Home Internet Mail Server Proxy Server Virus Windows Windows Server

Sunday, October 09, 2011

How to remove Conficker with Group Policy


Prevent Conficker spreading by using Group Policy settings

Notes:

  • These steps do not remove the Conficker malware from the environment. This procedure only stops the spread of the malware from moving from machine to machine. You should use an antivirus product or tool to remove the Conficker worm from the system. Or, follow the steps in the "Manual steps to remove the Win32/Conficker virus" section.
  • For information about the default permissions for the SVCHOST registry key and the Tasks Folder that are mentioned in the "Create a Group Policy object" section, see the Default permissions table at the end of this article.
  • You may be unable to install software, service packs, or Microsoft updates while the permission changes that are recommended in the following steps are in place. This includes applying Windows updates etc as these products rely on components of Automatic Updates. Remember that you change the permissions back to default settings after you clean the system.


First: Create a new Group Policy object

  1. Step one is to change permissions to the following registry subkey in order to remove write access:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost
    This prevents the randomly named malware service from being created in the netsvcs registry value. To do this, follow these steps: 
    • Open the Group Policy Management Console (GPMC).
    • Create a new GPO. Give it any name that you want.
    • Open the new GPO, and then move to the following folder: Computer Configuration\Windows Settings\Security Settings\Registry
    • Right-click Registry, and then click Add Key.
    • In the Select Registry Key dialog box, expand Machine, and then move to the following folder:   Software\Microsoft\Windows NT\CurrentVersion\Svchost
    • Click OK.
    • In the Add Object dialog box, click Replace existing permissions on all subkeys with inheritable permissions.
    • Click OK.
  2. Set the policy to remove write permissions to the %windir%\Tasks folder. This prevents the Conficker malware from creating the Scheduled Tasks that can reinfect the system. To do this, follow these steps:
    • In the same GPO that you created earlier, move to the following folder: Computer Configuration\Windows Settings\Security Settings\File System
    • Right-click File System, and then click Add File.
    • In the Add a file or folder dialog box, browse to the %windir%\Tasks folder. Make sure that Tasks is highlighted and listed in the Folder dialog box.
    • Click OK.
    • In the dialog box that opens, click to clear the check boxes for Full Control, Modify, and Write for both Administrators and System.
    • Click OK.
    • In the Add Object dialog box, click Replace existing permissions on all subkeys with inheritable permissions.
    • Click OK.
  3. We also need to disable Autorun. Autorun enables removable media to automatically open when inserted. This step keeps the Conficker malware from spreading by using that AutoPlay feature. Note Depending on the version of Windows that you are using, there are different updates that you must have installed to correctly disable the Autorun functionality: To set AutoPlay (Autorun) features to disabled, follow these steps:
    • In the same GPO that you created earlier, move to one of the following folders:
    • For a Windows Server 2003 domain, move to the following folder:
      Computer Configuration\Administrative Templates\System
    • For a Windows 2008 domain, move to the following folder:Computer Configuration\Administrative Templates\Windows Components\Autoplay Policies
    • Open the Turn off Autoplay policy.
    • In the Turn off Autoplay dialog box, click Enabled.
    • In the drop-down menu, click All drives.
    • Click OK.
  4. Close the Group Policy Management Console.
  5. Link the newly created GPO to the location that you want it to apply to.
  6. Allow for enough time for Group Policy settings to update to all computers. Generally, Group Policy replication takes five minutes to replicate to each domain controller, and then 90 minutes to replicate to the rest of the systems. A couple hours should be enough. However, more time may be required, depending on the environment.
  7. After the Group Policy settings have propagated, clean the systems of malware. To do this, follow these steps:

0 comments:

Post a Comment

Home Photography
Copyright © 2017 Xiu's Blog | All Rights Reserved.