu bar select E dit, then F ind (on this page)....

Current Worm / Virus

Enterprise ticket in NorthStar web, Ticket current as of 10/29/2004 for Beagle is 167155.

What do I need to do?

Check that your virus definition is current, update if necessary, then scan. :

Check your virus definitions: Your virus definitions should be dated October 29 rev. 37 or later. Virus definitions are updated weekly. If your definitions are more than a week old they need to be updated.

Norton AntiVirus or Symantec AntiVirus:

Launch the application. ( Start -> Programs -> Norton AntiVirus or Symantec Client Security -> Norton AntiVirus or Symantec AntiVirus Client.) Then click the Live Updates button near the bottom of your screen.

If you cannot run LiveUpdates button, the AntiVirus definitions for Symantec and Norton AntiVirus can be gotten from here: AntiVirus Definitions from Symantec. If you can't access the site try AntiVirus Defefinitions locally (updated only to last date on this document). Click on this link, then choose "Open" (I.E. 6) or " Run this program from its current location" (I.E. 5. x). Follow the screen prompts.

Open your AntiVirus software
Start > Programs > Norton AntiVirus Corporate Edition > Norton AntiVirus Corporate Edition

OR

Start > Programs > Symantec Client Security > Symantec AntiVirus Client
Double-click to open.

The virus definition should be no more than a week old ordinarily, and no more than 24 hours old during a crisis. If it is not current, click on the Live Update button to update your virus defnition. If you are not sure, update your definitions.

After ensuring your virus defintion is current, disconnect from the network so you don't infect anything while scanning.

Run a scan on your machine.
Symantec or Norton AntiVirus:
- To reduce the time of the scan
- Launch the program. On the left side of the main screen, under Scan, choose Scan Computer. Choose the C:\drive so that a plus and checkmark appears next to that drive. Then choose Scan at the bottom right hand corner of the screen.
Check that your patches are current.

Check the quarantine folder.

Open your AntiVirus software
Start > Programs >
OR
Start > Programs > Symantec Client Security > Symantec AntiVirus Client
Double-click to open.
Under General information it will tell you if there are quarantined items.
If there are any quarantined items you will need to check the quarantine folder.
On the left hand side expand the view folder
Select quarantine and then look in the right-hand panel for what is quarantined.
If you can't identify the quarantined item contact Technical Support Operations

How do I tell if my AntiVirus software is scanning all files?

See document 15264 — How to run a manual virus scan

How do I know when I'm "safe" (at least from this round)?

If all of the following exist:

If your virus defnintions are up-to-date. And
the virus scan did not detect a problem. And
there is nothing in the quarantine folder And
you do not find the files desktop.exe or date.exe (kobot) And
you do not find the files wingo.exe or wingo.exeopen or wingo.exeopenopen (Beagle) And
you do not find any files beginning with the letters TFTP that are 0 bytes in size (Spybot) on your computer
then the machine is probably not infected. If there are other problems do normal troubleshooting steps.

Information

Check NorthStar web for a ticket covering the problem. The ticket will be updated with current problem reports as well as any recommended steps to identify and resolve the problem.

Symantec can detect and contain infected files, but it can not totally eliminate the Worm. Symantec did not provide us with an automated removal tool, which is why we need rely on the SMS script to complete it's process.

w32.BeagleAW (Win32.Bagle.AR [Computer Associates], W32/Bagle.bd@MM [McAfee]) w32.BeagleAV ( Win32.Bagle.AQ, Bagle.BC, WORM_BAGLE.AT, Bagle.AT, W32/Bagle.AQ@mm, W32/Bagle.bb@mm, W32/Bagle-AU)

Current Worm / Virus

What do I need to do?

How do I know when I'm "safe" (at least from this round)?

If all of the following exist:

Information

w32.BeagleAW
(Win32.Bagle.AR [Computer Associates], W32/Bagle.bd@MM [McAfee])
w32.BeagleAV
( Win32.Bagle.AQ, Bagle.BC, WORM_BAGLE.AT, Bagle.AT, W32/Bagle.AQ@mm, W32/Bagle.bb@mm, W32/Bagle-AU)