[prev in list] [next in list] [prev in thread] [next in thread] 

List:       focus-virus
Subject:    RE: Microsoft mydoom removal tool via SUS
From:       "Dan Denton" <ddenton () PAYLESSOFFICE ! com>
Date:       2004-08-11 20:03:22
Message-ID: 2BF76EF9C289D046B3E7B9E20F9B064298778B () mail ! paylessoffice ! com
[Download RAW message or body]

Thanks to all who replied. I think this answered my question pretty
well. It would be nice if MS changed the verbage in the description when
they distribute these updates to remove the "you are likely infected"
portion, but who knows when or if that will happen. Thanks again...

-----Original Message-----
From: Zack Schiel [mailto:ZSchiel@blueandco.com] 
Sent: Wednesday, August 11, 2004 2:58 PM
To: Dan Denton; Eric McCarty; focus-virus@securityfocus.com
Subject: RE: Microsoft mydoom removal tool via SUS


*All* updates that MS sends out for distribution via SUS will show up
for approval in *all* SUS servers; it shouldn't trouble you that it
shows up in the list.  
 
-Z-

	-----Original Message----- 
	From: Dan Denton [mailto:ddenton@PAYLESSOFFICE.com] 
	Sent: Wed 8/11/2004 10:01 AM 
	To: Eric McCarty; focus-virus@securityfocus.com 
	Cc: 
	Subject: RE: Microsoft mydoom removal tool via SUS
	
	

	I never approved the update. The fact that it even shows up in
the list 
	of updates to approve it what troubles me. 

	-----Original Message----- 
	From: Eric McCarty [mailto:eric@lawmpd.com] 
	Sent: Wednesday, August 11, 2004 9:57 AM 
	To: Dan Denton; focus-virus@securityfocus.com 
	Subject: RE: Microsoft mydoom removal tool via SUS 


	If you approve it for update in SUS Admin it will deploy it
whether 
	workstations are infected or not. Uncheck it in the Approved
updates 
	section and it will no longer be an issue. 

	Eric 

	-----Original Message----- 
	From: Dan Denton [mailto:ddenton@PAYLESSOFFICE.com] 
	Sent: Wednesday, August 11, 2004 7:42 AM 
	To: focus-virus@securityfocus.com 
	Subject: Microsoft mydoom removal tool via SUS 

	We use SUS to distribute updates to our workstations and one of
the 
	updates that frequently shows up is the Mydoom removal tool. The

	description says that the appearance of this update is a sign of

	infection, but none of my systems show infection in Symantec's
SSC, and 
	Eeye's mydoom scanner shows nothing as well. Has anyone else had
this 
	issue? I assume at this point that it's a false positive, but
I'm 
	checking all my bases. 

	I apologize if this post is better suited to focus-ms. 

	Dan Denton 
	Information Technology Manager, CCNA 
	Pay-LESS Office Products 


[prev in list] [next in list] [prev in thread] [next in thread]