Re: MS KB 962007 to Protect Against Conficker Virus

Hello w,

In basic you should better apply the latest patches, use an actual AnitVirus
software. If the Virus is on some of your machines, disconnect them from
the network clean them, update them to the latest SP and patches, scan again
with AntiVirus software and reconnect them to the network.

The GPO/registry chagnes is a workaround in my opinion. Even if the above
way is restrictive for the user, we did it that way(unfortunal we have had
the Virus on some machines in different buildings/locations), you can be
sure the Virus will not be spread out.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Microsoft's knowledgebase 962007 describes a group policy that can be
> used to help protect systems against infection by viruses (in general)
> and Conficker virus (specfically). Two of the three steps involved
> seem like very serious restrictions of capability and I want to better
> understand the implications.
>
> First, there is an instruction to remove the ability for
> Administrators and the operating system to write or modify to the
> svchost registry key. Won't this affect the ability to do a normal
> Windows Update, which might need to either add services here or modify
> settings for existing services?
>
> Second, there is an instruction to remove the ability for
> Administrators or the operating system to create Scheduled Tasks.
> That also seems pretty serious since we would not be able to easily
> maintain Scheduled Tasks.
>
> In general, what activities are going to start to fail with these very
> restrictive security settings?
>
> I would like to have a group policy ready to go that undoes the damage
> caused by the above settings. Is it appropriate to create a policy
> that will give Administrators and SYSTEM Full Control on the SVCHOST
> and subfolders and subkeys, or should we attempt to snapshot the
> existing security tree structure and precisely restore that?
>