Annoying Virus (confick-E)

[mossj]

How do you put the tool in the start up script?

 

We run batch files on start up so i assumened it would be easy but found some code but doesn't seem to be working

 

on error resume next

Dim StrServer
Dim StrShare
Dim StrComputer
Dim objFSO
Dim objLogFile
Dim objFSO2
Dim objLogFile2
Dim objFSO3
Dim WshNetwork
Dim WshShell
Dim WshEnv
Dim objSystemInfo
Dim OpSysSet

StrServer = "10.177.0.15" 
StrShare = "downanup"

set wshnetwork = CreateObject("wscript.network")
StrComputer = wshnetwork.computername
set wshnetwork = nothing

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLogFile = objFSO.OpenTextFile("\\" & StrServer & "\" & StrShare & "\" & StrComputer & ".txt", 8, True)
objLogFile.Write("F-Secure Trojan/Worm Scan started at " & now() & " ") 
objLogFile.Writeline

Set objFSO3 = CreateObject("Scripting.FileSystemObject")

If objFSO3.FileExists("c:\fsmrt.exe") Then

objLogFile.Write("Application File already in place") 
objLogFile.Writeline

Else

objLogFile.Write("Copying FSMRT File to " & StrComputer) 
objLogFile.Writeline
objFSO3.CopyFile "\\" & StrServer & "\" & StrShare & "\fsmrt.exe", "c:\"

End If

Set WshShell = WScript.CreateObject("WScript.Shell")
Set WshEnv = WshShell.Environment("PROCESS")

WshEnv("SEE_MASK_NOZONECHECKS") = 1

Return = WshShell.Run("c:\fsmrt.exe >>\\" & StrServer & "\" & StrShare & "\" & StrComputer &".txt", 0, true)

WshEnv.Remove("SEE_MASK_NOZONECHECKS")

Set objSystemInfo = CreateObject("ADSystemInfo") 
Set OpSysSet = GetObject("winmgmts:{(Shutdown)}//" & StrComputer & "/root/cimv2").ExecQuery("select * from Win32_OperatingSystem where Primary=true")

For each OpSys in OpSysSet

If Return = 10 Or Return = 1 Then

Set objFSO2 = CreateObject("Scripting.FileSystemObject")
Set objLogFile2 = objFSO2.OpenTextFile("\\" & StrServer & "\" & StrShare & "\Cleared.txt", 8, True)
objLogFile2.Write("Trojan/Worm Found ... Item cleaned " & StrComputer & " rebooted at " & now() & " ") 
objLogFile2.Writeline

objLogFile.Write("Trojan/Worm Found ... Item cleaned " & StrComputer & " rebooted at " & now() & " ") 
objLogFile.Writeline

OpSys.Reboot()

ElseIf Return = 2 Then

Set objFSO2 = CreateObject("Scripting.FileSystemObject")
Set objLogFile2 = objFSO3.OpenTextFile("\\" & StrServer & "\" & StrShare & "\Infected.txt", 8, True)
objLogFile2.Write("Trojan/Worm Found ... Cannot clean " & StrComputer & " Shutdown at " & now() & " ") 
objLogFile2.Writeline

objLogFile.Write("Trojan/Worm Found ... Cannot clean " & StrComputer & " Shutdown at " & now() & " ") 
objLogFile.Writeline

opSys.Win32Shutdown(5)

Else

Set objFSO2 = CreateObject("Scripting.FileSystemObject")
Set objLogFile2 = objFSO3.OpenTextFile("\\" & StrServer & "\" & StrShare & "\Clean.txt", 8, True)
objLogFile2.Write("Nothing found on " & StrComputer & " ... Ending Scan at " & now() & " ") 
objLogFile2.Writeline

objLogFile.Write("Nothing found on " & StrComputer & " ... Ending Scan at " & now() & " ") 
objLogFile.WriteLine

End If

Next

Set objLogFile2 = nothing
Set objLogFile = nothing
Set objFSO3 = nothing
Set objFSO2 = nothing
Set objFSO = nothing
Set WshShell = Nothing

 

 

Also does it slow boot up? how much by?

[mossj]

Bump I need the solution urgently

[MPorter]

Bump I need the solution urgently

 

Ok, I think this would be the right method. If anyone notices a mistake, then please correct me. Copy the contents of the quoted text, and paste into notepad. Save the notepad document as "MyScript.vbs". The speech marks are important, as they stop notepad appending .txt to the end.

