Instructions on how to remove the virus:


Please check the definition date:
1) Double click on the shield located in the lower right side of your
desktop.
2) When window opens you will see on the left side a menu list going
downward, highlight Norton Antivirus Corporate Edition.
3) On the right hand side you will see general information, program
versions, and virus definition file. If your parent server is TUXEDO, please
call the helpdesk immediately (4000) or fill out a request at
http://itd.utc.edu/faculty/hdrequest/
4) If you are pointing to ZIGGY, NURSELAB, or COBASERVER check the virus
definition file, look for the date - if it does not read 9/18/2001, you will
want to check this periodically to insure that you have the latest
definitions, if it before 9/14/2001, you will need to contact the helpdesk
so they can help you get the latest virus definitions (The definitions
should be pushed out to you by the early morning, assuming you are pointing
to one of these servers, so check often).
5) After you get the proper definitions, start Norton AntiVirus (NAV), and
run manual scan
6) If any files are detected as infected by W32.Nimda.A@mm (dr) or
W32.Nimda.A@mm (dll), they will either be quarantined or repaired (Please
contact the helpdesk by either calling them at 4000 or filling out a online
request form at: http://itd.utc.edu/faculty/hdrequest/ after the virus has
been found.
6. Reboot the computer.
7. Repeat steps 5 & 6 above until no more files are detected as
[log in to unmask]

IF THIS VIRUS IS FOUND ON YOUR COMPUTER- PLEASE CALL THE HELPDESK AT 4000 OR
FILL OUT A REQUEST FORM AT http://itd.utc.edu/faculty/hdrequest/

Thank you

Tony Parsley
Network Systems Analyst
The University of Tennessee at Chattanooga
(423)755-4733 [log in to unmask]




-----Original Message-----
From: Richard Gambrell [mailto:[log in to unmask]]
Sent: Tuesday, September 18, 2001 10:31 PM
To: [log in to unmask]
Subject: [UTCSTAFF] Nimba computer worm news


A new virus/worm is attacking Windows machines called Nimba.  It
has the potential to be a very serious problem for the network and
it will make your computer misbehave, but it does not delete any
documents.  We will send out additional information as we have it.
We are pretty sure there are already machines on campus that are
infected.

Nimba is spreading rapidly by e-mail or web surfing in some cases.
Do not open e-mail attachments unless you expect them.  This worm
can also infect your Windows machine in certain cases even if you
do not open attachments.  We are updating the Norton Anti-Virus
protection on your machine to stop these infections.

If your machine behaves very oddly, or you suspect your machine
may be infected, shut it down normally and call the help desk at
ext. 4000.

If you get a message from Norton AntiVirus that your machine is
infected, please call the help desk and follow their directions
before you do anything else on the machine.

If you do not have Norton AntiVirus installed, please do not
use Outlook Express or Internet Explorer (do not open any
attachments in any e-mail agent), unless you know you have
updated the latest security patches from Microsoft.  Call the
Help Desk to arrange for Norton AntiVirus to be installed and
Microsoft's critical updates to be installed.

It is always a good idea not to open attachments unless you are
expecting them and the e-mail they come in looks reasonable for the
sender.  Viruses will pick a message at random to send to everyone,
so if that message doesn't look like to was meant for you, be
suspicious and do not open any attachment.

We will post more information as it becomes available.

Thanks,
Richard
--
Richard L Gambrell, Senior Information Technology Consultant and
Director of Computing Systems and Networks
Information Technology Division, University of Tennessee at Chattanooga
Fax: 423-755-4150                Support Help-Desk: 423-755-4000
Direct phone: 423-755-5316       ITD Business Office: 423-757-1755
Mobile (urgent): 423-432-5122    Main UTC: 423-755-4111
Email: [log in to unmask]