Total ban on removable media

[andyturpie]

Hi Gang,

 

For weeks now we have been chasing around a pesky virus (artemis) and are considering a ban on all USB sticks/removable drives. As we are an RM school we would like to recommend some off site storage for the girls/teachers to use. Would love to hear if other schools have followed through with this?

 

Also did you open up all machines and physically remove connection from mainboard, or use BIOS configuration?

 

How did the teachers and pupils react to the decision of banning them?

 

Feedback much welcome!

 

 

Regards,

 

Andy Turpie

[glennda]

how is it being spread? if it is the autorun.ini, then can you not just disable autorun.ini by gpo, thats all we did at my place, and although the virus is still there, its just no run.

 

Toby

[Danlewis3]

how is it being spread? if it is the autorun.ini, then can you not just disable autorun.ini by gpo, thats all we did at my place, and although the virus is still there, its just no run.

 

Toby

 

Good but that seems pointless. Why do people need access to memory sticks they all i assume have access to a school email account and can attach send files via that.

 

We have just blocked all drives so that even when its plugged in it wont recognize it as a mass storage device.

[andyturpie]

Hi Toby,

 

Our school has over 500 desktops and 115 teacher laptops, the virus is caught by our McAfee, but leaves a mess of the registry with startup looking for two dsjkhfkjsdhf.exe program entries (example there). This upsets the teachers on classroom pcs as they have to click okay twice after they log on to get rid of the message. We are chasing this around a large site would prefer to kick off a full rebuild of all PCs and ban USB usage and start afresh.

[andyturpie]

Dan,

 

Good point - They have access to Easymail with attachment facilities. How did you block the ports, as we would need two live for keyboard and mouse?

 

Andy

[Devontechie]

What about students that don't have Internet access at home?

 

Dan,

 

Good point - They have access to Easymail with attachment facilities. How did you block the ports, as we would need two live for keyboard and mouse?

 

Andy

[glennda]

Hi Toby,

 

Our school has over 500 desktops and 115 teacher laptops, the virus is caught by our McAfee, but leaves a mess of the registry with startup looking for two dsjkhfkjsdhf.exe program entries (example there). This upsets the teachers on classroom pcs as they have to click okay twice after they log on to get rid of the message. We are chasing this around a large site would prefer to kick off a full rebuild of all PCs and ban USB usage and start afresh.

 

Hiya,

 

I understand where you are coming from, our virus did not work like that, so i understand where you where coming from, at the time when we had ours, sophos didn't even know of the virus, we had to send them samples of the files for them to fix. but all the virus did was spread itself via usb's and there was a dll on the machine that just infected the drive if it could write to it. the email thing is one way around it. but at the school i was at, at the time had lots of darling students that tended to pull the network leads out and when reconnected the network drives did no reconnect untill log off and the student could not save there work anywhere as they had a mandatory profile, so we had to pop around with a usb stick and save it to that for them, then reboot machine and log in, save work to network!

 

Good point - They have access to Easymail with attachment facilities. How did you block the ports, as we would need two live for keyboard and mouse?

 

block the drives rather then the ports e.g block E: F: etc, but leave the ones you use for mapping drives to

 

Toby

[enjay]

What about students that don't have Internet access at home?

 

They could work at school, just like the students who don't have a computer at home.

 

Also worth finding out if you actually have any without PC/internet access before worrying about that - from a recent survey, we know we have 100% broadband penetration (but we are a fee-paying urban school, so it may be different for you).

[camel]

I've been experimenting with a program called USBDLM for sometime now to resolve a problem with our USB drives using network drive letters, rendering the USB drive unusable. It worked perfectly, but could even be configured to scan for viruses before the drive is made accessible to the user. Not tried this functionality yet (in testing). It can bypass Windows autorun which would help with limiting the damage caused by a network aware virus on a USB stick. Plus it has a wide feature set for limiting specific devices (works with digital cameras, card readers, external HDDs and more - check the site), renaming and encryption.

 

I also use software restrictions to limit where executables run from, limiting exes to run from known locations only (search the forums for more info)

 

Depends on your site requirements and policies for data usage and security but as USBs are cheap, versatile and just work (mostly), it makes them ideal for moving and using data anywhere, unfortunately.

[Slewis]

We had a similar viral outbreak here a couple of years ago.

 

We had problems rolling out Sophos, and when it was present it would detect the virus and prevent it running, but couldn't remove it.

 

My solution was writing a VBS to notify me of infections. (The virus in question always generated a specific file in addition to random ones (C:\Windows\inf\svchost.exe)

 

From there it was just a matter of cleaning it up (used a program called Replacer that was intended for replacing system files, then terminated the process) and innoculating repeat infections, (by disabling autorun and setting deny permissions on the local executables).

