Conficker scanner - using Bonn University's scs in a Windows environment

This post is based on information in ZD Net's article this morning
http://blogs.zdnet.com/security/?p=3043&tag=nl.e589

I followed these steps successfully on two machines, a Windows XP SP3 workstation and Windows 2003 SP2 server, and scanned three subnets in a few minutes.

Overview of steps:

• download and install ActiveState Win32 Python
• download python Crypto module
• download and install python Impacket module
• download, extract and run scs.py

create a working directory for downloads and builds. I used
c:\Download\ConfickerTools

ActiveState python
- download the .msi into the working directory
http://downloads.activestate.com/ActivePython/windows/2.6/ActivePython-2.6.1.1-win32-x86.msi
- install the .msi
- accept the defaults (it will install in C:\Python26)

python Crypto module
- make sure Python is installed first
- download into the working directory
http://www.voidspace.org.uk/downloads/pycrypto-2.0.1.win32-py2.6.exe
- run the executable. it should find the Python26 installation and install there

python Impacket module
- download into the working directory
http://oss.coresecurity.com/repo/Impacket-0.9.6.0.zip
- extract the .zip file, preserving the directory structure
- open a command prompt
- change into the extracted directory,
e.g., cd C:\Download\ConfickerTools\Impacket-0.9.6.0
- at the prompt enter
python setup.py install
python will build the module and install it into its library directory

simple conficker scanner (scs)
download from Bonn university, Germany, into the working directory
http://iv.cs.uni-bonn.de/uploads/media/scs.zip
extract
run the tool using the start and end addresses on your LAN, and redirect the output to a text file
e.g.
scs.py 192.168.1.1 192.168.1.254 > scs-out_192-168-1-0.txt

examine the output file for any infected machines

script to apply Citrix patches

This script applies patches patches to Citrix Presentation Server / XenApp server. It iterates through patch files in the current directory, examines the registry to determine whether the patch has already been applied, and applies it if not found.

Patches are available from
http://support.citrix.com/product/xa/

recommended use:

• download the patches
• paste the following script into a .cmd file in the patch directory (e.g, insthfx.cmd)
  
• the script defaults to Presentation Server version 4.5 on Win2003: if your Citrix version is different or on a different OS, edit the variables under the :setup label (hfxProductVersion or hfxOSVersion) accordingly
  
• logon to the Citrix server with administrative credentials
• ensure no other users are logged on
• run the script
  

This script has been in production for about a year on several different Citrix farms. Feel free to use or modify at your own risk - if something blows up, you have my sympathy. Applying any patch can cause problems with a system: I've had R03 misfire only one server, but that required removing and reinstalling PSE.

@if .%ECHO%. equ .. echo off
rem //
rem // script to apply Citrix XenApp (nee Presentation Server) patches
rem // copy script into directory with .msp files
:setup
setlocal
rem // XenApp 5 uses prefix XAE
set hfxProductPrefix=PSE
set hfxProductVersion=450
rem // 64-bit patch version appends x64 to OS version
rem // e.g., W2K3X64
set hfxOSVersion=W2K3
set hfxRollupPrefix=%hfxProductPrefix%%hfxProductVersion%%hfxOSVersion%
:start
rem //
rem // change into the directory where this script is located
rem // (and where the patches are located)
pushd %~dp0
rem //
rem // disable logon
rem // it would also be nice to check for logged-on users
rem // -- maybe later
change logon /disable
rem //
rem // find latest rollup
rem // (iterate through all the rollups in name order
rem // the variable will be set to the latest one
rem // when the iteration is complete)
for %%a in (%hfxRollupPrefix%R*.msp) do set hfxRollup=%%~na
rem //
rem // extract rollup version number
rem // (last three characters of file name)
set hfxRVersion=%hfxRollup:~-3%
rem //
rem // install rollups first
call :hfx %hfxRollup%.msp
rem //
rem // install post-rollup hotfixes in order
for /f "tokens=*" %%a in ('dir /on /b %hfxProductPrefix%%hfxProductVersion%%hfxRVersion%%hfxOSVersion%*.msp') do call :hfx %%a
popd
change logon /enable
goto :cleanup
:cleanup
rem //
rem // reboot after 60 seconds
if /i .%1. neq .noreboot. start shutdown.exe -f -t 60 -r
goto :end
:hfx
set hfxpkg=%*
set hfxpkgname=%~n1
rem //
rem // find out whether the patch is listed in the registry
rem // reg.exe returns 1 if not found, 0 if found
reg query HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\ProductCodes\Hotfixes\%hfxpkgname% > nul 2>&1
if %ERRORLEVEL% == 1 (
echo installing %hfxpkg%
start /wait msiexec /update %hfxpkg% /qn /norestart
choice /t:20 /d:y /c:y
)
goto :eof
:end