mattcharlton

Hi Tom, If you want to give us a call on the support number or drop an e-mail to [email protected] we'll help you out with this. Many thanks, Matt

Log into the toolkit, click the help tab, click on "Frog Technical Support". This will take you to the Frog Community site, from there you can click on Knowledgebase.

I took mine with me two years ago, no problems as a visitor. Taking my 30D and the 10-20 down to get some shots of our stand too - should be fine as an exhibitor too.

I'm at BETT for the first time in two years, albeit as an exhibitor rather than a Network Manager this time. Will try to stop by the edugeek stand

Server cleanup is going well, that f-secure thing did the trick. Need to work out what we're going to do site wide now. Making sure sophos is set up properly on the servers with full on-access scanning set up. Going to work out a way to run that app on login and we'll just log everything in (quicker than re-imaging - just). Maybe re-image the registration machines that will need a sims update on them anyway.

Thanks again mate. Problem we've got is the Sims share and apps share are mapped for all staff. We're trying to nail it down but from looking at the Sophos log (something I don't do enough), its showing infections on the sims server from 14/5/08 - the infected files are in the setups folder and it was the night I was trying to do the sims may update (before it was pulled) after it had already failed for our sims administrator due to a signature mis-match. The signature didn't match because it was infected with a virus evidently. The may update didn't get pulled because it was infected with a virus did it? I presume now that the infected machine is a registration workstation and that the may update has now infected all registration machines if not all classroom machines. We're going to be pulling a late one. Basically disconnecting everything at 3pm, clean the servers, make sure sophos is activated fully on them, start working through the 900 workstations we have and go from there. I really can't believe this has happened.

Bugger. I really had hoped it was a false positive. Recieved this back from Sophos. First time I've had a virus infection on the network in five years. Gutted. Guess I'd better not put the overtime sheets in just yet.

Oh dear. Not what we wanted to see.... Virustotal. MD5: f11208ff035b1c1acefde4bd74c28598 W32.Pinfi W32/Pate.b W32/Pinfi.A

Cheers will give that a go and let you know what happens

Right, chosen a random exe on the apps server and done an on-demand scan on there. Its infected "apparently". Modified date of 20/07/2007 Surely if it was infected by this virus it would have changed the modified date?

nm ignore that, it seeks out exes on network shares

Its possible, but its detectable by sophos, on-access scanning was turned on which is how its caught it, if the virus infects exes by sitting in memory all of the infected exes would have had to have been run to be infected - theres too many apps that just haven't been used for eons for that to have happened. Still looking into it...

ARGH! Good job I updated the policy to not delete, I have over 800 alerts on my apps server showing this virus as having infected every exe going. wtf is going on?! A phonecall to sophos is required methinks.

I'm not sure if its a false positive or whether something has infected the sims directory this morning but we've had the setups directory completely annilihated by Sophos on access scanning. Was detecting W32/Parite-B Win32 executable file virus (W32.Pinfi, W32/Pate-B, PE_PARITE.A, W32/Pate.b, W95/Parite.B, Win32.Parite.b) - Sophos security analysis All over the place. It couldn't clean the files and I've got it set to delete uncleanable files (as they're generally purely virus exes - obviously not in this case) Am restoring from tape now but wanted to make anyone else aware. I'm sure its a false positive which makes it even scarier. Stupid Sophos. I've changed my policies now to "do nothing" if unable to clean the files Matt

I think the initial schools are due to open sometime next year. The handover is June for the Buildings and sometime in July for Networks with a start up in September I think, so we should know a lot more by this time next year.