Re: Virus/Trojan/Worm in the Dorms

[Kris Monroe <kmonroe () ITHACA EDU>]

It sounds like the rorpian variant we've seen. An infected machine becomes a rogue dhcp server and changes the dns 
server setting for future dhcp clients of the rogue. When browsing, one is redirected to a "Your browser requires an 
update page in order to view this site" and graciously offers it for download and install. In cases we saw, this was a 
file named updbrowser.exe.
Dhcp snooping technology could indeed help contain. They will need to block the redirected dns traffic as well. One can 
run a rogue dhcp detector utility to track down the rogues and play whack-a-mole if DHCP snooping is not readily 
available. Microsoft has a rogue detection tool one can download to check for rogue DHCP.
Clean up is difficult but we seemed to find doing the "security tango" steps outlined at  securitytango.com could work. 
One of the key things I've seen is deleting the windows profile of the user that ran updbrowser.exe along with all the 
"dance steps" of the tango.
They can email me directly if they want more info. I'm not at the office so I don't have all the details at my disposal.

Kris Monroe, CISA, CISSP
Information Security Officer
Ithaca College


On Sep 2, 2011, at 7:35 PM, Allen Wood <awood () HILLCOLLEGE EDU> wrote:

> I'm sending this on behalf of a neighboring college.  It looks like they need help in a pretty bad way... here's 
> their message-
>
> ****************
>
> We've got a bit of a mess here - not quite sure how we're going to deal with it.  We contract with AT&T to provide 
> internet service in our dorms.  We don't provide tech support to our students for  their personal computers.  Even if 
> that weren't our policy, two techs can't provide technical support to 900 kids (not to mention the other 1900 
> computers we have that are spread over 4 different campuses).
>
> This trojan turns computers into rogue DHCP servers - once the bad IP address has been handed out to a computer on 
> the network, it's then pointed to a bad DNS server - that in turn sends the computer to a website in Romania that 
> displays a web page stating that the browser is out of date and provided a link to an executable file that is 
> supposed to update the brower - and that executable then infects another computer.  It appears we're dealing with a 
> variant of Rorpian.A.
>
> At this point, the network in our dorms isn't operational - it's impossible to connect to the valid DHCP server 
> because there are so many infected computers now.  We don't have any system in place to log or track computers - so 
> even though we can run Wireshark and see the traffic, we have no way of tracking that back to an individual to try to 
> eliminate the rogue servers.  In addition, we've had an ongoing problem with residents of the apartment complex 
> across the street (not associated with us) using our wireless network - and odds are, they're now infected as well.
>
> We've tried 4 different anti-virus/malware products and none have seemed to work as far as cleaning the computers 
> that we deliberately infected in an attempt to find a solution.  So far now, we have our dorm network shut down 
> entirely to prevent further infection - and we have 900 furious students.
>
> We don't have  the manpower to offer to format these student computers - and even if we did have enough people, and 
> were willing to accept the liability, we wouldn't be able to put their software back on.  We're also not comfortable 
> with "suggesting" that the students take their computers to a PC repair shop (even though that's probably the only 
> answer) for the same reason.   Even at that, if one rogue server is still out there, we're going to have the issue 
> again once we turn the network back on.  And what if that rogue server is in the apartment complex that we have no 
> control over?
>
> Anyone have any ideas on how to combat this?  We've been banging our heads against the wall for two days now and 
> admit we may not even be thinking clearing any more.  At the moment we can't think of a way out of this.  Any 
> suggestions would be welcome.
>
> Probably the good news out of all of it is that this will probably either cause the maintaining of the dorm internet 
> to be outsourced, or we'll get the equipment we need to manage it properly.  In the meantime, though, that's not 
> going to help us.
> *******************
>
> I'll be happy to forward on any suggestions or ideas that you may have.
>
> Thanks in advance,
>  
> Allen