Product

• InSite
• Link
• PANDORA
• Prepare
• PREPS
• PressTouch
• PRINERGY
• PRINERGY Evo
• PRINERGY Powerpack
• UPFRONT

Operating system

Windows 2000

Symptoms

A virus called Backdoor.Sdbot.AT is severely affecting some Kodak GCG customers. Symantec has recently released new virus definitions as of June 20, 2006. We strongly recommend that you apply the new virus definitions to Microsoft Windows-based Kodak workflow servers and run a full scan at your earliest convenience.

If you are not running any antivirus software, we strongly suggest that you purchase Symantec AntiVirus Corporate Edition (CE) version 10 and follow the eCentral instructions for installing Symantec AntiVirus.

Some Kodak sites have reported the following symptoms with Backdoor.Sdbot.AT-infected servers:

• In Kodak Prinergy Administrator, the infected servers appear to be unavailable.
• Prinergy Workshop client computers connecting to an infected Prinergy primary server are disconnected with a Corba error and are unable to reconnect.
• Users are unable to log on to rebooted computers and a Supplied credentials conflict with existing set of credentials message appears.
• Some user shares from an infected server disappear from the network.
• Administrative hidden shares disappear from the infected server.
• In an active directory, an infected server's account may be locked out because of too many logon attempts. This may be due to failed user attempts to log on, not to virus logon attempts.
• The Prinergy workflow will not operate.

Solution

To download the installation instructions for Symantec AntiVirus:

1. Go to https://ecentral.creo.com/
2. Select Self Support > Product Documentation.
3. In the Search box, type Symantec.
4. Select the document called Installing Symantec Antivirus Workflows Systems.

To determine whether you have the latest Symantec virus definitions:

1. Select Start > Programs > Symantec Client Security > Symantec Antivirus Client.
2. Under Virus Definition File, ensure that the date is 6/20/2006 or later.

If you have trouble running LiveUpdate, you can manually download the new Symantec virus definitions.

To manually download the latest Symantec virus definitions:

1. On a clean system, go to http://securityresponse.symantec.com/.
2. Under Virus Definitions, click Download Virus Definitions Manually.
3. Click Download Virus Definitions (Intelligent Updater Only).
4. Select the language for your operating system, select the anti-virus type (for workflow servers, it is typically Symantec AntiVirus Corporate Edition), and then click Download Updates.
5. Select your operating system and anti-virus type. (Typically, it is the 32-bit .exe version.)
6. Download the update to your hard drive and then run it.
7. To make sure the virus definitions were downloaded, check the date of your virus definitions. (Select Start > Programs > Symantec Client Security > Symantec Antivirus Client, and ensure that the date under Virus Definition File is June 20, 2006, or later.)

Recovery

Running Symantec AntiVirus will likely not be enough to clean the virus from your server. We recommend that you also take these actions:

1. Disconnect the network cable to remove the infected server from the network.
2. Follow the Backdoor.Sdbot.ATremoval instructions at http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbot.at.html .
   Please note:
   • The Symantec instructions recommend setting Internet Connection Sharing (ICS) service to Automatic. However, Windows-based Kodak workflow systems do not require a level higher than Manual. It is acceptable to use the Automatic or Manual setting.
   • Some Kodak sites have had to manually set Remote Registry Service to Automatic.
3. Call the Kodak Response Center and report what happened at your site.

Technical contact(s)

Derek Braendel

Submitted by

Derek Braendel

Date submitted

22 Jun 2006