Ask Bloggie

Home / News & Blogs / Ask Bloggie

How do you stop Sony's rootkit at the office?

By | November 15, 2005, 10:30am PST

Summary: Companies are not helpless against Sony’s rootkit; they can preemptively stop it in the first place with Active Directory Group Policy.

Some colleagues of mine were asking me how to stop CDs from auto-playing which allows something like Sony’s rootkit to install on their computers.  The solution is actually quite simple and effective with Microsoft Active Directory Group Policy.  It’s easy to disable auto-play from every single computer in the Enterprise globally with just a few tweaks in Group Policy and here’s how you do it.  The same technique works for individual PCs as well.

Open up the "Active Directory Users and Computers" console.  Right click on the top of the Active Directory and click "Properties"

Jump to the "Group Policy" tab, highlight "Default Domain Policy", and then click "Edit".

Expand "Computer Configuration" as shown below and click on the "System" folder.  On the right hand pane, double click "Turn off Autoplay".  Note that home users can jump to this screen by typing "gpedit.msc" from their "Start-run" prompt.  If you’re not sure what that means, it’s probably not a good idea to mess with "gpedit.msc".

Choose "Enable" and select "All drives" to turn auto-play off for any device including CD and DVD drives and hit "Apply".

Close everything out and every computer on your domain is protected against auto-play and the Sony rootkit.  Any business or organization that is serious about security should do this immediately.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Ask Bloggie”

Topics

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
Ask a Question Start a Discussion
25
Comments
Add Your Opinion

Join the conversation!

Just In

Wish I would have bought one of these CDs
Anthony S. 20th Jan 2006
Would have been neat to just "innocently" play the music on my school's computers...
View in thread
0 Votes
+ -
Alternative Method.....
JoeMama_z 15th Nov 2005
You can use software restriction policies, to;

a. block the Name of the installer executable ( assuming its not something generic like setup.exe or somthing), and possibly the runtime (this may take care of the computers already "infected", although i am not sure of the potential for this to cause stability issues)

b. import the hash value of both the setup file and the executable and restrict access that way.

as always test test test.

disinfection could easily be carried out via wmi filtered computer startup script policy.

enumerate the services and if the DRM service is found run script X.vbs.

Windows 2003 kicks ass.

- Sam

- Sam
0 Votes
+ -
Again where credit is due...
ju1ce 15th Nov 2005
What's funny is.. I did not know you could actually use an internal application to turn off auto-run.

I've grown accustomed to doing it via regedit and setting it to 0 in order to get the desired affect. Even found some other interesting things in there.

E.G.:

I usually go to HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Cdrom.

Edit the Autorun value to '0' disable autorun.
0 Votes
+ -
if you wanted....
JoeMama_z 15th Nov 2005
you could import the registry setting and apply it via group policy (and even assign permissions to it).
0 Votes
+ -
This is the easiest method
george_ou 15th Nov 2005
I know there are many other ways to do this, you can even do it one at a time via graphical interface or deploy a registry modification.

This method is by far the easiest to set this across the entire enterprise on the fly.
0 Votes
+ -
Agreed... Seems relatively simple (NT)
ju1ce 15th Nov 2005
Then again I'm by far a networking guru with Windows and Security. Just a plain old programmer learning Networking as I go.

Great stuff nonetheless. Good for future reference.
0 Votes
+ -
network guru?
kckn4fun 17th Nov 2005
You're a networking guru, but you didn't know that?

Maybe you should rephrase that to say that you are a guru of things *not* active directory... this is 101 in Domain restrictions and has been available since NT4 on stand alone as well as domain machines.
0 Votes
+ -
He said "by far" a network guru
george_ou 17th Nov 2005
Just to clarify, he said:

"I'm by far a networking guru with Windows and Security. Just a plain old programmer learning Networking as I go."

George
0 Votes
+ -
No kidding.. Some people just can't read I guess.. (NT)
ju1ce 18th Nov 2005
(NT)
0 Votes
+ -
in your case juice
dguith@... 18th Nov 2005
can't write--apparently what you wrote isn't what you meant---happens w/4th grade educations
0 Votes
+ -
Seems like more work than George's suggestion (NT)
ju1ce 15th Nov 2005
(NT)
0 Votes
+ -
Suggestion for George
kckn4fun 17th Nov 2005
...hey dude, in the little time I've been reading your articles I've come to appreciate your straight up *no bias* reporting style, unlike certain other ZDNet writers... that said, consider me a fan.

Now my suggestion:

Modify this article to include ALL XP users. I'm sure there are stand alone PC users that would love to do this. Soooo... to do it on a stand alone PC:

1) Click Start > Run
2) Type MMC, Hit Administrative Settings"
11) Click on the "System" setting and you should see the same thing as what you have spelled out in your article...

....Happy trails to *most* laptop and stand alone PC users!

-RS
0 Votes
+ -
Easier than that for standalone
george_ou 17th Nov 2005
If you look at the middle of my instructions, you'll notice in BOLD that you can use the GPEDIT.MSC command to jump in and skip some steps.

Thanks for your note though.
0 Votes
+ -
Are you certain it works?
brilang 18th Nov 2005
I started gpedit.msc as you mentioned in your article (in bold) and browsed down to the Turn off Autoplay entry. I highlighted the entry and then started reading the help text beside it (also available by getting the properties for "Turn off AutoPlay" and selecting the Explain tab). At the very bottom of the explanatory text is this note:

Note: This setting does not prevent Autoplay for music CDs.

