After hitting Brian Tuckers Blog for a look see, and then getting directed to Tim Minters, I found a happy ending article to a patch deployment story. Its nice when a company can be protected with knowledgeable system admins and that it can be done quickly and painlessly.
But folks, its not always this simple.
If you work in an GLP (Good Lab Practices) and/or FDA regulated place, its sad to say but, patching takes longer. If you work in an ISO certified environment it could take even longer, updating SOP's and documentation and test scripts can become a nightmare. In fact, I guarantee, this is why some large corporations got hit as bad as they did with this last one. Not all shops are blessed with SMS or security admins that can do the kind of things we do everyday, but I bet a lot of folks got handcuffed into staying un-patched or backed rev'ed on service packs. Lets face it though, if you were at SP4, you had to act pretty darn quick (less than a week to test/deploy/update SOP's or working instructions) to stay ahead of the infection hitting your corporate LAN.
Hand-cuffing happens in large places where a myriad of vendors have applications that cannot operate on a certain SP level. Ok, Ok, any tech worth their weight in Gold knows this is BS, but these vendors suffer from the same political game that the shops where their software is deployed suffer from, lack of time and or initiative to update the code or test plans to work at a new SP level. Hence the vendor tells the 'Vendee' “Sorry but if you update to SP4 or even SP3, we cannot support you”, so they stay at SP2 and get hosed a year later with sasser or some other new wave virus.
Knowing how to use the tools at hand, you as an Admin can at least tell your shop of the threat. It only took seven days this time people, be aware, be vigilant be outspoken to management. Its not always this simple, except for the virus creators, they know large business have these invisible handcuffs.