Security Bulletin
May 03, 2004

Microsoft: Critical Update

Microsoft: Sasser Worm Info
NAI: W32/Bagle.z@MM
NAI: W32/Netsky.ab@MM
NAI: W32/Bagle.aa@MM
NAI: W32/Sasser.worm.a
NAI: W32/Sasser.worm.b

Overview
Who is Affected

Recommended Actions

Administrative Users
Academic PC Users
All Home PC Users
Academic Mac Users

Further Assistance

Other Bulletins

ADMINISTRATIVE Staff: You will be contacted directly by Administrative Computing to install this update. You should not take any action regarding your OFFICE computer. If you use a computer at HOME, please read on.

STUDENTS, FACULTY, ACADEMIC STAFF AND ALL HOME USERS (including administrative home users) must all follow the procedures below.

I. OVERVIEW

NAI has recently identified several viruses as a Medium-level threat: Bagel.z, Netsky.ab, Bagel.aa, Sasser.a, and Sasser.b. This indicates that there is a high probability that one or more of these viruses will be found on Haverford's campus network. Microsoft has also released information regarding the Sasser worm. The Sasser worm requires no user interaction to infect an unpatched computer. Microsoft Windows update 835732 is necessary to prevent infection of a computer by the Sasser worm. See the April 14th bulletin for more information about these critical updates.

II. WHO IS AFFECTED?

All Windows 98, Windows 98 SE, Windows ME, Windows NT 4.0, Windows 2000, and Windows XP users are affected by these viruses.

III. RECOMMENDED ACTION - ADMINISTRATIVE USERS ON CAMPUS

The Administrative Computing Center will be contacting those in Administrative offices. Do not attempt to follow the directions below on your office system, but please do so for your home computer(s).

IV. RECOMMENDED ACTION - ACADEMIC WINDOWS USERS and ALL HOME USERS

Everyone should install all the Windows critical updates.. The best way to apply critical updates is to open INTERNET EXPLORER and go to http://windowsupdate.microsoft.com/
(Note: You must use Internet Explorer; Netscape will not work.) Follow the instructions to scan for updates and install all **critical** updates identified (recommended updates and driver updates are not necessary).

Your Windows computer may already be configured to automatically download software updates. If you received notification on your computer to install this critical update or restart your computer (after April 13), your computer may already be patched for Windows updates. If you are not sure if the updates have been applied, go to http://windowsupdate.microsoft.com with Internet Explorer and scan for updates. Be sure to apply any critical updates that are available. If no critical updates are available, you have already applied the updates.

If you find by the above methods that your computer is not automatically updating, see http://www2.haverford.edu/acc/docs/general/osupdates.html for instructions on how to set up your computer to automatically notify you and install these updates as they are released.

All Windows users must also make sure that they have installed the latest anti-virus software configured by ACC (Virusscan 7 for XP), and that you have the latest definitions issued May 2(dat version 4353) or later. Windows users should also run a full scan of their harddrive to verify that they are free from infection. To do this:

1. From the Start Menu, go to Programs, Network Associates and VirusScan Console.
2. Click Scan All Fixed Disks once.
3. Click on the green arrow button on the menu bar.
4. If a virus is found, write down the message and see the web page titled What to do if A Virus is Detected.

For virus software information and downloads go to http://www2.haverford.edu/acc/virus/virus.html.

V. RECOMMENDED ACTION - ACADEMIC MAC USERS

Macintosh users must also be sure to get all critical operating system updates and Office updates. Look for the Software Update tool in your Control Panel (OS 9) or in System Preferences (OS X) for operating system updates. For detailed instructions see http://www2.haverford.edu/acc/docs/general/osupdates.html.

For information and downloads of current anti-virus software, go to http://www2.haverford.edu/acc/virus/macantivirus.html

VI. FOR FURTHER ASSISTANCE

Students should fill out a HELPME form or call the Helpdesk at 610-896-1480, open 9am to 5pm, Monday through Friday.

Faculty members and academic staff should contact their liaison (see http://www2.haverford.edu/acc/about/liaisons.html ) or call the Helpdesk at 610-896-1480, open 9am to 5pm, Monday through Friday.

Administrative users should contact Administrative Computing (610-896-1044).