# Veterans Benefits Administration IRM HB 5.05.02.HB2

Department of Veterans Affairs March 31, 1999

Washington, DC 20420

## VBA IRM Handbook No. 5.05.02.HB2, Change 1

Computer Virus Detection, Removal and Recovery

**POLICY:** This change clarifies procedures for reporting computer
virus incidents within VBA. In order to consolidate reports of these
incidents, it is important that all incidents be reported to one
location.

**[WHO (Actor)]{.underline} [ACTION]{.underline}**

Facility ISO (Formerly Facility AIS Security Officer) All suspected
virus incidents are to be

> reported as they occur to
>
> the Information Technology Support Center (ITSC) Helpdesk in
> Philadelphia.

Information Technology The virus reports will be promptly forwarded by
the

Support Center (ITSC) ITSC to the Hines Configuration Management

> and Security Team and the Systems Implementation Division.
>
> Each month, the virus incident reports will be documented and
> forwarded to Information Security Program Coordination Team (20S) for
> review and action, as required by OMB Circular A-130, Appendix III.

All other procedures listed in VBA IRM Handbooks Nos. 5.01.01.HB2,
Incident Reporting, and 5.05.02.HB2, Computer Virus Detection, Removal
and Recovery, remain in effect.

**REFERENCES**

VBA IRM Directive No. 5.00.01, VBA Information Security Program.

VBA IRM Handbook No. 5.01.01.HB2, Incident Reporting.

VBA IRM Handbook No. 5.05.02.HB2, Computer Virus Detection, Removal and
Recovery.

OMB Circular A-130, Appendix III.

**Proponent Organization:** Questions regarding this change should be
directed to the Information Security Program Coordination Team (20S) on
(202) 273-7122 or 6930.

**NOTICE:** Place this change in Part II of M20-4, behind Tab 5.0,
Information Security Management.

**IMPLEMENTATION DATE:** Immediately upon receipt.

By Direction of the Under Secretary for Benefits

William D. Stinger

Acting Chief Information Officer

+-----------------------------------------------------------------------+
| VBA IRM Handbook No. 5.05.02.HB2                                      |
|                                                                       |
| Computer Virus Detection, Removal and Recovery                        |
+-----------------------------------------------------------------------+

  -----------------------------------------------------------------------
  This handbook contains the procedures that the proponent organization,
  the Information Resources Management (IRM) Quality Assurance, Security
  and Contingency Planning Division (20M12), has developed to implement
  *VBA IRM Policy Directive No. 5.05.02*. Appendix 1 relays how to detect
  viruses. Appendix 2 describes how to remove and recover from viruses.
  Appendix 3 contains descriptions of computer virus types. Appendix 4
  contains the computer virus incident report. You may direct any
  questions or comments concerning these procedures to the proponent
  organization.

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------
  VBA employees using VBA automated information systems connected to
  personal computers, including local area networks (LANS), wide area
  networks (WANS) and telecommunications systems, who detect or suspect
  the presence of computer viruses or other malicious code in those
  systems will follow these procedures.

