Help Desk Email

[pt14]

Hey Guys
Just wondered your take on the latest ITS email about the Nyxem worm.
It says we would have to reinstall windows if we got infected...
Now I searched the internet long and hard to try to find any other person on the planet who thinks that you need to do a clean reinstall of windows if you get infected with this virus (unless of course - the virus has wiped windows for you after 3rd of the month). All of the majour anti-virus companies have removal tools. Am I missing something?

[Nickel]

I imagine someone who knows that they are doing will be able to remove the virus without reinstalling windows, but it would probably involve some more complex undertaking than can easily be explained in an email. The email does say that there are tools available but they are not always reliable. I assume the reinstalling option is the one suggested as it is the only simple option with almost guarunteed success, and they want to avoid people running removal tools and then having their hard drive wiped because the tool didn't do a good enough job.

--
nickel

[munchingfoo]

Sounds like a lot of work though Nickel - I mean, if all it does is deletes all you files then why not just wait to see if you have it then format when it screws you over. Most people don't have too much really valuable data.

When I first read the e-mail I honestly thought it was a ploy to get you to do a fresh install for no reason.

[hr]

I'd like to change the world but they won't give me the source code.

[Nickel]

Quoting munchingfoo from 21:24, 29th Jan 2006

When I first read the e-mail I honestly thought it was a ploy to get you to do a fresh install for no reason.

lets hope not, when people do fresh installs they may be doing so from old installation media and end up on resnet without the latest patches/service packs and with no firewall.

[Steveo]

I think the reason for warning about a format is to give time to backup crucial documents.

The best advice would have been to ask people to make sure they have all their crucial work backed up, run the removal and then wait and see, if it goes tits up, time for a format Johnny and what not chaps.
[hr]

Strangers passing in the street, by chance two seperate glances meet.

[Traveller]

More information on this worm - including a couple of good reasons to do a clean install of any infected machine - can be found at http://isc.sans.org/blackworm. (Look under "Removal".)

[Nickel]

someone should really write a virus that backs up the users documents, then replaces windows with linux on their machine.

[munchingfoo]

have you not done that already?



[hr]

I'd like to change the world but they won't give me the source code.

[niall]

honours project anyone?

[hr]

do you have a tastyspoon?

http://www.tastyspoon.com/forum