Request for help in Derbyshire

[GrumbleDook]

Calling all helpful folk in Derbyshire (or nearby Counties). Some of you may be aware that there has been a bit of a problem with a virus in a few schools in the region and one of them has to clean all of their machines ... every single last one of them ... around 500.

 

Are there any CRB-checked people out there that can spare a day to help out at another school, free of charge.

 

The virus, according to Sophos, is Delbot-AO and Sophos has a cleaner that can be downloaded from their site. Norton spots it but doesn't do anything with it and I am checking about AVG and others now.

 

If you have a spare person that you can free up for a day to help out a fellow NM than please PM me and I will pass on your details to him.

 

Any help with this appreciated. They have already been down for over a week and are getting pretty desperate. The source of the outbreak is still being investigated.

[tosca925]

Is there no way the removal can be automated with Sophos?

[plexer]

Problem is I presume as soon as networking is used it's infecting itself?

 

Set up a clean machine that is fuly protected and then plug that in and do some automating from there?

 

Ben

[petectid]

Are there any CRB-checked people out there that can spare a day to help out at another school, free of charge.

 

Your CRB check only covers you for work with your current employer, if you work for someone else you need to be CRB checked again. Not a small hurdle, you need volunteers from the very same authority.

[GrumbleDook]

The cleaner, IIRC, has to be run from safe mode and then the machine has to be brought back online and updated with the latest definitions before it can be connectedback to the network.

 

THe main problem is that fact that it targets a bug in W2K machines ... and the hotfix (request only) is not pefect. But the machine still needs cleaning or reimaging (if you are sure that all machines are turned off and there is nothing to reinfect the clean machines whilst it starts up, joins the domain and gets Sophos onto it.

 

The only way to clean it it to take *everything* offline and do it one by one. Once a machine is clean and has the latest definitions on it is fine.

[robk]

Hmm, we found WORM_RINBOT on a number of W2K based CCTV servers, Trend housecall finds and appears to kills it.

 

Not sure if this is the exact same virus, but I know of another school that got the same problem, though worse than us as they had more W2K clients (on top of other networking problems as well).

 

Source of infection would be interesting, considering that would make three DCC sites with it, perhaps EMBC`s firewall is not as good as they tell us??

 

What are the visible effects of said virus?

 

Rob Keeling

[tosca925]

I feel really sorry for the school, this happened to us in win98 days and we had to take all 120 pc's off the network and do exactly the same thiing.

 

Can't imagine having to do 500

[chrbb]

Whats the signs and symptoms?

Is it Derbyshire County Council schools or Derby City, I'm in Derby City can't help I'm afraid off sick at mo but now panicking it may be affecting my two schools - sorry just realised how selfish this sounds - but am panicking!

[Kyle]

the poor sods.......

[Espada]

I did my PGCE up that way. Which schools are affected (PM them)

[cheesypete]

I'm in Notts but unfortunately cant help out this time.

 

Used to work for Derbyshire County Council as an ICT Tech so am wondering which school(s) are affected?

 

Is it worth creating some sort of db to match areas against willing helpers?(for future use) - put my name down if its a good idea

[bh1985]

Hi, Have you heard of RIS? (Remote Installation Services). It is well worth looking into, especially if you are to reinstall over 200 machines with an OS, not to mention the required software and device drivers per computer, eek! :-(

 

Just perfect an OS image, with all your software/drivers etc, and deploy the image to clients. It uses PXE LAN boot and TFTP. The only user intervention to installing your image is getting and administrator to log on on each machine at network startup, select an image and your away. You will save hundreds of hours recovering from bloody rinbot (and anything else).

 

We have it here in derbyshire. If you need any help, tips etc yada yada, email me if you want. [email protected]

[bh1985]

BTW, sorry, misread. Didnt realise it was 500 odd, oh dear. You need RIS. Get it get it NOW. Clean ris image, imaged deployed site wide, virus gone! :-)

[bishopsgarthstockton]

@bh1985

 

I think GrumbleDook def knows what RIS is

[bh1985]

oops, :oops: , Dind't realise, sorry. But If any derbyshire schools need any help with this, then they are welcome. :-)

[GrumbleDook]

Pm on its way to you

[peterk]

GrumbleDook I'm in Derbyshire and have CRB check - can't you run a ghost image out to all infected machines, maybe room by room. Did this at my last school in Stretford, the only probs we had were keeping laptops of the system until they had been checked

 

you can e-mail me on

[email protected]

[acrobson]

Sorry to here the bad news, if this starts hitting north east territories i am CRB cleared for Newcastle and i am also registered on many casual supply registers for this part of the world too, i do get around!

 

All the best, fingers, legs and toes crossed for you all!