  -----------------------------------------------------------------------

+----+---------------------+----+-------------------------------------+
|    | [WHO                |    | [ACTION]{.underline}                |
|    | (                   |    |                                     |
|    | Actor)]{.underline} |    |                                     |
+----+---------------------+----+-------------------------------------+
| !  | All VBA employees   |    | a.  Follow the steps listed in *VBA |
| [] | who use Automated   |    |     IRM Handbook No. 5.05.02 HB1*   |
| (m | Information Systems |    |     and any additional anti-virus   |
| ed | *(including         |    |     procedures established by your  |
| ia | contractor          |    |     managers.                       |
| /i | personnel*)         |    |                                     |
| ma |                     |    | b.  In addition to using anti-virus |
| ge |                     |    |     tools, be alert for common      |
| 1. |                     |    |     symptoms of virus infection.    |
| em |                     |    |     (See Appendix 1).               |
| f) |                     |    |                                     |
|    |                     |    | c.  [IF YOU DETECT OR SUSPECT A     |
|    |                     |    |     VIRUS:]{.underline}             |
|    |                     |    |                                     |
|    |                     |    | ```{=html}                          |
|    |                     |    | <!-- -->                            |
|    |                     |    | ```                                 |
|    |                     |    | (1) Save the information you are    |
|    |                     |    |     working on and [turn off your   |
|    |                     |    |     computer]{.underline}.          |
|    |                     |    |                                     |
|    |                     |    | (2) Notify your supervisor          |
|    |                     |    |     immediately.                    |
|    |                     |    |                                     |
|    |                     |    | (3) Use Appendix 2 of this          |
|    |                     |    |     handbook.                       |
+----+---------------------+----+-------------------------------------+
|    |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
|    |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
|    |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
|    | [WHO                |    | [ACTION]{.underline}                |
|    | (                   |    |                                     |
|    | Actor)]{.underline} |    |                                     |
+----+---------------------+----+-------------------------------------+
| !  | First Line          |    | a\. Ensure that the user is         |
| [] | Supervisor          |    | following the steps outlined in     |
| (m |                     |    | Appendix 2 of this handbook.        |
| ed |                     |    |                                     |
| ia |                     |    |                                     |
| /i |                     |    |                                     |
| ma |                     |    |                                     |
| ge |                     |    |                                     |
| 2. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
|    |                     |    | b\. Contact the facility's          |
|    |                     |    | automated information systems (AIS) |
|    |                     |    | Security Officer immediately and    |
|    |                     |    | obtain his/her assistance as        |
|    |                     |    | needed. (In Central Office, contact |
|    |                     |    | 20M12 for assistance as needed.)    |
+----+---------------------+----+-------------------------------------+
|    |                     |    | c\. Inform your manager             |
|    |                     |    | immediately.                        |
+----+---------------------+----+-------------------------------------+
|    |                     |    | d\. [IF YOU AND THE EMPLOYEE        |
|    |                     |    | DETERMINE THAT THERE IS NO          |
|    |                     |    | VIRUS:]{.underline}                 |
|    |                     |    |                                     |
|    |                     |    | (1) Inform the AIS Security         |
|    |                     |    |     Officer.                        |
|    |                     |    |                                     |
|    |                     |    | (2) Inform your manager.            |
|    |                     |    |                                     |
|    |                     |    | (3) Report the computer symptoms to |
|    |                     |    |     the facility technical          |
|    |                     |    |     maintenance representative.     |
|    |                     |    |     \[This will be the Automated    |
|    |                     |    |     Resource Manager or Sector Site |
|    |                     |    |     Manager in VBA field sites. In  |
|    |                     |    |     Central Office, contact the     |
|    |                     |    |     Customer Support Division       |
|    |                     |    |     (20M32)\].                      |
+----+---------------------+----+-------------------------------------+
|    |                     |    | e\. [IF YOU AND THE EMPLOYEE        |
|    |                     |    | DETERMINE THAT THERE IS A           |
|    |                     |    | VIRUS:]{.underline}                 |
|    |                     |    |                                     |
|    |                     |    | (1) Complete the steps outlined in  |
|    |                     |    |     Appendix 2 of this handbook.    |
|    |                     |    |                                     |
|    |                     |    | (2) Assist the employee with the    |
|    |                     |    |     Virus Incident Report (see      |
|    |                     |    |     Appendix 4). Give a copy to the |
|    |                     |    |     facility AIS Security Officer   |
|    |                     |    |     and a copy to your manager.     |
|    |                     |    |                                     |
|    |                     |    | (3) Resume normal operations.       |
|    |                     |    |     Continue to exercise anti-virus |
|    |                     |    |     procedures as described in *VBA |
|    |                     |    |     IRM Handbook No. 5.05.02.HB1.*  |
+----+---------------------+----+-------------------------------------+
|    | [WHO                |    | [ACTION]{.underline}                |
|    | (                   |    |                                     |
|    | Actor)]{.underline} |    |                                     |
+----+---------------------+----+-------------------------------------+
| !  | Facility AIS        |    | a\. Check to see that the employee  |
| [] | Security Officer    |    | and first line supervisor used the  |
| (m | (*Director, 20M12,  |    | most up-to-date virus tools         |
| ed | for VACO)*          |    | available at the facility.          |
| ia |                     |    |                                     |
| /i |                     |    |                                     |
| ma |                     |    |                                     |
| ge |                     |    |                                     |
| 3. |                     |    |                                     |
| em |                     |    |                                     |
| f) |                     |    |                                     |
+----+---------------------+----+-------------------------------------+
|    |                     |    | b\. Ensure that the employee and    |
|    |                     |    | supervisor followed the steps       |
|    |                     |    | outlined in Appendix 2 of this      |
|    |                     |    | handbook.                           |
+----+---------------------+----+-------------------------------------+
|    |                     |    | c\. Assist the employee and first   |
|    |                     |    | line supervisor if they have any    |
|    |                     |    | problems following Appendix 2 of    |
|    |                     |    | this handbook.                      |
+----+---------------------+----+-------------------------------------+
|    |                     |    | d\. Forward the completed Virus     |
|    |                     |    | Incident Report (see Appendix 4) to |
|    |                     |    | the IRM Quality Assurance, Security |
|    |                     |    | and Contingency Planning Division   |
|    |                     |    | (20M12) within 24 hours of the      |
|    |                     |    | incident.                           |
+----+---------------------+----+-------------------------------------+

