Virus attack halts polytech network for day

Auckland Institute of Technology's network suffered its worst virus attack in 15 years last week.

Auckland Institute of Technology's network suffered its worst virus attack in 15 years last week.

IT manager Calum MacLeod, says at least three servers out of 27 on the Novell NetWare network were infected with the One Half DOS-based virus.

The virus, which can wipe hard drives, was also traced to about 50 of the 2000 PCs on the network.

The network was down for a full day on Monday as staff worked into the night to remove the virus.

"The problem is that if you remove the virus it wipes the hard drive, so all the data had to be taken off first, then the virus removed," says MacLeod.

"Fortunately nothing vital was lost but it took a lot of hard work from our technicians."

He says the virus was most likely brought in unwittingly by a staff member--probably on a floppy disk from home.

"The areas affected were mainly the science and engineering departments and people in administration. It affected staff only as the students' workstations don't have hard drives."

AIT staff used the shareware virus scanner Fprot to detect and destroy the virus.

"We're still finding the odd computer that is affected. We've written a program that will halt the user from using the computer if Fprot comes across the virus and there're still a few people ringing us.

"We don't have the resources to get some of the sophisticated antivirus tools. I think it will make our users a lot more cautious because people don't think about it until they've had a problem."

MacLeod says Fprot has been available on the network but staff have mostly ignored it.

"It used to run automatically on every workstation when people logged in but they complained that it took them five minutes to log-in so they gradually stopped using it. We will probably have another education campaign now but it's all to do with user acceptance and that's always a hard battle."

Join the newsletter!

Error: Please check your email address.
Show Comments
[]