X-Message-Index: 006
X-Message-Prev: 383
X-Message-Next: 005
X-Thread-Prev: 003
X-Thread-Next: 009
From: Edward Vielmetti <emv@starbarlounge.cc.umich.edu>
To: [not phage]
X-To: bostic@okeeffe.Berkeley.EDU (Keith Bostic), cic@relay.cs.net, csg@pyramid.com, fair@ucbarpa.Berkeley.EDU,       aburt%isis.uucp, jeff@gatech.edu, jrs, kcs, lp@decvax.dec.com,       mckay@harbor.ecn.purdue.edu, narten,       nntp-managers@ucbarpa.Berkeley.EDU, nrh@bellcore.com,       pleasant@rutgers.edu, postmaster@amdahl.amdahl.com,       postmaster@hplabs.hp.com, postmaster@husc6.harvard.edu,       postmaster@mcnc.org, postmaster@ms.uky.edu, postmaster@relay.cs.net,       postmaster@ucsd.edu, rick@seismo.css.gov, rsk, smb@ulysses.att.com,       spaf, stjohns@ddn1.arpa, systems, trinkle, vixie@decwrl.dec.com,       woods@handies.ucar.edu, neil%zardoz.uucp
Subject: Re: Yet more on the virus
Date: Thu, 03 Nov 88 18:46:28 -0500
X-Date: Thu 18:46:28 03/11/1988 EST

I would suggest that you use the following order to clean out
the virus from your network, based on the fact that the
thing seems to hit hosts in the order of the /etc/hosts file.

Clean out 128.xxx.1.1 first, then 128.xxx.1.2, etc, making sure
that each one is safe down the line.  Fix hosts that are in the
nic published tables first. 


While you're at it, turn off anonymous FTP on your systems.