JMB Posted September 23, 2011 Posted September 23, 2011 Hi, we moved to Server 2008 R2 over the summer, and broadly speaking it's been a triumph. However, we appear to have a Conficker infestation. It seems to be disabling sound and network services, which is deeply irritating. I've tried McAfee, our standard AV, which hasn't detected anything. And I've downloaded the MS Malicious Tool, which also finds nothing. I know it's there though! Can anyone recommend a tool or a means to get rid of this little beast once and for all? Thanks!
Michael Posted September 23, 2011 Posted September 23, 2011 Disable Autorun for all devices (you can do this with GPO) and for the time it takes to scan a machine, you may as well re-image it as new. It's primarily the Autoplay function in Windows that it exploits. Even with Conficker removed, it creates a lot of damage with system files.
kmount Posted September 23, 2011 Posted September 23, 2011 The MS tool normally finds it quite well, what's making you sure it's Conficker? Isolate, scan, patch, scan, reconnect to clean LAN job.
Geoff Posted September 23, 2011 Posted September 23, 2011 Here's the MS article on the subject. Computer Worms - Conficker | Microsoft Security
mattx Posted September 23, 2011 Posted September 23, 2011 (edited) Download the KK tool from the KAV site - that's quite good at getting rid of it + I have this running at logon at the moment for PCs that don't have KAV or MSE installed. Feel free to change it and use it - [ may I suggest you compile it first into a .exe and have it running at logon ] ; Language: English ; Platform: WinXP ; Author: Matt ; Script Function: Run kk.exe in silent mode at logon ; Version: 1 ; Date: June 2011 If FileExists('c:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe') Then Exit ElseIf FileExists('c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe') Then Exit Else Run(@LogonServer & "\netlogon\kk.exe -f -s -z -y -x -t -j", "") EndIf Exit Forgot to say it's an AutoIT script but could easily be ported to say powershell or something. KK can be DLed from: http://support.kaspersky.com/faq?chapter=207800963&print=true&qid=208279973 Edited September 23, 2011 by mattx
ToyHeartsFan Posted September 23, 2011 Posted September 23, 2011 I don’t use McAfee but as they have a free conficker detection tool (McAfee Conficker Detection Tool | McAfee Labs) then your AV software should detect it if its there. If your computers are kept up to date then conficker shouldn’t be able to infect them as Microsoft released a patch for it. Were all your workstations reimaged when you upgraded the servers? I had problems with a new image when I used the latest sound drivers and had to use an earlier driver or the sound would stop working. If you want to try another tool give sophos a go but it sounds like something else could be causing your problem (Conficker Removal Tool | Conficker Virus Removal | Sophos Free Tools).
JonWPS Posted September 23, 2011 Posted September 23, 2011 There's a Microsoft tech article with some decent advice on this. Main thing is disabling autorun and I seem to recall restricting access to the system service, as it spreads by creating scheduled tasks. Real pain when we had it, so good luck.
36Degrees Posted September 23, 2011 Posted September 23, 2011 The most effective tool we found is cfremover cfremover.exe although this was about 18 months ago. All other tools seemed quite ineffective at the time but using that eradicated it for us. We also created a folder called autorun.inf on all server hard drives as someone once told me that this helps. Not sure whether it's true or not but we have been Conficker free since then!
JMB Posted September 23, 2011 Author Posted September 23, 2011 Thanks everyone, really appreciate such a swift response! I should add some more detail... ToyHeartsFan, you asked something specifically - yes, we worked from a completely clean image. Set up a PC with a clean install of XP SP3, installed all our standard software (Office, etc.), then took an image and used sysprep to push that out to all the other machines. From there we just updated drivers etc. on an ad hoc basis. I've got a fully updated McAfee, which hasn't found anything. Have also tried the MS tool described above (found nothing) and the KK program suggested above (also drew a blank). I'll give the McAfee conficker tool and the Sophos ones a try. It's very odd. Boot a PC (any PC) and everything's fine. Leave it on for any length of time without logging in, and when you try to log in you get a local profile and no network access. Likewise, if a PC is logged in and left for a while, you lose your network AND the sound stops working. And yet, although the sound stops working, when you shut Windows down, you get all the system sounds. Puzzler! I have someone from the council's IT come and take a look (they helped with the server install) and he was the one who determined the Conficker.
