4

Conflicker has been beating us down all week. We think a server or workstation is clean, but it comes back.

Windows Updates are up-to-date and everyone runs Trend or NOD32.

It would be great to use an effective tool to help us clean the computers. We are still experiencing workstation and/or server services shutting down, random tasks are added to the Scheduler, failing Automatic Update service, and DNS poisoning (I think that's what it's called when you suddenly can't get to microsoft.com and its related update sites).

So far we have used Windows Malicious Software Removal Tool (6/2009), and BitDefender Removal Tool. Neither seems terribly effective.

Improve this question
2
  • 3
    Take away "Administrator" rights from your users or you're never going to end the battle. Today it's "conficker", tomorrow it will be something else. Clean the slate by wiping and reloading the messed-up machines, and stop giving out "Administrator" rights. If someone "needs" to have "Administrator" rights to run a program you're not trying hard enough.
    – Evan Anderson
    Jun 30, 2009 at 22:12
  • The users don't have local admin rights, but I suspect laptop users (mostly managers or attorneys do).
    – smackaysmith
    Jun 30, 2009 at 23:45

5 Answers 5

Reset to default
3

The issue seems to be not that the things you have tried haven't worked, it seems more likely that, after you have cleaned one machine, another infected machine on the network will infect the machine you have just cleaned. You need to do a complete clean of all systems on the network. During that time, you will have to keep the machines from re-infecting one another.

Microsoft does have a knowledge base about this, Here. If the things there don't work, you will have disconnect every machine from the network, disinfect every machine, and then hook everything back up again. Good luck.

Improve this answer
13

There is only one effective method to clean a compromised workstation\server\network, and that is to wipe the machine(s), reinstall Windows and restore your data. Any other method, and you will never be sure that someone else doesn't own your network.

Once you're back up and running, the most effective ways to protect your network are, in order of importance/effectiveness:

  1. Not giving users local administrator rights on their Workstations.
  2. Enforce a strong password policy
  3. Use Group Policy to manage Internet Explorer and XP Firewall on Workstations.
  4. WSUS for updates for Servers and Workstations
  5. Anti-Virus
Improve this answer
4
  • 1
    This is true. Malware hides in so many places and infects so many files that even a removal tool isnt trustworthy, especially for an important machine. You can never be sure. Format and reinstall.
    – cop1152
    Jun 30, 2009 at 22:05
  • 1
    Evan says: serverfault.com/questions/27708/…
    – Evan Anderson
    Jun 30, 2009 at 22:10
  • 1
    Worth a mention: The Conficker Eye Chart. confickerworkinggroup.org/infection_test/cfeyechart.html
    – Qwerty
    Jun 30, 2009 at 23:44
  • That's not necessarily an option, speaking of critical infrastructures and high availability systems. And yes, these days they run WinDos. ;)
    – wishi
    Jul 1, 2009 at 12:01
1

The reason it spreads is because you have not yet set the group policy as specified here. Then you can clean the machines using the Malicious Software Removal tool. While many times you do need to wipe the machine, this is not one of them (as long as this is the only issue you have). Hopefully you have also initiated some sort of WSUS or another mandatory patch management solution.

Improve this answer
0

Symantec offers a removal tool along with instructions on how to quarantine while disinfecting. McAfee does also, but they call it S.T.I.N.G.E.R.
Take down the network while cleaning if you can, that will keep computers from getting re-infected.

Improve this answer
0

There's the Confickr working group and the Unfickr project. I pretty much guess you'll find all infos there. I would recommend to go through propper Nmap checks at first on the whole available subnet.

System hardening, working in user mode, using app policies - priceless nowadays.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.