ITS Knowledge Base

Before installing Sophos, please uninstall any anti-virus or virus-update software packages from your computer. Go to Control Panel->Add and Remove Programs (Windows XP) or Uninstall a Program (Vista) for removal.

(more…)

Sophos Anti-Virus for Linux (requires kernel version 2.4+, 2.6+)

Sophos Ant-Virus Engine Version: 6.4.3
Threat Detection Data: 4.35E

Release Date: 2008-11-03
File Size: 4,038,903 bytes
MD5 sum: 69f29025bb367de2ddce6ff032d7816b

WARNING!
This package is licensed for current students, faculty, and staff of Southwestern University. Redistribution or other unauthorized use is prohibited. Package contents are maintained by Information Technology Services.

Installation Instructions:

1. Uninstall Old Anti-Virus First: You should manually uninstall any anti-virus software currently on your machine before you begin the installation of Sophos Anti-Virus.
2. Install: Follow the instructions below for installation.
   1. Download: Save this file (Sophos Installer (Linux) - 2008-11-03.tgz) to your desktop or another location you’ll remember easily.
   2. Extract: Double-click the file to open it with Archive Manager, File Roller, or similar GUI. Extract the subdirectory sophos-av to the same location where you downloaded the archive file. Alternatively, you can run the command tar -zxvf Sophos\ Installer\ \(Linux\)\ -\ 2008-11-03.tgz to un-tar the file. (Remember, you can hit Tab after typing the first few letters of the filename to auto-complete the rest.)
   3. Run Install Script: Launch a terminal window (if one is not already open). Navigate to the directory where you extracted the contents of the archive in the previous step (for instance, cd /home/username/Desktop). Run the installation script as root (sudo ./sophos-av/install.sh). This will download engine binaries and virus definitions. It might take some time, especially on a slow connection. If you receive any errors during the downloading process, simply re-run the script.
3. Completion: For Linux, the administrative interface is accessed through a local web server. From any web browser on the machine, navigate to http://localhost:8081/ to view this interface. It will tell you the current status of the engine. (If you are running a web server on port 8081 already, contact ITS and we will recompile the package with a custom port number.) By default, the login username and password for the web interface are both sophos.

   The installer needs the source for the currently-installed kernel in order to build the on-access kernel module. This can usually be found in the software repository of your distribution as kernel-source or similar. (You may also download the source from http://www.kernel.org/, but it is safer to use the package from your distribution’s software repository.) The kernel module may not compile correctly for your distribution. It has been verified to compile in Ubuntu 8.04 x86, but not openSuSE 11.0 x86_64, for instance. Contact ITS if you would like assistance in building the kernel module.

4. If You Need Help: Call x7333 (512.819.7333), e-mail helpdesk@southwestern.edu, or add a help ticket at http://helpdesk.southwestern.edu/.

Before installing Sophos, please uninstall any previous anti-virus software (such as Virex) that you may have installed on your computer. (more…)

If you have replied to an e-mail that you suspect is a scam, and you sent your SU username and password in the reply, change your password immediately. You can do this yourself at http://www.southwestern.edu/password/. Alternatively, you can call the SU Help Desk (x7333, hours 8AM-5PM M-F) or come by ITS with your SU ID.

Be cautious when you receive an e-mail asking you to reply with any type of personal information, including (but not limited to) a username or password. While the appearance of the e-mail may at first glance look legitimate, take the time to inspect it closer. You may find numerous misspelled words, awkward language, references to services that do not exist, or other little things that seem out of the ordinary.

You should always question the provenance and authenticity of such e-mails. Please note, however, that simply receiving a scam e-mail is not typically enough to compromise personal information. If you are unsure if an e-mail is legitimate, call the SU Help Desk or come by ITS with any questions. (more…)

There are a number of different things that may have gone wrong in your installation. First, download a fresh copy from the Knowledge Base (maybe unnecessary, but it never hurts just in case the download was corrupted). If you are concerned about the authenticity of the file you downloaded, use a freeware utility like MD5sums to check the MD5 checksum of the file against that posted in the article.

When you run the executable, it will unzip to %SystemRoot%\Sophos_Installer_<YYYY-MM-DD>. Before you do anything else, make sure that all anti-virus programs (McAfee, Norton/Symantec, and Sophos) are completely removed. Check the Add/Remove Programs (in Vista, this is now called Programs and Features) listing in Control Panel. Then, reboot and execute the setup file with no other programs running. You don’t necessarily have to disable background programs or services, but foreground programs like Firefox or Word can disrupt the installation process.

