Prevent task creation

[hipsterdoofus]

Hello all. We have been experiencing at our libraries some programs, possibly malware installing. Our antivirus catches them and deletes, however, they are still able to create scheduled tasks that look for certain dll's. What we end up with are annoying messages on those computers until we end the tasks. So far we've had 2 of these that are similar: Cakebake and PopGames.

 

My understanding is that with XP, there was a group policy to prevent task creation, but there isn't with Windows 7. Overall, our computers are quite locked down, but would really like to prevent this from happening. Any suggestions?

[Steve21]

As far as I know you can only disable tasks completely but that's not exactly a good idea.

 

If it's being installed though it sounds like something isn't locked down properly, as normally those ones you mentioned are bundled with rubbish, and if they are able to install the "original program" they'll install the rubbish.

 

Do the normal users have admin rights or something?

 

Steve

[hipsterdoofus]

As far as I know you can only disable tasks completely but that's not exactly a good idea.

 

If it's being installed though it sounds like something isn't locked down properly, as normally those ones you mentioned are bundled with rubbish, and if they are able to install the "original program" they'll install the rubbish.

 

Do the normal users have admin rights or something?

 

Steve

 

Absolutely not! I give no one admin rights! I have quite a few policies on these machines, but apparently a regular user is able to create a task in Win 7.

[Steve21]

Creating it via what? If control panel's logged down/restricted etc.

 

WebCake (Cakebake) comes bundled as part of free software, so unless someone is installing software and has rights to do so it shouldn't get installed in the first place is what I meant in regards to the admin rights.

 

It also installs a Service by default to Update itself which shouldn't be able to be installed

 

Steve

[hipsterdoofus]

Creating it via what? If control panel's logged down/restricted etc.

 

WebCake (Cakebake) comes bundled as part of free software, so unless someone is installing software and has rights to do so it shouldn't get installed in the first place is what I meant in regards to the admin rights.

 

It also installs a Service by default to Update itself which shouldn't be able to be installed

 

Steve

 

 

I assure you that none of them have admin rights. The users also do not have access to the control panel. It isn't being created by the user manually, rather I think it is something that webcake is doing when downloaded. Again, the dll can't be found afterwards, so I think our AV software catches that, but the task is still made programatically.

[ADMaster]

1 are you using app locker or SRP, if not a user can install stuff in their own profile.

2 what program is the task calling to check for the dll and display the message? Try blocking or deleting that program.

3 If the task has a consistent name and isn't random rubbish each install, delete the task with GPO.

 

Hope this helps.

[hipsterdoofus]

1 are you using app locker or SRP, if not a user can install stuff in their own profile.

2 what program is the task calling to check for the dll and display the message? Try blocking or deleting that program.

3 If the task has a consistent name and isn't random rubbish each install, delete the task with GPO.

 

Hope this helps.

 

1) No, we are running pro, not enterprise, so we don't have app locker. We use roaming mandatory profiles, so after every use, the profile gets wiped out, but the task created applies to the whole system.

2) I don't have any going on right now to see, but I think they are calling cakebake.dll, but it can't find it. I'm not sure what is creating the task though?

3) It does have a consistent name that includes the system name, could you use a variable in a gpo to delete? for the cakebake one, it makes two tasks called ArcadeCakeBake-$computername and ArcadeCakeMix-$compname. I've been deleting them remotely with powershell but that is more f something to do after the fact rather than preventative. How would you do the GPO way?

[mrwoberts]

A few questions

 

1. What AV do you have, and does it report the origin of the 'infection', which website, for example. This info could potentially help to at least block that website, or download...

2. Looking over the browsing logs for the library PCs, do they show up anything that could help to track down the source...

3. The next time you see this happen, could you get to that PC before the profile is wiped and work backwards to help track down the source. Maybe the student it affected can also help fill in some missing parts of the puzzle.

 

I guess all of these suggestions don't necessarily deal with your original request about task creation, but they may at least help to 'stem the flow' until you have time to look into that problem.

Edited October 28, 2015 by mrwoberts

[psydii]

You should be able to see 'who' created the task by viewing the history tab of the task itself.

 

You can use process explorer and procmon to investigate what is actually happening on the box.

 

To install a service or create a system wide scheduled task, the unwanted application is going to have to be running as Admin, System or TrustedInstaller. This means either it is using a privilege escalation attack (which means you are likely behind on your windows updates), or you do have users with admin rights.

 

This video on malware investigation and remediation for System Administrators is well worth the time :

https://channel9.msdn.com/Events/TechEd/NorthAmerica/2012/SIA302

(it also talks about malware using task scheduler for nefarious purposes.)

 

HTH.

[hipsterdoofus]

You should be able to see 'who' created the task by viewing the history tab of the task itself.

 

You can use process explorer and procmon to investigate what is actually happening on the box.

 

To install a service or create a system wide scheduled task, the unwanted application is going to have to be running as Admin, System or TrustedInstaller. This means either it is using a privilege escalation attack (which means you are likely behind on your windows updates), or you do have users with admin rights.

 

This video on malware investigation and remediation for System Administrators is well worth the time :

https://channel9.msdn.com/Events/TechEd/NorthAmerica/2012/SIA302

(it also talks about malware using task scheduler for nefarious purposes.)

 

HTH.

 

Not behind on Windows updates - fully patched, unless there was something that may have been causing this that just got patched this month? I just got my public computers patched thru this month yesterday, but I keep them patched monthly with WSUS.

 

However, if there was something that was patched this month that dealt with this, then I agree, that could be the issue.

 

I haven't had any more of these pop up the last couple of days, but if I do, I will look more carefully at the task and see if it says "who" created the task. Again, I assure you that the users do not have admin rights. Just a plain jane user.