[TYO]

we have blocked all USB media for years 9 to 11 as they seemed the only users causing problems. we have ranger administrator and it was very straight forward to setup a block. aslong as you have a good VLE/email system it shoudnt be a problem. we also have sharepoint access to students home directories. The only issue is students who do not have internet at home.

[FN-GM]

We use GFI endpoint security. It's not cheap but does the job well

[Stuarte]

Hi,

 

You can disable all USB storage devices by pushing out a registry merge in you workstation custom settings in the RM Console. The value that you need to change is:

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

In the details pane, double-click Start.

In the Value data box, type 4, click Hexadecimal (if it is not already selected), and you are done.

 

We have a temporary ban on USB storage here for the same reasons!

 

Hope that helps.

[andyturpie]

Thanks Stuart, thats the route we might go down - nice one!!!!!!!!!

 

Andy T

[contink]

I've been experimenting with a program called USBDLM for sometime now to resolve a problem with our USB drives using network drive letters, rendering the USB drive unusable. It worked perfectly, but could even be configured to scan for viruses before the drive is made accessible to the user. Not tried this functionality yet (in testing). It can bypass Windows autorun which would help with limiting the damage caused by a network aware virus on a USB stick. Plus it has a wide feature set for limiting specific devices (works with digital cameras, card readers, external HDDs and more - check the site), renaming and encryption.

Could you keep me/us posted on how you get on with this as this sounds like a useful solution to a few issues that have plagued me in one or two schools.

 

If nothing else, getting the AV to scan the drive and kill off any autorun chicanery BEFORE anything goes in the system that would be a real plus.

[tech_guy]

You can use this nifty .adm with group policy to block usb, cd, floppy and super floppy devices on server 2003:

 

HOWTO: Use Group Policy to disable USB, CD-ROM, Floppy Disk and LS-120 drivers

 

We use it and it works a treat - easy to enable / disable. Don't forget to uncheck 'only show policy settings that can be fully managed' under filtering to see the options.

[GREED]

We still use them, but deiable autorun on all drives, and also manage the attachemtns that can be accessed, and where they can be saved to (which is almost nowhere for the children).

[enjay]

You can use this nifty .adm with group policy to block usb, cd, floppy and super floppy devices on server 2003

 

Thanks for that. I think it is an overkill response to this problem, but would address what to do with controlled assessment candidates.

[AlexB]

Could you keep me/us posted on how you get on with this as this sounds like a useful solution to a few issues that have plagued me in one or two schools.

 

If nothing else, getting the AV to scan the drive and kill off any autorun chicanery BEFORE anything goes in the system that would be a real plus.

 

We have this entry in our USBDLM reg entry

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Uwe Sieber\USBDLM\OnArrival]
"Force"="1"
"open"="\"%ProgramFiles%\\McAfee\\VirusScan Enterprise\\scan32.exe\" %drive%"

 

It causes the McAfee scanner to scan the USB stick, sadly the window remains open after the scan even if nothing is found. It is useful to scan for the kids sake as no executables can run from USB sticks within school.

 

Just an aside, unless you use another key to demote the "OnArrival" part of USBDLM runs with local admin privs.

[contink]

We have this entry in our USBDLM reg entry

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Uwe Sieber\USBDLM\OnArrival]
"Force"="1"
"open"="\"%ProgramFiles%\\McAfee\\VirusScan Enterprise\\scan32.exe\" %drive%"

 

It causes the McAfee scanner to scan the USB stick, sadly the window remains open after the scan even if nothing is found. It is useful to scan for the kids sake as no executables can run from USB sticks within school.

 

Just an aside, unless you use another key to demote the "OnArrival" part of USBDLM runs with local admin privs.

 

Could you use something like AutoIT to open the necessary command and then shutdown the window when a "completed" message or such like comes up?

 

Just a thought...

 

Thanks for sharing that though...

[deanc]

possibly worth checking with the IT staff as to what course they are running first, the OCR nationals specifically state that students must back-up thier work to removable medium, i.e USB/Floppy/Zip (the spec mentions it, nobody ever does)

[enjay]

You can use this nifty .adm with group policy to block usb, cd, floppy and super floppy devices on server 2003

 

@tech_guy - is it possible to do that via RMMC/CC3, or would I have to do it straight in the AD?

[Michael]

Tech_guy's link looks very interesting, however in the past (as an alternative) I created a custom GPO which limits the number of drive letters available.

 

If all existing network drives are using drive letters, plugging in a USB stick will do nothing as no letter can be assigned.

[enjay]

That would suffice - could you post the adm file?

[mattx]

Not sure if anyone has used this template ?

 

Group Policy to disable Autorun Arricc