# MA-041.052002: MyCERT Advisory - Computer Worm Incident Handling Standard Operating Procedure

**Date:** 02 May 2002  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-041.052002  
**Advisory ID:** MA-041.052002

---

MyCERT received a growing number of Computer Worms Incidents reported primarily since August 2001, there are more organizations that are spending endless hours repeating processes that are non effective in completely eradicating the worm within the network due to uncoordinated effort within the organization.
Due to the nature of email-borne worms and/or internet-borne worms, which replicates via more than one means of propagation, i.e. via email, unauthenticated folder sharing and network scanning, MyCERT is providing the procedure in handling mass worm infection incidents especially within medium to large organizations distributed networks. Most organizations in which the network is physically distributed in multi level facilities, worm problems are difficult to eradicate if the problem is not dealt with in a coordinated manner.
MyCERT is proposing organizations that are facing these problems to form an operation center. The Worm Incident Handling Standard Operating Procedure is as shown in Diagram 1.