Data on the HMI server was being corrupted, this data caused the system to slow and eventually stop. On investigation, it was discovered that the R&T server (in the same domain) had been infected and was totally unusable - unlike the control servers which were partially damaged. The virus was identified as Remote Explorer.

The virus was cleaned over a period of a week and anti-virus was then added to the control system and R&T servers.

A group of 7 people spent the week cleaning, rechecking, re-cleaning and installing anti-virus software. This prevented the normal day to day work being carried out and delayed a commissioning job of a new plant.

There were problems with ownership of the problem with a recently outsourced IT team.

Later conversations with other companies in the group indicated that this had been a wide spread issue on the corporate network but this information was never passed on.