[sims] Virus Corruption

[Gongalong]

Hi All,

 

Mid-week we spotted a nasty virus infection on our network (Agent-AKJF).

 

It was bad enough that Sophos wasn't addressing it correctly, but the LA had put McAfee on our SIMS server and it doesn't seem to have spotted it all. It has targeted EXEs and PDFs on the shared drive, but the server itself and SIMS database appear fine.

 

I have removed McAfee and installed Sophos, which has at least found and cleaned up the virus, but I suspect some of the EXE files have been corrupted and/or quarantined. I've tried copying the SIMS\Setups folder from a backup from a week ago (as far as our principal backup goes) but that also appears to be affected by the virus. The other backup I have is from June and that appears problematic also, perhaps because it's too old.

 

In short, the problem is I can no longer deploy the SIMS client, although it makes some of the right noises it doesn't complete properly and I cannot launch SIMS on the client.

 

Coincidentally we're due to upgrade both the server's Windows version and SQL version in the Spring half term (unless we can bring this forward), so the question is whether there's some easy way to repair the SIMS install but without involving the LA?

 

I'm assuming that migrating to the new server with the new SIMS install will resolve these issues.

 

We might be able to limp along until Christmas or half term because I can image new PCs with an image from a PC that has the SIMS client.

 

Advice appreciated!

 

TIA

[Gongalong]

I get as far as deploying the client, but when I run it I get "Digital Signature Failure. The SIMS setup file SIMSApplicationSetup has failed its digital signature check. Your SIMS workstation has not been fully upgraded. Please contact your technical support provider."

[Gongalong]

Ah, after this it asks for the location of the CONNECT.INI. I give it, and then SIMS starts. On a second run I get the same upgrade error, no request for the CONNECT.INI, and SIMS starts. It's something I guess, but the error isn't ideal and I can probably workaround it with a cloned PC.

[matt40k]

some easy way to repair the SIMS install but without involving the LA?

 

No, get them involved them as early on as possible. The long you leave it and the more fudging you do, the more they have to unpick. If they have to involve Capita and they wave their charging stick, its about £400 a day. If your setups directory is corrupt and your not using SOLUS3, they'll need to send you a fresh copy if its become corrupt, no getting away from that.

[speckytecky]

Always worth giving both SIMS and Sophos support a call I would suggest. I know my school pays for our support from both (and receives exceptional value for what we pay I feel) but in the past I've found certain companies have been been brilliant in digging me out of trouble even on out of warranty kit.

[Gongalong]

Yes, I've had several discussions with Sophos. Support has been variable - clearly some of it is outsourced, and they troubleshoot from a script. It transpires some bits on the server weren't working properly, but it isn't clear enough there are problems. Email reporting doesn't seem to be working, so something still to resolve.

 

Oddly it's not able to clean all the files, so I've sent some samples off.

[dwhyte85]

Yes, I've had several discussions with Sophos. Support has been variable - clearly some of it is outsourced, and they troubleshoot from a script. It transpires some bits on the server weren't working properly, but it isn't clear enough there are problems. Email reporting doesn't seem to be working, so something still to resolve.

 

Oddly it's not able to clean all the files, so I've sent some samples off.

 

I've had a similar issue with Sophos EM, albeit in 2009/2010. Everything looked great from GUI, in reality it was knackered and not updating client machines... despite the EM saying it was, we opted for a fresh re-deploy after re-imaging the machines to be safe... and it appeared to do the job, we didn't do this with Sophos support - they kept giving us the bog standard, template responses and I didn't have time to argue with them.

 

As for support, most of the corps have this issue with teams that aren't local, I currently work in one and have the same complaint a lot. If you're in that position, don't be afraid to ask to speak to someone in your country. If you're paying for support... you're entitled to have a whinge if it's not working and you're getting fed the reading from the manual and reading from the KB type responses. These places always have an escalation path, don't feel bad if you have to use it.

 

On the other hand... Capita were always very good

 

Best of luck, I hope they can rescue this situation without a need to re-install and restore data.

[Gongalong]

Annoyingly we have to go through the LA for SIMS support.

 

Still using Sophos?

 

My worry with a data restore is that the clock is ticking. We use DPM, and it keeps between 30-60 days of backup, depending on the exact server. In fact that's just for our file servers. For SIMS I naively keep only 7 days of the SIMS share folder, and the infection had already taken hold before that time.

[CAM]

If you go through your LA for SIMS support then you need to speak to them first. Chances are they will have a solution and a means of accessing SIMS whilst you do a clean-up. Ours did when Conficker went on a rampage through the network.

[Gongalong]

The LA sent the installs through from Capita. I've yet to try and deploy them and it will have to wait until Spring Term as I'm off on leave now. The client's still working for the moment though.