After Melissa, DOD was ready for the worm

DISA and the services took no chances with infection, so, for the most part, 'there were no problems'By Bill MurrayGCN StaffSeveral Defense Department officials recently declared victory in their battle against the latest malicious computer virus, with two reporting they relied on the DOD-wide antivirus software license program for updated patches.Space and Naval Warfare Systems Command teams located antivirus software on servers as soon as they knew of the Worm.ExploreZip virus, said Richard Williamson, a SPAWAR spokesman in San Diego. The command received no reports of the virus infecting any of its servers or users.'We got hit on a few PCs, when people opened up Zip files from someone they supposedly knew,' said Col. Philip E. Vermeer, chief of the Information Systems Division Directorate of the Army National Guard Readiness Center.Software vendor Symantec Corp. of Cupertino, Calif., first received reports about the worm from Israel on June 6, but the virus apparently did not spread as widely as the Melissa virus [GCN, April 5, Page 1].Pull the plugIn response to advice from the Army Computer Emergency Response Center, National Guard officials unplugged all servers running Microsoft Exchange and instructed state Guard bureaus to do the same, Vermeer said.Guard users did not have e-mail service for about 24 hours, he said, while systems administrators ran McAfee antivirus software from Network Associates Inc. of Santa Clara, Calif., on PCs and Symantec Norton Utilities on servers. Through Defense Information Systems Agency's antivirus site license, DOD agencies can download selected Network Associates and Symantec products, from www.assist.mil, at no charge.The DISA Joint Task Force for Computer Network Defense received several reports of Defense systems infected by the virus, spokeswoman Melissa Bohan said. 'A few reported notable dam-age,' she said.The DOD Computer Emergency Response Team released an alert to DOD agencies, with a potential impact evaluation, technical de-scription and an immediate remedy for the virus, she said.Worm.ExploreZip uses Microsoft Exchange, Outlook and Outlook Express on systems running Windows 9x or Windows NT to replicate itself by replying to unread messages.The worm will destroy any file with the extensions .h, .c, .cpp, .asm, .doc, .ppt or .xls on hard drives, any mapped drives and any network machines accessible each time it is executed, according to a document on Symantec's Web site.'We got the [DISA] update and made upgrades to our software,' said Dave Rourk, a Navy Atlantic Fleet spokesman in Norfolk, Va. 'There were no problems. They were ahead of it.'The Air National Guard also thwarted the attack, said Maj. Bruce Babcock, chief of the Air Guard Network Operations and Security Center. 'We had no damage to files and no information loss. No service was interrupted to our customers,' he said.The Guard maintains some 50,000 desktop PCs.Air Force Computer Emergency Response Center officials reportedly advised network administrators to filter out e-mail files of more than 200K because Zip files are generally 206K or larger.'As far as techniques and tools are concerned, we'd rather not give that away,' out of fear that hackers could distribute viruses through files with smaller memory requirements, said Arthur Farrington, chief Air Guard information assurance officer.On June 10, the Air Force CERC issued an advisory to Air Force base system administrators explaining how to update their virus software and offering detailed corrective measures, said Dominick Cardonita, an Air Intelligence Agency spokesman at Kelly Air Force Base, Texas.Get the word outThe Marine Corps, reportedly blindsided by the Melissa virus, had no reported incidents of the Worm.ExploreZip virus, said Capt. Mike Newmann, a service spokesman.'We were able to get the word out to everyone prior to the virus hitting'some great work on our staff's part,' said Lt. Cmdr. Conrad Chun, a Navy Pacific Fleet spokesman in Hawaii.No Standard Systems Group systems were infected, said Maj. Carol Zienert, a spokeswoman at Maxwell Air Force Base's Gunter Annex, Ala. 'All the precautionary measures were run as soon as the communications folks heard about the worm virus,' she said.Army officials received a dozen or so re- ports of Worm.ExploreZip infections in the service, said Lt. Col. William L. Wheelehan, an Army headquarters spokesman. He said the infections were insignificant with no compromises of security or loss of data.'We had two cases where the Worm virus was detected at the server level,' said Cleo Zezos, an Army Communications-Electronics Command spokeswoman in Fort Monmouth, N.J.'In both of these cases the virus was detected by the server antivirus software, isolated and cleaned before it could infect a personal computer and cause damage. The virus did not cause any e-mail downtime,' he said.But a virus can devastate individual users. One guardsman at the Naval Postgraduate School lost all Microsoft Word files he had not backed up, said the National Guard's Vermeer. He predicted viruses would continue to cause damage until law enforcement authorities developed better ways to apprehend and convict their authors.