Virus notification procedures

Monash University receives many emails through its network connections every day, and despite the scanning of incoming email, the possibility of infection is always present. Infection is also possible from a variety of other means, such as network worms.

In response to the potential threat this poses, ITS has developed a series of procedures that should be completed whenever a virus is detected or suspected. These are divided into two levels as listed below, and the responsibilities of each level are further identified in each section:

• Level 1 : Local IT Representatives
• Level 2 : Security & Risk Section

Level 1 : Local IT Representatives

The Local IT representatives are responsible for the identification of known or unknown viruses. When they receive notice of a potential virus, they should investigate using anti-virus software in conjunction with the web pages below, to identify the virus and then implement the solution recommended by ITS or the supplier.

Responding to viruses

Local IT Support representatives are expected to investigate viruses before contacting ITS. They can do this by investigating the symptoms of the virus, using search engines and other online resources - such as the links below.

• Monash Virus Alerts
• Sophos Virus information

Please keep in mind that many modern viruses are extremely complex and embed themselves into the operating system so thoroughly that they cannot be easily removed and a re-installation or backing up user data and re-imaging of the machine may be requried and can be faster than manually removing the virus. Additionally at the time of infection removal instructions may be brief and/or incomplete.

If the virus (including the current variant) is unknown, a heat job should be logged with as much detail about the virus as possible, and a e-mail sent to virus.alerts@its.monash.edu.au . Please include the following information in the e-mail:

• The heat job number in the subject line
• Copies of virus related files that have been placed into a password protected zip file
• A copy of the password used to protect the zip file

In case of emergency, such as an outbreak affecting a large number of machines (10+), please call the Security hotline on x55428.

Level 2 : Security & Risk Section

Security & Risk are responsible for the speedy resolution of unknown virus threats referred to it via HEAT, as well as the monitoring of known viruses throughout the university. Upon receiving the notice of a virus, they will then liaise with the Anti Virus software companies to get a solution as soon as possible.

The Security and Risk Group are responsible for the distribution of information on viruses. They will send out notices on unknown viruses and on prevalent known viruses to ICCT-L (formerly TWP) and/or the IT Security Forum. If it is a dangerous virus which has the potential to do a wide amount of damage to Monash systems, they can also recommend to the head of Client Services to have a University-wide notice sent out.