Conficker Infected Entire Network: How To Remove?

[onyxice]

Wow, I never even thought of using that little lock key, in fact I didn't really like them at all until you posted this. Thank you. lol

[jba3]

Update every machine's avast definitions.

Shut down/disconnect all the computers.

Run the avast "boot time" scan while they are disconnected from the network.

Delete/move/etc as necessary.

Repeat til all machines are cleaned.

Smack customer and make a policy restricting/removing USB drive usage.

[SilverBullet]

Wow, I'm glad I'm not the only one. I infected our entire network a couple of weeks ago with the same virus. We had to disconnect all of the computers from the network, do a full AV scan, then there are a couple of system settings that have to be changed before it's safe to put them back on the network.

[FeaRpb]

Noobs and your infections.

[ictponder]

Got it fixed and it wasn't too bad.

Every computer is logged into a domain so I just logged them in locally on each machine and ran the Microsoft Removal Tool from a USB drive while they were disconnected. Then I installed Microsoft Security Essentials and the newest Avast before connecting them to the internet. This seemed to work for every infected computer. Any time the worm would try and reinfect a machine while installing Windows updates, Security Essentials would detect it and block it. So, we were able to update every machine to SP3 and all corresponding updates without a problem.

I did try running ComboFix once but it seemed stuck on the create restore point for about 30 minutes so we reverted to the above plan. Thanks for all the advice, especially running the software from the USB drive.

I really hate being the guy at work who gets stuck doing all the computer stuff.

[blindmist]

I really hate being the guy at work who gets stuck doing all the computer stuff.

I need a job.

[ictponder]

I need a job.

Therein lies the problem. They will not pay someone new when they can pay someone already employed here to do it for 1/4 as much as someone specifically for that purpose.