  ----------------------- --------------------- ----- --------------------------------------
  ![](media/image4.emf)   VBA Managers *(whose        Ensure that the AIS Security Officer
                          organizations use           forwards the completed Virus Incident
                          automated information       Report to 20M12 within 24 hours of the
                          systems)*                   incident.

  ----------------------- --------------------- ----- --------------------------------------

  ----------------------- --------------------- ----- --------------------------------------
  ![](media/image5.emf)   Director, 20M12             Review Virus Incident Reports and
                                                      report all occurrences of computer
                                                      viruses to the Director, 20M.

  ----------------------- --------------------- ----- --------------------------------------

![](media/image6.emf)

This handbook is approved. It will be used to implement *VBA IRM Policy
Directive No.* *5.05.02* of *VBA Manual M20-4*. Place it in *Part II of
M20-4* behind *Tab 5.0, Security.*

> By Direction of the Under Secretary for Benefits
>
> /S/ ORIGINAL SIGNED
>
> Rhoda Mancher
>
> Director
>
> Office of Information Technology

+-----------------------------------------------------------------------+
| Appendix 1                                                            |
|                                                                       |
| How To Detect Viruses                                                 |
+-----------------------------------------------------------------------+

  -----------------------------------------------------------------------
  Early virus detection is crucial to prevent widespread infection of
  PC-connected VBA automated information systems, to include local area
  networks (LANS), wide-area networks (WANS) and telecommunications
  systems.

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------
  You may direct any questions or comments concerning this appendix to
  the Director, IRM Quality Assurance, Security and Contingency Planning
  Division (20M12).

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------
  Use anti-virus tools to scan all software and remain alert for the
  following common symptoms of computer virus infection:

  -----------------------------------------------------------------------

  ------------------------ -----------------------------------------------------------------
                           [ACTION]{.underline}

  ![](media/image7.emf)    Unfamiliar graphics or messages on the screen or other unusual
                           screen activity (e.g. letters begin to drop to the bottom of the
                           screen).

  ![](media/image8.emf)    Unusually long time periods for loading and executing programs.

  ![](media/image9.emf)    Noticeably longer time periods for disk access, processing and
                           system operation.

  ![](media/image10.emf)   Altered volume labels.

  ![](media/image11.emf)   Unusual, frequent or inappropriate messages.

  ![](media/image12.emf)   Unexplained reduction in memory or disk space.

  ![](media/image13.emf)   Changes in file data and time stamps for no apparent reason.

  ![](media/image14.emf)   Mysteriously disappearing programs or replacements of files with
                           unknown objects or garbled data or other symbols.

  ![](media/image15.emf)   Blinking of access lights for drives or other devices that are
                           not in use.

  ![](media/image16.emf)   Execution failures for programs.

  ![](media/image17.emf)   Changes in size of executable programs for no apparent reason.

                           [ACTION]{.underline}

  ![](media/image18.emf)   Consistently out-of-balance data (in systems using such internal
                           controls).