 

On your domain controller, if you have the group policy management console installed, click Start, Run and enter gpmc.msc. This launches the management tool. All your workstations should be contained in an organisational unit, such as 'workstations', or possibly a bunch of OU's, such as 'Room1', 'Room2'. Locate the correct organisational unit, and right click on it, and select 'Create and Link a GPO Here'. This creates a new group policy object, linked to the stations in that OU. Give that group policy object a descriptive name.

 

Now you need to configure the GPO. In the right hand side, the new GPO should appear. Right click on this, and click Edit. Expand the Computer Configuration node, followed by Windows Settings, and click on 'Scripts'. In the right hand pane, double click on 'Startup'. A properties box should appear. On here there will be a button labelled 'Show Files'. Click on this, and windows explorer will open, at the location where you need to place your startup script. Copy the .vbs file into here, and close the window. Next, click on the 'Add' button on the startup properties sheet. Either type in the name of the script, or browse to it using the browse button. Close all open windows, and click Start, Run and type gpupdate. This will update the group policies. Your clients should then run the script on startup.

 

However, before doing all this, test the script works OK in your environment. Log on to a workstation, get the script, and double click it to run it, and observe that it doesn't break anything. If everything seems OK, try a couple more, and when you feel sure enough, set it with group policy.

 

Best of luck

 

Maria

[Maz]

Just a heads up to anyone who has / had the virus, check your scheduled tasks - it seems to create files named "At1" "At2" etc. Simply deleting these files do the trick, we also disabled the Task Scheduler service aswell.

 

Also could anyone else tell me if there virus has created new services. I've seen a few new ones popping up and can't seem to get rid of them. A few keywords that they use are 'Network', 'Security', 'Center Time', and 'System'.

 

These services also steal a random description from one of the other legitamite services that are running, it's pathetic when you reliase a name you haven't seen - look at the description and it has nothing to do with the service name.

 

Service Name: "Center Time"

Description: Provides automatic IPv6 connectivity over an IPv4 network. If this service is stopped, the machine will only have IPv6 connectivity if it is connected to a native IPv6 network.

 

Oh rly?

[meastaugh1]

Also could anyone else tell me if there virus has created new services. I've seen a few new ones popping up and can't seem to get rid of them. A few keywords that they use are 'Network', 'Security', 'Center Time', and 'System'.

 

Yeah, this was mentioned a couple of pages back in this post. If the service isn't removed I'm fairly confident that the scheduled tasks will get recreated when you enable the Task Scheduler service again.

 

I'd recommend the MS article for further advice on this.

[xeroxxe]

We have this virus also, but got 6 pages to read through now on how to remove it cheers guys We thinking of holding out till the easter break before removal, just becuase they cannot do without the network for a day.

[AyatollahPies]

We have this virus also, but got 6 pages to read through now on how to remove it cheers guys We thinking of holding out till the easter break before removal, just becuase they cannot do without the network for a day.

 

Are you not getting annoyed by the locked out user accounts, or have you not suffered that yet?

[mullet_man]

We have this virus also, but got 6 pages to read through now on how to remove it cheers guys We thinking of holding out till the easter break before removal, just becuase they cannot do without the network for a day.

 

I managed to get rid of it without bringing the network down.

 

Send out the patch, firstly patch the servers, and make sure everyone has up to date virus, send down Microsoft Malcious Software remover as a startup script. (slows down logging in, but required)

 

Also I used wireshark to watch for dodgy packets around the network, this helped me track down a couple of machines that were unpatched.

 

Also make sure you do not log in as administrator in any machines you think are infected this will allow it to spread again.

[mullet_man]

Are you not getting annoyed by the locked out user accounts, or have you not suffered that yet?

 

The lockouts were a PITA, luckly it only got on our admin network so locked out around 80 accounts.

 

Would have locked out 700 on the pupil.

[xeroxxe]

No we have not yet had accounts locked up, we have however had a significantly slower network last few working days due to the virus. It congests the network horribly, to be honest at the moment getting the pens sorted would be a good start, I mean I have seen a few teachers now bring it in on their pen drive and a couple of them were admin :S

[meastaugh1]

I'd personally be nervous about leaving it until Easter with 1 April coming up.

 

If you follow the MS article you should be able to contain it from spreading further, patch it, then remove it. I'm not yet convinced that it is absolutely necessary to shutdown to cleanse yourself of the infection.

