[C#] Confiker elimination tool. Need a bit of help disabling a few things. - Overclock.net

Licht · 10-16-09

A network at a local business just got hit with Confiker. The little devil seems to have penetrated the whole system, and as soon as i clean one PC it gets attacked again. The business in question has over 80 PCs. I can't spend days going around cleaning every one and basically have their network in shambles as i do it to prevent reinfection. Nor can i reformat all of those PCs (obviously.) So i need a quick and efficient fix.

After doing research into Confiker's attack methods and established removal methods, i think i have a way to take care of this issue. But i will need a bit of help coding up a very simple application to assist in taking out the little bastard. The application needs to accomplish the following :

Disable autorun. -This Windows feature is not needed. And spreads the virus.
Disable system restore. -It has been reported this Windows component is used by Confiker.
Disable network adapters. -I'm not going around and unplugging cables everywhere as instructions call for. That much physical work my panic the business, which is already worrying.
Launch the first removal tool.
Upon the exiting of that tool, check to see if confiker is still present by means of checking connectivity to Microsoft, McAffee and other sites.
If it detects confiker is still present, launch the next tool.
Repeat.
If Confiker is eliminated, install the Windows patch to prevent reinfection.
Block known Confiker update sites in the host file.
Reboot.
Reenable System Restore, Network Adapters, and so on.
Display a completion message.

Any steps to be added you guys can think of is nice. Mainly i just want System Restore, auto-run, and the network adapters disabled. Other then that the rest can be done manually. But just those three things would speed up this process so much.

I think most of this stuff can be done in registry and simple commands that should be built into .Net.

Going to go to lunch and think over my battle plan. When i get back i'll start the VS project and see what i can do. I would greatly appreciate your help in all of this, thank you.

killnine · 10-16-09

most of this seems like file system commands that may be pretty simple to implement. A lot of the other windows stuff (disabling adapters and system restore and such) may not be feasible through C#, per se. Instead, maybe batching out commands would allow you to do this.

Rather than disabling adapters, why not backup, then overwrite the existing hosts file and point all IPs back to localhost so that you effectively stop traffic. IIRC, the hosts file is always the first reference for name resolution so regardless of what their network DNS says, you will reroute to localhost.

noldevin · 10-16-09

You will need to re-enable the network adapter in order to test connectivity to key websites before running the second tool. That may open the machine up to reinfection so perhaps you are better off just running both tools no matter what?

Also, if they are running vista you will want to temporarily disable UAC to make your life much easier.

Licht · 10-16-09

Quote:

Originally Posted by noldevin

You will need to re-enable the network adapter in order to test connectivity to key websites before running the second tool. That may open the machine up to reinfection so perhaps you are better off just running both tools no matter what?

Also, if they are running vista you will want to temporarily disable UAC to make your life much easier.

There are no Vista PCs. Their medical software doesn't work with it.

--

Just spoke with the technician who is going to be there in person. I'm revising my plan to make this as painless as possible. And easiest to do in person and remotely simultaneously (probably can't make my way over there.)

Current plan is to push the Windows XP update down via group policy and reboot the entire network. I'm worried about bandwidth and possibly crashing the network. There is a massive bottleneck when you get 80+ PCs on 100mbps. After that we'll use a script i found that allows group policy to disable auto-run. Code below.

Code:

; US-CERT Technical Cyber Security Alert TA09-020A -- Microsoft Windows Does Not Disable AutoRun Properly
; http://www.us-cert.gov/cas/techalerts/TA09-020A.html
;
;FIX:
;REGEDIT4
;   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
;   @="@SYS:DoesNotExist"
;
;
CLASS MACHINE
    CATEGORY !!RegistryFixes
        POLICY !!AutoRunInfSYSDoesNotExist
            #if version >= 4
                SUPPORTED !!SUPPORTED_WindowsXPSP2
            #endif
            EXPLAIN !!AutoRunInfSYSDoesNotExist_Help
            KEYNAME "SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf"
            VALUENAME ""
                VALUEON "@SYS:DoesNotExist"
                VALUEOFF DELETE
        END POLICY
    END CATEGORY ; DisableRemovableStorage
[strings]
RegistryFixes="Registry Settings"
SUPPORTED_WindowsXPSP2="Microsoft Windows XP Professional SP2 or later"
AutoRunInfSYSDoesNotExist="Disable auto handling of Autorun.inf"
AutoRunInfSYSDoesNotExist_Help="As per US-CERT Technical Cyber Security Alert TA09-020A -- Microsoft Windows Does Not Disable AutoRun Properly\n\n\nhttp://www.us-cert.gov/cas/techalerts/TA09-020A.html"

http://www.arricc.net/group-policy-t...le-autorun.php

So i can install the patch to prevent reinfection by the Windows vulnerability Confiker uses. Then i can push down a modification to kill auto-run to prevent reinfection by that method. Once i'm done with that i kill Confiker using a number of patches i found for variant C (the one we see on the network.) Thank god we have a badass firewall installed on the router in this place. Only thing i can think of to keep Confiker from updating to versions D or E.

Trying my best to avoid writing my own program in this. Don't want to worry about glitches. But i sure as hell am writing an article about how we cleared this thing.

		Overclock.net - Overclocking.net > Software, Programming and Coding > Coding and Programming
[C#] Confiker elimination tool. Need a bit of help disabling a few things.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)