Virus strikes campus computer network

by Zachary Goldstein | 11/7/03 6:00am

A virus is plaguing the Dartmouth campus, but this time it's not pink eye. In this case, it's a computer virus called the Welchia worm, which has infected 2000 computers -- nearly half of all student computers on campus -- and is drastically slowing down the campus network.

In response, Director of Computing Larry Levine sent out a campus-wide BlitzMail yesterday instructing students of the steps necessary to diagnose and, if necessary, treat their computers for the virus. The e-mail also threatened to disconnect infected computers from the network if they are not cured by next Tuesday.

The worm infects a computer, but has no adverse effects visible to the user. However, an infected computer constantly send out "pings" over the network searching for other computers which it can infect. It is this abundant flood of ping activity that swamps the network, slowing down entire subnets, effectively allowing one infected computer to neutralize an entire building's network and Internet access. Wireless networks are particularly susceptible.

"Just one infected computer can screw up an entire building," Director of Network Services Bill Brawley said. "The intense pinging activity can prevent people who want to sign on to a building's wireless network from getting an IP address in that building."

Students with Apple computers are not susceptible to the Welchia virus and need not run the removal tool.

Because of the heavy stress the worm is causing to the network, students who have infected computers and who do not follow the simple steps necessary to disinfect their computer will have their network access privileges revoked until they remove the worm from their system.

"Should the network's performance continue to suffer, we will be forced to deny access to machines that are abusing, however unintentionally, the network," the e-mail warned. "We do not want to turn off your network access but we will to protect the integrity of the network. Please take the steps outlined above as we will begin a process of disconnections beginning on Tuesday, November 11, 2003."

Brawley said that denying Internet access to any student is a last resort, but that it would be necessary for the integrity of the network if students do not solve the problem themselves.

"We want to work with people to get this cleaned up," Brawley said. "We are just really hoping that everyone gets the message and takes a few minutes to check their computer."

The campus e-mail also implored students to take additional steps after checking for and removing the virus from their computers. Windows users should "configure your Windows operating system to automatically update itself when critical Windows patches are released," the e-mail said.

Additionally, links were given to free downloads of Symantec Norton Anti-Virus software for both Mac and PC users. In previous year the anti-virus software has been offered to the community at a nominal fee -- last year just six dollars -- but this year Computing Services decided to provide the program free of charge. Brawley pointed out that once the anti-virus software is being used it is also important to download updated virus definitions regularly -- which the software can be set to do automatically.

The Welchia worm diagnosis and removal tool can be downloaded at www.dartmouth.edu/~comp/support/library/software/viruses/welchia.htm.

Instructions to set up Windows computers to automatically download system patches can be found at www.dartmouth.edu/~helpdesk.

Norton Anti-Virus software for Windows can be downloaded free of charge at www.dartmouth.edu/~comp/resources/downloads/win/productivity/sav.html, and for Macintosh users at www.dartmouth.edu/~comp/resources/downloads/mac/productivity.