 

As AP suggests, it can bring unpatched computers to a stop as I'm pretty sure we've seen it stop more than just the update service.

Edited March 23, 2009 by meastaugh1
typo

[Roopert]

To those getting page not found for some sophos tools etc. the virus actively blocks anti-virus sites so you cannot download these cleanup tools etc.

[meastaugh1]

send down Microsoft Malcious Software remover as a startup script. (slows down logging in, but required)

 

I didn't find the MS tool to be entirely effective/consisntent. We remoted into the registry of all computers to check svchost registry entry and tidied up accordingly.

[JJonas]

Can I apply the steps from the microsoft article to the default domain policy or is there a chance I might lock myself out.

[meastaugh1]

Why do you need to do that? Can't you create a new one? I think it's generally bad practice to make those sorts of changes to the DDP.

[xeroxxe]

We do keep scanning computers and have all patches on, we are removing it dailey as you know it keeps coming back, we were thinking of going on like this untill the easter break removing it dailey just for it to come back. We were thinking of doing the full cleanup and removal during easter just becuase of the amount of work we don't need the pressure of getting it back up and running fast.

[mullet_man]

I'd start now, rather than the holidays. Its gonna infect all machines, meaning more work.

 

If you get on top of it now, you might be able to clean it up within a few days. Also follow the Sophos steps as listed in one of the pages previous.

[Geoff]

Beware if you use this approach as Confick activates on April 1st.

 

Slashdot | Researchers Ponder Conficker's April Fool's Activation Date

[xeroxxe]

So it activates on april 1st? All this stuff its doing in the meantime I thought it was very much active There is another purpose behind just being annoying. We are going to try and start tackeling it right away. Just looking around for the best methods.

[Roopert]

Edited cause i am superstitious Edited March 23, 2009 by Roopert

[gshaw]

Sophos seems to have blocked one or two flash sticks that have had it on and one PC that got it broke anyway so taken away for rebuild. Haven't spotted anything in the registry on machines yet, WSUS protecting our admin machines and manually ran the 958644 on teaching ones but still paranoid it could be waiting somewhere!

 

What did you notice in Wireshark btw, any obvious patterns?

[philtomo-25]

Hi guys,

 

could do with a bit of advice regarding this virus, our school has been infected late last week, having spent most of the weekend fighting the virus by disconnecting the network it appeared yesterday and promptly infected every pc that we had disinfected.

 

We have followed the MS advice and also sophos, after recieving the virus, and viewing the enterprise console we -

 

1. disconnected each device

2.patched all pcs up MS patch then disconnected each pc from patch lead

3.did a full sophos scan and disinfected PC (virus was caught in sophos quarantine)

4.rebooted pc, and (after all network was clean) added each pc back to network.

 

to stop the virus we have done -

 

1.stopped "task scheduler" through group policy to stop "A*" schedules running

2.disabled file and print sharing

3. disbale usb devices and cd/dvd drives to stop virus spreading

4.stopped autorun on PCs from removable devices

 

although we have done all the above the virus appeared again yesterday

 

one of many questions we would like answers for is -

 

1.if we leave the virus in quarantine what implications would we have if we left it untill april easter?

(we have already had the occasional account lockouts)

 

help would be appreciated

 

cheers

 

phil

[Crispin]

Apologies if this has already been linked to, but here is a conficker cleaning tool provided by BitDefender, for those who can't access sophos.

 

Remove Downadup - Removal tool for Downadup (known also as Conficker or Kido)

 

Seems like quite a nice tool. Testing in our ICT Suites after school today, although we don't have any infected machines thankfully. Works across the network using AD so you can deploy to all PCs at once.

 

cb

[xeroxxe]

Hey the network version. This tool from bit-defender is it safe running it on the server? Dont want it corrupting files as it goes through and deletes infected files. Just some guidance needed, poeple who have had the virus and have ran this tool. Edited March 25, 2009 by xeroxxe

[meastaugh1]

Hey the network version. This tool from bit-defender is it safe running it on the server? Dont want it corrupting files as it goes through and deletes infected files. Just some guidance needed, poeple who have had the virus and have ran this tool.

 

It stopped the Server service (to name one) when I ran it one of my servers, so not especially safe running during normal hours, but doesn't seem to have caused any damage. I'd favour manual removal though.