Page 1 of 1
neomonAP23
Posted: Tue Feb 01, 2005 12:16 am
by RadioFan
Sorry if this is a glass dick, but this fucking virus took out our entire network at my job all day today.
Our tech guys said there was no information on it that they could find. They had to disconnect a bunch of machines, then download about half a dozen Windows patches because they couldn't figure out which one would prevent it from entering again. Seems to be OK now, but this is the worst my company has ever seen, I'm told. Nobody could do shit all day today ... which normally would have been nice, except I couldn't fuck off in here either as Internet was down.
Posted: Tue Feb 01, 2005 3:24 pm
by ElTaco
Is that the name of the virus? NeomonAP23? Never heard of it. Why did they figure it out? There is no way that there is no information on the internet unless its a 0 day virus/worm. Either way, its their fault for not keeping your machines up to date.
I'm working on a setup that will automate most of it using domain stuff but for now I just have my underlings go around and update machines. Gives them something to do for a week each month and it keeps us secure.
Ultimately though, especially for companies that have their own admins, they should be setting up some kind of a patch system where they can test patches and then approve them and the machines will install them once approved. If you are really big, it pays to pay for a solution where they can push patches and even force reboots but we aren't big enough for that.
Posted: Tue Feb 01, 2005 5:43 pm
by RadioFan
ElTaco wrote:Is that the name of the virus? NeomonAP23? Never heard of it. Why did they figure it out? There is no way that there is no information on the internet unless its a 0 day virus/worm. Either way, its their fault for not keeping your machines up to date.
Yes and yes. It is new, or so they said. And they do need to be a lot more proactive, apparently.
Posted: Tue Feb 01, 2005 7:17 pm
by ElTaco
I still am not sure where they got that name from. Here is all the viruses that came out as of yesterday.
http://securityresponse.symantec.com/av ... hreat_list
Posted: Tue Feb 01, 2005 8:11 pm
by RadioFan
I saw the file on my computer when they were isolating it. It definitely was titled "neoconAP23." Maybe it's a version of something else with that name.
At any rate, our network dudes said home computers are probably safe, as long as they are updated. Yeah, big reassurance. :roll:
Posted: Wed Feb 02, 2005 1:58 am
by Fat Bones
There are now 9 entries in Google now for that...no one has really nailed it down yet.