Thought I had seen the last of conficker virus! Grr!!

[CM786]

Hi guys,

 

Had staff today complaining to me that the printers keep disappearing when they try to print over the network at a school I look after. They have Server 2008 with Windows 7 Pro and all client machines have AVG Business 9.0 on them.

 

Now disappearing printers is strange because every workstation has each printer locally installed (they were in the image). I logged into a few workstations locally and found that the printer spooler was disabled! Now this got me suspicious so I downloaded the Windows Malicious software removal tool and ran it. Low and behold it detected and removed cornflicker!! I thought I had seen the end of this virus! :mad:

 

Now the Main domain controller and fileserver are provided and maintained by the local authority and has McAfee on it. I scanned this and this also came up as infected!

 

Why is the antivirus software not picking up cornflicker? I thought Windows 7 was pretty secure against cornflicker (obviously I am wrong!).

 

Now I will have to work my way through all the clients and remove it. What is the best procedure to do this and protect against reinfection?

 

On a Windows XP machine network last year I had to disconnect each machine from the network, run the Microsoft malicious software patch to remove cornflicker, then patch XP with the MS08-67, MS08-68 and MS09-01 Patches and then finally physically add each machine it back to the Network (plug back in)

 

Is there a similar procedure with Windows 7? I would have thought it wouldn't need patching up?

 

Why has AVG and McAfee (who both have real-time protection) failed to protect the machines?

 

Thanks for any help.

cm786

[SYNACK]

Did you not have the Windows firewall enabled?

[DAZZD88]

Did you not have the Windows firewall enabled?

 

Good question. If not, then I'd suggest using the firewall to help you clean things up by turning it on and blocking everything except the ports and applications you want to allow through.

[3s-gtech]

My WSUS server distributes the Malicious Software Removal tool - do you have WSUS up and running?