Double-Click “ruin_my_computer.exe” To Continue
During the last year — though it seems like much longer — I took charge of the Information Technology/Security group at work. What I’ve learned thus far is that much of the work arises when users do something absolutely ridiculous. The thing that constantly amazes me is how often people infect their systems with a virus/worm/trojan out of sheer curiosity (or sheer something-else.)
Running a network is difficult because there’s always a trade-off between convenience and security. Security is seen as an impediment to productivity, and so that trade-off ends up being entirely skewed toward convenience.
When people are able to access webmail or mail from any other servers out of my control, the skies open up and trash comes tumbling down. Our particular W32.Mydoom outbreak was limited to a mere four regular suspects people, but surely could have been worse had I not tightened up the mail server some months ago (before I took over, the mail server had no virus scanning protection whatsoever; but that’s another story).
So, for the sake of your Systems Administrator (and for the sake of your reputation), do not open a zip file and execute the enticing but obviously scandalous executable file. Rumour has it that I’ll take my sweet time sending someone over to fix it.

Entry Title
Publish Date
Category Tags
Related Entries
Comments
Dennis,
One of the things I’ve found helpful is to create software restriction policies in AD for my WinXP Pro clients. I not only restrict the file names of the most common virii and worms, but I also make a point of obtaining copies so that I can generate signatures that prevent the file from being launched even if the name changes.
It’s a bit of work, but man can it prevent grief down the road. My sympathies to you if the majority of your client workstations are non XP.
A lot of them aren’t XP, unfortunately (never thought I’d say that). I’ll take a look at your suggestion, though; sounds promising.
Here are a few hits from my bookmarks for you:
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
http://support.microsoft.com/default.aspx?kbid=310791
http://support.microsoft.com/default.aspx?scid=kb;en-us;324036
Plz feel free to e-mail me if you have any specific questions!