DoN. Nichols wrote:
According to Jon Elson :
Well, once informed that they have a compromised system, it is their DUTY to
get it disconnected, disinfected and cleaned up!


That appears to be just what they have done -- once they got in
on Monday and discovered what had been running. The people who
perpetrate these things like to start on late Friday night to get the
maximum time before the admin staff is back to deal with the problem.
Our University Network administrators pass a beeper around, and
somebody is always on call. They can log in and take a machine
off the outbound firewall's OK list if it goes haywire. Any
place with at least a couple hundred machines should be required
to have similar staffing. Especially with student-owned
computers on their internal net, this is going to happen every
couple days, at least.

Jon