[Dshield] MS SUS (formerly Mydoom (A, B) and Doomjuice.A Worm Removal Tool (KB836528), 2/13/2004)

Micheal Patterson micheal at tsgincorporated.com
Sun Feb 15 01:29:23 GMT 2004



----- Original Message ----- 
From: "Josh Tolley" <josh at raintreeinc.com>
To: "General DShield Discussion List" <list at dshield.org>
Sent: Saturday, February 14, 2004 5:43 PM
Subject: [Dshield] MS SUS (formerly Mydoom (A, B) and Doomjuice.A Worm
Removal Tool (KB836528), 2/13/2004)


> On a side note, and mostly to fulfill personal curiosity -- of those of
> you in Windows shops, how many have tried, experimented with,
> considered, hated, given up on, loved, installed, etc. Microsoft's SUS?
> I've thought about it, but other priorities haven't let me do much with
> it. What's it take to install, configure, use, manage, etc.?
>
> Josh Tolley
>
> Micheal Patterson wrote:
>
> > Oh, this is nice. MS has a removal tool for *doom* trojans. It only
shows up
> > if you need to remove the item. It's also available for the SUS servers
as
> > well. This is actually not a bad move in my opinion, with the exception
of
> > one small item.
>
> -- the rest removed for brevity --
>
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list

An IIS server, and some disk space to store the updates is what you need to
run it. Of course, it helps to have an AD domain so you can configure your
group policy to point updates to the sus server. I'm not certain, but I
don't think that NT's domain services allow for the necessary reg entries to
pass to the domain clients. BUT, I'll admit, I could be wrong on that.

--

Micheal Patterson
Network Administration
TSG Incorporated
405-917-0600




More information about the list mailing list