Procedure following discovery of a virus on a computer attached to ResNet

Through the Intrusion Detection System and other network monitoring we perform, we may notice a virus-infected computer on the network via its attempts to infect other systems. This procedure is followed where web believe a virus-infected computer is a threat to other computers on the network.

1. We disable the network connection for the infected system immediately to prevent the virus spreading and protect other network users. If the infected system is used by a member of the University, this disconnection will remain in place until the system has been cleaned and a reconnection fee paid (steps below). If the system is used by a temporary or guest user disconnection is permanent with no possibility of reconnection to ResNet and no refund of subscription fees.
2. We notify the user concerned by email that their computer is infected by a virus and has been disconnected. They can still access their email and other computing facilities in the public computer rooms around the University.
3. We can often help students disinfect their systems at the Student Laptop Clinic.
4. Once the virus is removed, the user must install anti-virus software and ensure it is up to date.
5. We charge a reconnection fee of 15 pounds which must be paid before a previously virus-infected system is reconnected to ResNet. This fee is a contribution to the cost of the work caused by each virus infection. It also acts as a deterrent to encourage users to secure their computers. It can be paid in person at the  help desk.
6. Once the reconnection fee has been paid, the user will need to telephone the help desk while at their computer. We make a few checks over the phone and will then re-enable the connection.
7. Once re-enabled the user will need to visit WindowsUpdate <http://update.microsoft.com> and install all critical updates and service packs to protect their computer.