CC4 Unable to rebuild anything... RM say Virus?

[EduMan]

Hi all,

 

When we moved from CC3 to CC4 we went from being able to rebuild three computer rooms at a time to only building four computers!

 

Now, we are unable to build anything.

 

Our infrastructure is gigabit throughout the whole school...

 

When we build computers over the network.. The computer builds fine until it gets to the "Adding Computers to the Network" at this stage the computer freezes and goes no further.

 

We do have a virus on both of our networks.. one is RM one is just a windows based network, which we call the "Admin System". On the Admin System we can build computers absolutely fine.

 

Anyone had any situations like this? I don't personally think its the virus, I think RM are trying to pass the blame on.

 

Thanks,

Tom

[rad]

We have RM Virus protect which is supplied by RM, if you have that then it will be back to them.

 

We had an issue where we were unable to build more than 4 computers at a time but that was not down to virus issues. I'd get a scan done of the servers using Microsoft Security essentials via an administrator computer (I know MSE is not for business but it works in the short term)

 

If you get your AV upto date on the Windows network, when you rebuild the onto the RM network is should format and wipe the files anyway.

[jsnetman]

You cannot rule out the virus causing problems to the rebuild process, if you have conficker it will limit network connectivity as it floods the network. Identify the virus and get rid is your fist priority.

[EduMan]

You cannot rule out the virus causing problems to the rebuild process, if you have conficker it will limit network connectivity as it floods the network. Identify the virus and get rid is your fist priority.

 

We are trying. Unfortuantly we are stressing to staff to bring their computers up to the office so we can scan them. Becuase members of staff arnt, we are fighting a loosing battle everytime we disconnect servers and scan computers, on the monday the staff who refuse to bring their laptops to us infect everything again..

 

Dont you just hate schools!?

[synaesthesia]

Firstly look up the Scaleable Networking Pack (SNP) on Google and disable it on the server. Cant remember the exact keys but its something along the lines of TCPChimney and 2 other keys. They need disabling.

 

Restart server, I bet you'll find it works nicely then

[jsnetman]

What virus is it?

[jsnetman]

If it's conficker its not that hard to ger rid of. We had it maybe a year ago and I seem to remember you can apply a group policy patch to stop anything from creating a scheduled task, which conficker does. You can also deploy conficker removal tools and patch them to SP3 via startup scripts as I think GP gets applied before the virus kicks in. We also ran a memory cleaning program on all sstations and servers which basically looked for the virus in memory and unloaded it if found.

[synaesthesia]

Sorry, misread it and thought you didn't know you had a virus. So as above, which one? What symptoms other than this? If it's conficker or one of it's many clones please do a search on these forums for it and you'll see plenty of good advice on disinfection. Also it would mean your CC4 system isn't up to date/you've missed a couple of vital updates.

[Redbottom]

Hi At what point are the computers failing to build. If they are failing at adding computers to the network this could be related to a DNS issue. Do have the admin and CC4 on the same subnet ? and are they on different domains ?. Do you have any idea which virus you have on the network

[jamesfed]

I used to have similar problems building PCs at my last site onto a CC4 network (I especially had problems when building into VirtualBox); in the end it was determined that there were massive problems with the way RM setup the server and ended up in them sending out two guys for 4 days to fix everything.

If you have recently 'upgraded' from CC3 to CC4 contact your account manager and raise these issues with him directly (at least if you are sure that it isn't a virus lol)

[AngryTechnician]

Becuase members of staff arnt, we are fighting a loosing battle everytime we disconnect servers and scan computers, on the monday the staff who refuse to bring their laptops to us infect everything again..

There are two ways to deal with this (and it does need dealing with):

1. Explain the severity of the problem to SMT and have them order all staff to bring their laptops in.
   
2. Go and physically take the laptops from them. If they resist, beat them to death with their own shoes.
   

Even if the virus is not the cause of the immediate problem, it will cause problems later. RM clearly aren't going to help you until it's sorted anyway. If nothing else, motivate yourself with the idea that getting it sorted will prove RM wrong (usually works for me).