  ![](media/image19.emf)   Activation of obsolete user accounts.

  ![](media/image20.emf)   Unusual network activity.
  ------------------------ -----------------------------------------------------------------

If you experience any of the above symptoms, save the information you
are working on and turn off your computer. Start the virus removal and
recovery steps outlined in Appendix 2 of this handbook.

> NOTE: Some of these items may be indicative of systems problems and
> not of viruses.

Appendix 2

How to Remove and Recover From Viruses

Virus prevention and detection are the first and second stages of an
effective anti-virus program. This section lists the steps you should
take when you find or suspect that your personal computer and diskettes
are infected.

You may direct any questions or comments concerning this appendix to the
Director, IRM Quality Assurance, Security and Contingency Planning
Division (20M12).

  ------------------------ -----------------------------------------------------------------
                           [ACTION]{.underline}

  ![](media/image21.emf)   Save the information you are working on and turn off your
                           computer.

  ![](media/image22.emf)   Notify your supervisor immediately. Warn other users that your
                           computer is infected. They should not use it. Use a "keep off"
                           sign if needed.

  ![](media/image23.emf)   Boot your system using a write-protected backup (See Appendix 1
                           of *VBA IRM Handbook 5.05.02.HB1).* Do not use your original
                           program diskette.

  ![](media/image24.emf)   Scan your computer hard disk and all disk drives using an
                           anti-virus tool.

  ![](media/image25.emf)   Repair (or delete) any infected files.

  ![](media/image26.emf)   Scan your hard disk again.

  ![](media/image27.emf)   Scan all (each and every) floppy diskette used on the infected
                           computer or that might have been used on the computer.

  ![](media/image28.emf)   Repair (or delete) any infected files found on the diskettes.

  ![](media/image29.emf)   Isolate infected diskettes and scan them again. The same virus
                           can infect your hard disk or your floppy diskettes several times.
  ------------------------ -----------------------------------------------------------------

> NOTE: Anti-virus programs that remove virus infection from diskettes
> might also remove original program code. Make sure you make and keep
> clean backups of data and program disks.

Appendix 3

Types of Computer Viruses

You may direct any questions or comments concerning this appendix to the
Director, IRM Quality Assurance, Security and Contingency Planning
Division (20M12).

APPLICATION SOFTWARE VIRUSES (Also known as PROGRAM VIRUSES):

Generic viruses that attack a ".COM", ".EXE", or ".SYS" file by
inserting themselves (or placing themselves in front or behind) an
executable or overlay file. Application software viruses are troublesome
because the original application program runs "normally" when infected
files are executed, making this kind of virus difficult to detect.

BOOT SECTOR VIRUSES: Boot sector viruses substitute themselves for the
boot sector program found on operating systems disks. This type of
malicious code hides on or embeds itself into the first sector of a hard
disk and loads itself into memory each time the system initialization
(system booting or "boot up") occurs. Boot sector viruses are
transmitted to hard disks by infected diskettes or by infected programs
downloaded from Electronic Bulletin Boards.

NEW GENERATION VIRUSES (Also known as STEALTH VIRUSES): These viruses
contain built-in avoidance of virus detection software and devices. This
type of virus installs itself as a memory resident program that bypasses
DOS interrupt vectors and directs access instead to the ROM BIOS disk
I/O routine. In doing so, these new generation viruses are able to avoid
checksum algorithms and anti-virus software monitoring.

Appendix 4

Computer Virus Incident Report

You may direct any questions or comments concerning this appendix to the
Director, IRM Quality Assurance, Security and Contingency Planning
Division (20M12).

Forward the following information to 20M12 within 24 hours of the
incident. You may relay the information by phone or forward it by FAX,
ATTN: Director, 20M12.

Name

Title/Position

Organization/Station

Office Symbol

Phone

Date and Time Virus was Detected/By Whom

How Virus was Removed (Software or Method Used)/By Whom

Number/Type of Systems Scanned

Number of Diskettes Scanned/Cleared

Name of AIS Security Officer

AIS Security Officer's Office Symbol

AIS Security Officer's Phone