Here's some interesting reading related to the Downadup virus from the SANS NewsBites newsletter. SANS is a computer security training organization (http://www.sans.org/)

--How One Company Cleaned Up The Thumb Drive Attacks- And Learned A Lot In The Process.

From the editor of SANS NewsBites: I received a fascinating note from a manager who registered three people for SANS training this winter despite a corporate ban on nearly all travel and training for the first half of 2009. I had known about his company's ban so when I saw the three registrations come in, I wrote and asked him what happened. His answer is enlightening; it has to do with the thumb drive infections that are hitting so many people.

Here's his answer to "Why Did You Send People to SANS This Year When You Have a Ban on Training and Travel?"

Alan,

Take a closer look; you'll find that 12 or 13 people are coming from (company) to SANS in Orlando, not just my three. The others are coming from other divisions. Here's why. You remember the big wave of attacks last November where infections were spread by thumb drives. We got hit by that. It is amazing how often people use those things. It spread to dozens of Windows file servers, and from there jumped to thousands of workstation systems. It clogged our networks. It was so bad a lot of machines, including the ones on the top floor of this building, had to be taken off line - and that got some unwanted visibility from the CEO.

We called both our AV vendors but neither had a signature for this virus yet. It took a long time and a lot of pain before we found all the machines that were hit, stop the spread to new machines, and got rid of the (expletive deleted) thing. The whole company - every US division and international was affected.

So what does that have to do with my guys going to SANS? It turns out our CEO was in the UK visiting our facility there and somehow the topic of the virus came up and our UK manager told him it had hardly been a problem at all in the UK. He said his security guys found it within a few minutes and cleaned it out. As you might imagine the CEO's follow-up email to me was unpleasant. So I called my counterpart in the UK and asked him how he had dealt with the attack so easily. He told me one of his guys knew what to do immediately. He said used the built-in Windows WMIC command to find systems with the malware processes running and that also told him about the changes made by the malware. Then, he used the reg command to remove an entry from the auto-start capabilities of infected machines to stop the malware from running on startup. He also said the reg command let him change the USB and CD/DVD autorun function to stop similar infections. After shutting down the malware and stopping it from spreading, he said he used a couple more techniques to clean up the infected machines quickly. I asked where his guy learned all that. He said at SANS, in a course called 504 which I later learned was your Hacker Exploits and incident Handling class. I reported that back to our CEO. He told me to make sure every division had at least two people who knew those techniques. So, our travel ban was lifted for SANS.

==end==

Here’s a link to info on the WMIC command: http://technet.microsoft.com/en-us/library/bb742610.aspx?ppud=4

Jonathan Webster, eGroup
http://www.eGroup-us.com