[ajs]

[*]Go and physically take the laptops from them. If they resist, beat them to death with their own shoes.

 

The problem I always found with that approach was that people don't really buy decent shoes anymore :-)

[AngryTechnician]

The problem I always found with that approach was that people don't really buy decent shoes anymore :-)

 

FACT: The only reason I worked in a Clarks shop during my A-levels was to convince people to buy sturdy shoes in preparation for the beatings years later.*

 

 

* This is a made-up fact.

[jsnetman]

Can you tell us what virus it is?, there will be lots of help here if you tell us. I would also block any laptop connecting to the DHCP server when they are brought back into school by mac address until you have looked at them. Edited July 2, 2010 by jsnetman

[Cue]

Honestly, if I were you I'd just cut every laptop off the network until it's scanned, explain to the staff that their lack of cooperation has caused this because you need to scan every machine for viruses (and for God's sake, get some decent virus protection on there, MSE isn't corporate but it's obviously better than what you have now if what you currently have can't even pick it up).

 

Elaborate on how viruses could be stealing all their information when they browse the net and such (even though that's more a spyware thing but hey) including logins and bank details, I'm sure they'd suddenly be far more cooperative.

 

If they still don't listen, then yeah, beat them with their own shoes.

[CHR1S]

Has Eduman been consumed by the virus too?

[EduMan]

If it's conficker its not that hard to ger rid of. We had it maybe a year ago and I seem to remember you can apply a group policy patch to stop anything from creating a scheduled task, which conficker does. You can also deploy conficker removal tools and patch them to SP3 via startup scripts as I think GP gets applied before the virus kicks in. We also ran a memory cleaning program on all sstations and servers which basically looked for the virus in memory and unloaded it if found.

 

With an RM network you can not use group policy, what patch did you use and do you know where i can get it?

[EduMan]

Has Eduman been consumed by the virus too?

 

I could only hope

[CHR1S]

With an RM network you can not use group policy, what patch did you use and do you know where i can get it?

 

Actually you can, if you can work out their AD structure its as easy as creating a new GPO for the setting in the right location. Just don't edit any of their GPO's, they might get angry

[jsnetman]

First thing to do is apply a registry patch to all machines and set security on the key to read for everyone including administrators the key is MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost. The easiest way is to do it via GP. I'm sure even on an RM network you can still use GP. Or you could deploy it via a script. I will post the other steps as soon as I can track what we did. It was a long time ago.

 

here is the svchost information from MS:

 

http://support.microsoft.com/kb/962007

[jsnetman]

We downloaded and stored this Virus Description: Worm:W32/Downadup.AL on a network share and and used a startup script to initiate detection and removal, machines that don't connect to the share or have the virus will have to be manually scanned. You also need to turn off autoplay on all removable devices again you can do this in GP but a regedit deployment script would also work. We also installed SP3 on all workstations and laptops, not sure you can do this on RM but I don't see why not. This can be done via WSUS or startup script, or manually.

 

Further info from Ms:

 

 

Virus alert about the Win32/Conficker worm

[Edu-IT]

We also installed SP3 on all workstations and laptops, not sure you can do this on RM but I don't see why not.

You can, yes.

[CHR1S]

You can, yes.

 

Can you, thats news to me, SP3 is included in CC4 SR2 isnt it?

[ajs]

Can you, thats news to me, SP3 is included in CC4 SR2 isnt it?

 

SP3 build images are supplied with SR2.

 

CC4UPD075 provides the necessary packages to update a station to SP3.

 

The SR2 build image also includes .NET 3.5 but I think that is the only difference.

[penfold]

As others have said, disable network access for all machines that are not being brought back to you. It seems like you cant progress without clearing the virus to ensure thats not causing any problems. Send out an email giving staff a day to bring in their laptop for scanning or loose their connection to the network. That way you have covered yourself and given staff warning. Staff can sometimes be lazy and you need to give them a prod to do what is needed(or use a shoe I can see from this thread )

 

Once you have cleared the virus you can go back to RM if need be.