Keep Your Eyes Open

4 Simple Steps to A Clean Machine

 

What To Do If You're "Infected"

How do you know your computer is infected?

Unfortunately, there is no particular way to identify that your computer has been infected with malicious code. Some infections may completely destroy files and shut down your computer, while others may only subtly affect your computer's normal operations. Be aware of any unusual or unexpected behaviors. If you are running anti-virus software, it may alert you that it has found malicious code on your computer. The anti-virus software may be able to clean the malicious code automatically, but if it can't, you will need to take additional steps.

What can you do if you are infected?

Minimize the damage .  If you are at work, contact Information Resources immediately by calling (913) 588-7995. The sooner they can investigate and clean your computer, the less damage to your computer and other computers on the network. If you are on your home computer or a laptop, disconnect your computer from the internet. By removing the internet connection, you prevent an attacker or virus from being able to access your computer and perform tasks such as locating personal data, manipulating or deleting files, or using your computer to attack other computers.

Remove the malicious code.  If you have anti-virus software installed on your computer, update the virus definitions (if possible), and perform a manual scan of your entire system. If you do not have anti-virus software, you can purchase it at a local computer store (see Understanding Anti-Virus Software for more information). If the software can't locate and remove the infection, you may need to reinstall your operating system, usually with a system restore disk that is often supplied with a new computer. Note that reinstalling or restoring the operating system typically erases all of your files and any additional software that you have installed on your computer. After reinstalling the operating system and any other software, install all of the appropriate patches to fix known vulnerabilities (see Understanding Patches for more information).

How can you reduce the risk of another infection?

Dealing with the presence of malicious code on your computer can be a frustrating experience that can cost you time, money, and data. The following recommendations will build your defense against future infections:

• use and maintain anti-virus software - Anti-virus software recognizes and protects your computer against most known viruses. However, attackers are continually writing new viruses, so it is important to keep your anti-virus software current.
• change your passwords - Your original passwords may have been compromised during the infection, so you should change them. This includes passwords for web sites that may have been cached in your browser. Make the passwords difficult for attackers to guess (see Choosing and Protecting Passwords for more information).
• keep software up to date - Install software patches so that attackers can't take advantage of known problems or vulnerabilities. Many operating systems offer automatic updates. If this option is available, you should enable it.
• install or enable a firewall - Firewalls may be able to prevent some types of infection by blocking malicious traffic before it can enter your computer (see Understanding Firewalls for more information). Some operating systems actually include a firewall, but you need to make sure it is enabled.
• use anti-spyware tools - Spyware is a common source of viruses, but you can minimize the number of infections by using a legitimate program that identifies and removes spyware (see Recognizing and Avoiding Spyware for more information).
• follow good security practices - Take appropriate precautions when using email and web browsers so that you reduce the risk that your actions will trigger an infection.

As a precaution, maintain backups of your files on CDs or DVDs so that you have saved copies if you do get infected again.

Additional information:

• Recovering from a Trojan Horse or Virus
• Before You Connect a New Computer to the Internet
• Securing Your Web Browser

This information was adapted from an original production by US-CERT and republished for non-commercial use as outlined in their Privacy & Use policy.

Mozilla Fixes Critical Bug in Firefox 10

Just one week after Firefox version 10 was released, Mozilla has pushed out a fix for a critical flaw that could be exploited to crash the browser.  Students and home users are encouraged to download and apply the fix immediately.  The security patch will be pushed automatically to all University and UKP-owned workstations.

For more information, read the Mozille Security Advisory.

Apple Issues First Mac Security Update for 2012

Apple has released its first 2012 security update to address more than 50 vulnerabilities for Mac OS X.
Updates are available for Mac IS X 10.7 (Lion), and for 10.6 (Snow Leopard).  OS X users should apply the appropriate update as soon as possible.

NOTE:  There have been reports of issues with version 10.7.3 including rendering the system unbootable, so users with that version should be careful applying the patches.  More info on the issues can be found at Apple: OS X Lion 10.7.3 and Security Update 2012-001

For more information:

EWeek:  Apples Fixes 52 Bugs in OS X
Cnet: OS X 10.7.3 Update Causing Issues
ComputerWorld: Apple Update Patches 51 bugs in Mac OS X

Symntec Releases pcAnywhere patch

Symantec has released hotfixes for its pcAnywhere software. The updates address all known  security issues in versions 12.0, 12.1 and 12.5 (including SP2, SP2, and SP3). Concerns still abound because the source code has been stolen by hackers, giving them unlimited access to find other security issues within the software.

We are already seeing someone scanning for open pcAnywhere installations on the Internet on port 5631.  Users of pcAnywhere software should apply the patch immediately.

For more information:

Symantec Vulnerability Advisor
Information Week:  Symantec Patches pcAnywhere, but should you delete?

Microsoft Patch Notifications for January 2012

Microsoft released 7 patches today designed to address 20 vulnerabilities, including the one exploited by the Duqu worm. There are two patches that have been given a "PATCH NOW" rating by SANS:  one of them, MS12-004 or KB2636391, addresses a currently exploited issue in Windows Media Player . Windows, Office and Internet Explorer are all affected and many of the updates will require you to restart your computer.

Members of the KUMC community will have these patches deployed automatically to your on-campus computers, so no further action is needed. However, you should ensure that your personal computer is  updated as soon as possible.

Update to Firefox 9 and 3.6.25

Earlier today, the Mozilla Foundation released Firefox 9 and Firefox 3.6.25 to address multiple vulnerabilities that would allow an attacker to execute arbitrary code, cause a denial-of-service condition, or perform a cross-site scripting attack.  (In other words, they could control your browser or PC, cause it not to function, or steal information.)   Campus computers will be updated automatically; however, you are encouraged to update your Firefox installations on personal devices as soon as possible. 

For additional information, review the Mozilla Foundation Security Advisories for Firefox 9 and Firefox 3.6.25.

Microsoft Patch Notifications for December 2011

Microsoft released 13 patches today designed to address 20 vulnerabilities, including the one exploited by the Duqu worm.  One of the patches, MS11-087 or KB2639417, addresses a currently exploited issue in the way that the Windows kernel-mode driver handles TrueType font files and has been given a "PATCH NOW" rating by SANS for workstations and a Critical rating for servers.  In addition, there are 7 other patches rated critical for workstations.  Windows, Office and Internet Explorer are all affected and many of the updates will require you to restart your computer.

Members of the KUMC community will have these patches deployed automatically to your on-campus computers, so no further action is needed.  However, you should ensure that your personal computer are updated as soon as possible.

For more information see: http://technet.microsoft.com/en-us/security/bulletin/ms11-dec