36Degrees Posted September 23, 2011 Posted September 23, 2011 Make sure that the XP3 service patch has been installed: Download Details - Microsoft Download Center - Security Update for Windows XP (KB958644)
DAZZD88 Posted September 23, 2011 Posted September 23, 2011 Doesn't sound like Conficker. Conficker spreads by exploiting the ADMIN share that is created by default on Windows boxes that are joined to a domain with poorly secured user accounts that have created when building the inital image (stupid mistake on our part), by using scheduled tasks and also by memory stick (as autorun.ini I think). You'll know it's conficker if you have AT tasks in your scheduled tasks list on the infected machines. Disable autorun via GPO Disable USB access Check your firewall policy is configured securely We have only just re-enabled USB. If you can afford to take your network offline and reimage everything then I'd say do that. Like I said though, your virus doesn't sound like Conficker although there may well be another variant or two that I've not come across.
JMB Posted September 23, 2011 Author Posted September 23, 2011 I've run the McAfee tool and it's searched the network; only 3 PCs are infected, and actually none of these are the ones that present with network/sound issues. But the sound/network services on many of the PCs do spontaneously stop. They can be restarted, of course, but not by a "civilian" user! So, if Conficker isn't behind these problems, it makes me wonder what is!
JMB Posted September 23, 2011 Author Posted September 23, 2011 We have considered reinstalling all the drivers, but surely if it was a driver issue, the sound/LAN wouldn't work full stop. As it stands, it all works, but the respective services stop spontaneously...
DAZZD88 Posted September 23, 2011 Posted September 23, 2011 drivers?+1 to this Also, what about a software conflict of some sort? We have Securus on our machines to help monitor activity on t'internet and to scan for any inappropriate words typed into documents the only problem is that Adobe Reader X doesn't get on well with it so we have to install version 9.
SimpleSi Posted September 23, 2011 Posted September 23, 2011 I haven't read the other answers but to clean this off one of my schools I had to disconnect EVERTHING from the lan and make sure all servers were clean On each machine, I ran the sophos root kit/conficker removal tool - if the machine had an infection i rebooted and ran it again and then did a scan with Malabytes malaware just ot be sure. Once I'd done this - i reconnected machine to network. All computers set to not autorun USB drives and all USB devices with memory in them e.g cameras as well as pens) were banned from school until I personally had checked them and then they were not allowed on school machines if they were taken home - they had to be handed back to me again for rescanning . It took a week - i did the classroom teacher machines first. Been clean for a year now Good Luck Si
sidewinder Posted September 23, 2011 Posted September 23, 2011 I'd also go software or driver conflict. If an AV and Microsoft's tool isn't finding anything, it won't be conficker. Probably isn't even a virus at all. Slightly odd that the council IT guy would tell you that and give you no proof of it, nor help you resolve it
ToyHeartsFan Posted September 23, 2011 Posted September 23, 2011 We have considered reinstalling all the drivers, but surely if it was a driver issue, the sound/LAN wouldn't work full stop. As it stands, it all works, but the respective services stop spontaneously... - Unfortunately iffy drivers can cause all sorts of problems I would sort out the 3 infected machines before doing anything else then rescan and if the network is clear pick a PC thats playing up and reinstall the drivers on it. I’ve had strange problems with drivers in the past; sound stopped working on a newly imaged PC, I had to revert to an older driver rather than the new one I had put on the image. Upgrading the nic driver on a server caused network problems to appear on all of the workstations and I had to upgrade the driver on every workstation in school to fix that problem. I would check that the latest drivers are installed if they already are you should consider installing the previous version and see if that makes any difference. Also if you have gig network cards connected to gig switches remember that XP has a problem with them (although they shouldn’t stop working) and you need to disable media sense via a reg entry or group policy doesn’t always get applied.
