Background
A new worm is spreading on campus. The worm has spread primarily through infected flash drives. The worm uses the Windows autorun capability to initiate the process. Once started, the worm attempts to copy itself to all drives on a system and enables autorun for each drive. The current variation of the worm does little damage to a system. The effects of the worm are a change to the title bar of Internet Explorer to include "GSPI" and disabling of the registry editor.
Symantec released virus definitions on 04-22-2008 that detect the worm as VBS.Autill. However, while Symantec deletes the program that spreads the worm, it does not remediate any of the changes to the infected system.
Action
If you notice the title bar in Internet Explorer includes "GSPI", your system has been infected. TSS has posted a script written by staff in Engineering that will clean the effects of the worm. The script requires the use of ONID credentials to download:
https://tss.oregonstate.edu/sav/GSDIWorm_Removal.vbs
Please either download and run the above linked script or contact the helpdesk for assistance.