<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Bookman Old Style";
panose-1:2 5 6 4 5 5 5 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.gd
{mso-style-name:gd;}
span.hb
{mso-style-name:hb;}
span.g2
{mso-style-name:g2;}
span.id
{mso-style-name:id;}
span.g3
{mso-style-name:g3;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>SEIU has informed us that the issue with the email virus I notified you about two weeks ago. Below is notification from their IT staff regarding the issue and confirmation that their website is virus-free. Please let your staff know as appropriate.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thank you for your patience.</span><span style='color:#1F497D'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> <o:p></o:p></span></p><p class=MsoNormal><b><span style='font-family:"Arial","sans-serif";color:purple'>Anna Sikel</span></b><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Office Manager</span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'>DAS, HRSD, Labor Relations Unit</span><span style='font-family:"Bookman Old Style","serif";color:#000040'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:black'>503-378-2616 desk</span><span style='font-family:"Bookman Old Style","serif";color:#000040'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";color:navy'>Data Classification: Level 1 Published </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Jeff Seekatz [mailto:seekatzj@seiu503.org] <br><b>Sent:</b> Wednesday, January 04, 2012 3:15 PM<br><b>To:</b> anna.sikel@state.or.us<br><b>Cc:</b> Mollie May<br><b>Subject:</b> SEIU Local 503 Website<o:p></o:p></span></p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>Anna,<br><br>Mollie asked me to send you an update on our website. Below is my notice to the DAS data Center folks about a half an hour ago and their reply back to me. The International (where our site is hosted) had a number of their web servers compromised. Our site now appears to be clean and that has also been confirmed by folks at the DAS Data Center. The IS Department here and the DAS Data Center folks will be monitoring our site closely.<br><br>Jeff<o:p></o:p></p><table class=MsoNormalTable border=0 cellpadding=0><tr><td style='padding:0in 0in 0in 0in'><table class=MsoNormalTable border=0 cellpadding=0><tr><td style='padding:0in 0in 0in 0in'><div><p class=MsoNormal><span class=gd><span style='color:#00681C'>John Ritchie</span></span> <span class=hb>to </span><span class=g2>mike.bushman</span><span class=hb>, </span><span class=g2>me</span><span class=hb>, </span><span class=g2>GATHERUM</span><span class=hb> </span><o:p></o:p></p></div></td></tr></table></td><td style='padding:0in 0in 0in 0in'><div><p class=MsoNormal><span class=id>show details</span> <span class=g3>2:51 PM (15 minutes ago)</span> <o:p></o:p></p></div></td><td style='padding:0in 0in 0in 0in'></td></tr></table><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Jeff,<br><br>Thank you for the update. We confirmed that the bad javascript areas we knew of have been cleaned up and it’s good to hear that the web admins have taken further hardening efforts to prevent this from happening in the future. It doesn’t sound like they found the root cause, but the measures they took may keep future attacks from being effective.<br><br>Mike, can you remove the block on the SEIU site? Let’s keep an eye out for more redirects to the bad site originating from SEIU, but it sounds like they’ve cleaned up the problem.<br><br>Regards,<br><br>John Ritchie<br><br><br>On 1/4/12 2:40 PM, "Jeff Seekatz" <<a href="http://seekatzj@seiu503.org/" target="_blank">seekatzj@seiu503.org</a>> wrote:<br><br>Hi All.<br><br>We received this message about an hour ago from the Tech folks at the International. We wanted to do our own checking this time so there has been some delay in getting back to you. We have confirmed that we see no redirect traffic emanating from the site. Please read their comments. It is almost exactly what we first reported with your help almost two weeks ago. I think it is appropriate to remove the block.<br><br>Please notify me ASAP if any suspicious activity reoccurs.<br><br>Jeff<br></span><br clear=all><br>-- <br>***************************************************<br>Jeff Seekatz<br>Information Systems Supervisor<br>SEIU Local 503, OPEU<br>1730 Commercial St SE<br>Salem Oregon 97302<br><br>Office - <a href="tel:503-581-1505%20Ext%20162" target="_blank">503-581-1505 Ext 162</a><br>Cell - <a href="tel:541-760-3125" target="_blank">541-760-3125</a><br>Fax - <a href="tel:503-581-1505" target="_blank">503-581-1505</a><o:p></o:p></p></div></body></html>