ToyHeartsFan Posted September 26, 2011 Posted September 26, 2011 If you still have problems after running another scan and updating the drivers look at any software that installs a service. I once had a problem where the remote software our lea used would crash the print spooler on the server – good luck!
JMB Posted September 30, 2011 Author Posted September 30, 2011 **UPDATE** Thanks to everyone for their advice, some great suggestions. I've done a full virus scan of the entire network, and only 3 machines had any trace of Conficker on them. Ironically, none of them on the domain, and therefore none of them the PCs that had issues with sound/network dropping. In the process of logging in to these machines locally as admin, I noticed svhost.exe error messages. All these PCs are XP SP3, clean installs from a ScoMIS disc. Clean bill of health from every antivirus and spyware scan I throw at them. And I've thrown a LOT at them lately! I upgraded the .net framework on a couple of them, which seemed to fix the svhost.exe messages. I then went into the services themselves and set the Windows Audio and network services to restart if they are stopped for any reason. BUT - this still doesn't stop these services stopping. And having stopped, they still won't restart automatically. So...anyone got any other ideas?!
mwbutler Posted September 30, 2011 Posted September 30, 2011 We get McAfee from ScoMIS too and it caught any traces of Conficker immediately (surprised me tbh!) which stopped the virus spreading across the entire network. Therefore unless your version of Mcafee (EPO 4.5 on server and 8.7 patch 4 on desktops) is horribly out of date I don't think you will have Conficker on your network. What does the affected PC event logs say? Are you sure the correct drivers got installed? Try updating / reinstalling the PC's chipset, sound driver and network driver and see if that helps fix the problem.
SimpleSi Posted September 30, 2011 Posted September 30, 2011 Clean bill of health from every antivirus and spyware scan I throw at them. Unless ALL your USB memory devices have been checked .. you can't sleep safe at night Si
JMB Posted September 30, 2011 Author Posted September 30, 2011 Well...I've reinstalled all the drivers for everything on one of the PCs. Still getting the svhost.exe error message. This is what the error log says about this: Event Type: Error Event Source: Application Error Event Category: (100) Event ID: 1004 Date: 30/09/2011 Time: 14:14:08 User: N/A Computer: ICT04 Description: Faulting application svchost.exe, version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000. For more information, see Help and Support Center at Events and Errors Message Center: Basic Search. Data: 0000: 41 70 70 6c 69 63 61 74 Applicat 0008: 69 6f 6e 20 46 61 69 6c ion Fail 0010: 75 72 65 20 20 73 76 63 ure svc 0018: 68 6f 73 74 2e 65 78 65 host.exe 0020: 20 30 2e 30 2e 30 2e 30 0.0.0.0 0028: 20 69 6e 20 75 6e 6b 6e in unkn 0030: 6f 77 6e 20 30 2e 30 2e own 0.0. 0038: 30 2e 30 20 61 74 20 6f 0.0 at o 0040: 66 66 73 65 74 20 30 30 ffset 00 0048: 30 30 30 30 30 30 000000 Going to leave this machine on for a while, see if the problem of sound/network dropping returns. If it does, we're going to wipe a machine and start over with it, from reinstalled XP up...
mwbutler Posted September 30, 2011 Posted September 30, 2011 Just had a thought. Mcafee blocks all sorts of things randomly; make sure it isn't blocking svhost plus other processes. IT used to block dns.exe plus all sorts of programs that interact with Exchange as it thinks it's a "mass mailing worm."
JMB Posted September 30, 2011 Author Posted September 30, 2011 Nothing McAfee does would surprise me! Bless it. Good idea - I'll give that a try! Thanks again for all the ideas - always grateful for more! Have a good weekend all!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now