If Sophos successfully installs itself, it will put two entries in the Add/Remove Programs list: Sophos Antivirus and Sophos Autoupdate. If you find that it did not install again, check to see which, if any, of these components was installed. If you still can’t fully install everything, but you do see the blue shield in the notification area (next to the clock), right-click on it and choose Configure updating. Select the Logging tab and click the View Log File button. This file will describe what sorts of things are going wrong when you are downloading updates, which is the source of the vast majority of Sophos problems. Contact the Helpdesk if you are still unable to successfully install Sophos on your machine.

PC USERS ONLY

The new McAFee Virus DAT file is labeled 5004. Please download and install.

Problem:
Occasionally, Microsoft Windows fails to run the Mozilla Thunderbird process using its long filename. Since the names of the processes allowed to send data through TCP Port 25 are hardcoded into the McAfee preferences, this deviation from the normal setup is not allowed by default.

Summary:
Add the DOS 8.2 filename for thunderbird.exe into the McAfee preferences.

Procedure:

1. Right-click on the McAfee System Tray icon → Select VirusScan Console…
2. Double-click Access Protection.
3. Select Prevent mass mailing worms from sending mail. Be sure not to uncheck this box.
4. Click on the Edit button.
5. Add a comma at the end of the text box at the bottom of the window and then add THUNDE~1.exe. DO NOT PUT A SPACE BETWEEN THIS AND THE PREVIOUS ENTRY.
6. Click OK.
7. Click OK.
8. Close the VirusScan Console window.

After this has been completed, you should be able to send e-mail again from Thunderbird.

Virex 7.7 is available for Mac OS X computers. Click here to download the disk image. After downloading the disk image, double-click on it to open it and look inside for the “Virex.pkg” file. Double-click that file to install Virex 7.7.

This replaces Virex 7.2 and 7.6 and is compatible with OS X 10.4.

The 2005 Resnet CDROMs will be distributed to faculty and students in the next two weeks. These CDs contain the latest versions of McAfee antivirus software for Macintosh and Windows computers, spyware protection, recommended software, and guides to help you with your computing. If you do not get a CD, you can access all the content online at this link.

Update: Virex 7.7 is available. Go here to download it.

In light of the upcoming school year, we’re posting the antivirus software for Macintosh users. Until McAfee releases a new version of Virex for OS X, here is what’s needed, listed by operating system version:

• Mac OS X 10.4 or greater: Virex 7.2. Click on the link to download.
• Mac OS X 10.1.5 to 10.3.9: Virex 7.6. CLick on the link to download.

Virex 7.6 is the latest version, however it is incompatible with Mac OS X 10.4 (and all sub-version of 10.4). As a result, you should not load it, instead use the older version, Virex 7.2.

McAfee 8.0.0 Save to your desktop and double click to install. This is a two year subscription. This software has been tested on Windows XP. You must still use McAfee 4.5.1 for Windows 95/98/ME.

Spyware on your PC is a major threat to both privacy and productivity. We are seeing many PCs that have some form of spyware infestation, and the PCs that were infested had an average of 90 spyware programs in place. Fortunately there are good, free tools available that can remove the threat from your system and immunize against future infestations.

We recommend if running Windows 98/ME/XP that ALL Security Patches are loaded including Service Patch 2 for Windows XP etc…
Windows update site

Make sure you have the latest Virus Software loaded with latest definitions loaded:

Southwestern Information Technology Knowledge Base Virus Software Page

We also recommend downloading and running anti spyware programs listed below:

Spybot - Search & Destroy 1.3

Click here to dowload spybotsd13.exe from download.com

SpywareBlaster 3.2

Click here to dowload spywreblastersetup32.exe from download.com

Ad-Aware SE Personal Edition 1.05

Click here to dowload aawsepersonal.exe from download.com

Scan your system with Housecall at:

Click here to go to Housecall site, follow on-line instructions

Scan your system free with PestPatrol just to check if any spyware is left. To remove you do have to purchase PestPatrol software.

Click here to go to PestPatrol’s site, follow on-line instructions.
(more…)

McAfee 4.5.1 Save to your desktop and double click to install. This is a two year subscription.

Microsoft Security Site on Sasser

A new virus has been released effective May 3rd, 2004 that is called 32/Sasser.worm.a, this worm spreads by exploiting a recent Microsoft vulnerablity, spreading from machine to machine with no user intervention required. What this means is you do not have to open an attachment to get this virus it will attack your computer if you haven’t installed the latest Microsoft Windows patches. This is what ITS is recommending you do immediately to prevent our SU systems from being infected.

Your Windows XP PC should be patched with: Security Update for Windows XP (KB835732)
(more…)