The University experienced a major attack of the Blaster worm and its varients starting late last Monday evening, August 18th. The Blaster worm spreads by exploiting security weaknesses in Windows 2000 and XP operating systems. The worm generates high volumes of traffic looking for new targets on and off the campus. This traffic caused our network to essentially shut down.

OIS shutdown the internet connection early Tuesday morning and spnt most of Tuesday reconfiguring the network. The network was moved to a new Cisco 6509 Core Router and restored to service in the early afternoon. Restrictive Access Control Lists were applied to every building until OIS personnel updated every computer with current security patches and anti-virus software. Network services were more or less back to normal late Friday afternoon, but some problems continue to appear.

OIS is monitoring the situation closely, but everyone can help in this effort. Everyone should ensure that their computer’s anti-virus software is installed and active and Microsoft’s updates are being applied.

At 11:00 AM, the campus network was disconnected because of widespread infection of University workstations by the Nachi worm subsequent to an initial infection by the Blaster worm (see http://us.mcafee.com/virusInfo/ for more details). The University’s Windows servers do not appear to have been infected. A byproduct of Nachi infection is a large volume of network traffic, and it was this that apparently overwhelmed the campus network.

OIS employees have eradicated most worm infections in Jones Hall, McIntyre Hall, Wheelock Hall and Security Services, and non-public workstations in Collins Library.

Currently, most University network services are online, with the exception of Windows filesharing. Thus, access to MERLIN2 and ALEXANDRIA is unavailable at this time. We expect it to become available sometime tomorrow morning(Wednesday, 20 August) from the above buildings.