Virus Notes

Mytob Virus Fix (9.26.2005)

If you tried to open the attachment on a computer running Windows (Macs are not affected), the following steps will remove the virus from that system:

1. Turn Off System Restore (necessary for Windows XP and Windows Me only)
• Click the Start button
• Right-click My Computer and click Properties
• Click the System Restore tab
• Place a check in the box next to Turn off System Restore
• Click OK
• When asked Do you want to turn off System Restore, click Yes
2. Run the Mytob Fix Tool
• Click here (http://www.hope.edu/resources/cit/virus/W32.Mytob/FixMytob.exe)
• When prompted, select Run
• Click Run again
• Click Start and allow the tool to run. This may take 10 minutes or more.
• When the tool is finished, you will receive notification if the virus was found. Click OK.
• When asked if you would like to continue, click No
3. Turn On System Restore
• Click the Start button
• Right-click My Computer and click Properties
• Click the System Restore tab
• Clear the box next to Turn off System Restore
• Click OK
4. Reboot the Computer

The virus should now be removed from your computer. If you have difficulties, please contact CIT at x7670 to make an appointment for repair. Please note that there may be a wait for this service.

New Virus (9.25.2005)

The following email message was sent to all faculty, staff, and students:

A new e-mail virus is spreading quickly around the Internet. The "Mytob" virus tries to trick you into opening its attachment by faking a message from official-sounding Hope College e-mail accounts like:
register@hope.edu
admin@hope.edu
webmaster@hope.edu
service@hope.edu

The body of the message may say something like:
" Your account has been suspended..."
" You've successfully changed your password..."
" Your e-mail account was used to send a huge amount of unsolicited spam..."

If you receive messages like this, please delete them immediately, and do not open the attachment.

If you have already opened the attachment on a Windows computer (Macs are not affected), it is likely that your computer is actively sending this virus to others. Instructions for removing the virus are available at:
this site.

Please note that while there are sometimes "one-click" removal tools available to assist with removing viruses, currently there is not one available for this particular infection. If you have opened the attachment and are either not comfortable with following these instructions or are not able to complete them, please disconnect the Ethernet cable from your computer to prevent the virus from being spread further. If you connect using wireless, please turn the computer off. Then, use a lab computer to check the CIT website (http://www.hope.edu/cit) for more details.

Thank you...

- Jeff Pestun, CIT

Beware of Viruses (9.7.2005)

Another school year has started, and we all managed to avoid any major virus outbreaks. If you were around in 2003, you'll recall that it was a different story that year (remember Blaster?).

However, even though the start of this year has gone smooth so far, the next big virus on the Internet is probably right around the corner. CIT employs multiple layers of virus detection designed to filter the bad things out before they even get to your inbox. But it usually takes those programs several hours to discover the new viruses, so there's always an amount of time when some can sneak through.

Remember, e-mail attachments are the most common way for viruses to be transmitted. So don't open e-mail attachments that you're not expecting, even if you know the sender. You wouldn't take pills that just showed up in your mailbox, would you?

We'd also like to remind everyone that CIT will never send you a message stating that your account has been suspended or closed, and that you need to click on an attachment to re-enable access. Faking messages like this is a tactic that virus writers use to trick you into clicking. Don't fall for it!