What do I do about viruses?

7 May, 2003

At SLAC, we take various measures to protect e-mail and Windows computers from virus and other malicious code. Users of the SLAC e-mail systems and supported Windows computers should contact their local administrators if they receive notification that they have a virus.

The local administrators will work with SCS to disinfect compromised systems and infected files, and to determine the source and cause of the infection. However, if you are not using SLAC e-mail systems or your computer is not supported by your local administrator, these measures will not protect you.

Diagram

Where Viruses Come From 

The sources of infection are most commonly:

1. incoming e-mail (attachments, etc.)
2. files that get onto the local computer by any other means (floppy disk, CD, download from Internet, SLAC servers, etc.). Such an infected file may then be sent back out as e-mail.

How SLAC Deals With Viruses

Anti-virus software on the e-mail servers scans incoming and outgoing e-mail and removes suspicious attachments (infected files, executables, Word/Excel files with macros). The intended recipients of these messages receive a substitute text file instead, informing them of this. Since the infected files never reach the user, there is nothing he/she needs to do unless the stripped file needs to be retrieved (in which case the user should contact postmaster@slac.stanford.edu).

What You Should Do

If you get a notification indicating that an infection has originated from one of your files, please immediately contact your local administrators. This will set in motion a process that has been set up with your local administrators and SCS. After your local administrators checks your anti-virus software to make sure that it is working properly and the signature file is up to date, he/she will scan you local system. SCS will have already received notification of the infection also (if not the local administrators will contact SCS), and will scan for any infections on the servers. Only SCS should check the servers because if this is not done in a coordinated manner it may cause a slowdown of the servers, affecting the whole site.

Overall, SLAC has a good history of avoiding any widespread infections. This is thanks to the cooperation of the user community, to the anti-virus measures taken on the e-mail systems and Windows servers, as well as on the supported Windows client systems.

However, occassionally files may still get infected because:

1. a new virus may infect files before the vendors update their anti-virus signature files to detect the new virus
2. the anti-virus software may not be working properly

For these reasons, SCS needs to be notified by the local administrators whenever there is an infection in order to investigate the cause.

More information: Windows FAQ and E-mail web pages

Owner: Desktop-Admin and Postmaster
Feedback