So, I ask you again, ARE YOU CERTAIN THAT THIS WORKS????
0 Votes
+ -
This will sort of work
joe.brockman@... 18th Nov 2005
All it will do is prevent the CD from running automatically. If someone manually clicks on play with the CD in it will play and then install the rootkit. All this does is stop everything from happening automatically.
Joe
0 Votes
+ -
Not for XP Home!
PB_z 18th Nov 2005
"Note that home users can jump to this screen by typing "gpedit.msc" from their "Start-run" prompt"

Just a note: XP Home edition doesn't support gpedit.msc.
0 Votes
+ -
There is more to the Sony thing.
Rocas 18th Nov 2005
I have had some real disputes with them st which point they cut off my email service. I had a lawyer go at them but did not get to far. I do not know how MNS can allow there programs to run alongside Sony. We go back with the lawyers end of January. Sony is just a sales gimmick to sell their highly marked up goods and services. I will never ever deal with Sony again. In fact does any one want to trade one disc Windows XP for six Sony discs covering the same.
0 Votes
+ -
Sony is just a sales gimmick...?
gardoglee 18th Nov 2005
From your post I'm not sure just what your issue is with Sony, nor how it relates to their sneakware practices, but I think it is a bit odd to label them as bad because they are "a sales gimmick to sell their highly marked up goods and services". That's pretty much what all consumer goods companies are in business to do, isn't it? You produce something, you sell it for as much more than it costs you to make as you can, and then you make some more, repeat, repeat, repeat. I'm a bleeding heart anti-corporate liberal, and I hope the California AG kicks Sony's butt over the sneakware thing, but even I don't see what your issue is.

I expect companies which produce something of value which costs them to try to make a profit on the deal. I just also expect them to limit their behavior to what is within the law, and to give me a reasonable warning of what it will cost me (both in price and in messing up my machine/privacy/health/life) to use their product.
0 Votes
+ -
My office banned all music and video CD's
kraterz 19th Nov 2005
Thanks very much Sony, my office has now banned all music and non work related CD/DVD's from the work place.
0 Votes
+ -
XP Home Threat and Sol'n
svasutin 19th Nov 2005
While there is no doubt Admins need to worry, and companies need to ensure their security and privacy, there is also a threat from home users.

The millions of home systems at risk can be used as bots.
For my 'Home' clients, since there is no policy tell them:
1) download powertoys TweakUI from Microsoft.com
2) Install TweakUI
3) Click Start | Programs | PowerToys | TweakUI
4) Click the '+' by 'My Computer'
5) Click 'Drives'
UnCheck All Letters
Click Apply
6) Click 'Types'
UnCheck 'AutoPlay for CD and DVD drives'
UnCheck 'AutoPlay for removable drives'
Click Apply
Click Ok

Additionally, it is a good idea to disable 'Shell Hardware Detection'
Click Start | Run
Type:
services.msc
Click Ok
On the right-side of the window, scroll down to
'Shell Hardware Detection'
Double-Click 'Shell Hardware Detection'
Click the 'Stop' button
In the 'Startup type:' field select 'Disabled'
Click Apply
Click Ok

Reboot

It is not a bad idea for Corporate IT to email its users about the threat and CD List. In addition, include the instructions above, or provide a reg/cmd file for users to run at home.
Tell them to run an online virus/spyware scan to ensure their systems are safe.

http://housecall.trendmicro.com
http://www.trendmicro.com/download/dcs.asp
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?dc=12bms&ctry=US&lang=en
http://securityresponse.symantec.com/avcenter/FixRyknos.exe

BTW, av companies are not making clear the threat is from Sony/BMG/Columbia/Epic, it is sometimes being called a first4 UK issue, not a Sony Label Music CD issue.
0 Votes
+ -
Home Threat and Security Sol'n
svasutin 19th Nov 2005
While there is no doubt Admins need to worry, and companies need to ensure their security and privacy, there is also a threat from home users.

The millions of home systems at risk can be used as bots.
For my 'Home' clients, since there is no policy tell them:
1) download powertoys TweakUI from Microsoft.com
2) Install TweakUI
3) Click Start | Programs | PowerToys | TweakUI
4) Click the '+' by 'My Computer'
5) Click 'Drives'
UnCheck All Letters
Click Apply
6) Click 'Types'
UnCheck 'AutoPlay for CD and DVD drives'
UnCheck 'AutoPlay for removable drives'
Click Apply
Click Ok

Additionally, it is a good idea to disable 'Shell Hardware Detection'
Click Start | Run
Type:
services.msc
Click Ok
On the right-side of the window, scroll down to
'Shell Hardware Detection'
Double-Click 'Shell Hardware Detection'
Click the 'Stop' button
In the 'Startup type:' field select 'Disabled'
Click Apply
Click Ok

Reboot

It is not a bad idea for Corporate IT to email its users about the threat and CD List. In addition, include the instructions above, or provide a reg/cmd file for users to run at home.
Tell them to run an online virus/spyware scan to ensure their systems are safe.

http://housecall.trendmicro.com
http://www.trendmicro.com/download/dcs.asp
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?dc=12bms&ctry=US&lang=en
http://securityresponse.symantec.com/avcenter/FixRyknos.exe

BTW, av companies are not making clear the threat is from Sony/BMG/Columbia/Epic, it is sometimes being called a first4 UK issue, not a Sony Label Music CD issue.
0 Votes
+ -
Adminstrator Privileges
debater 20th Nov 2005
I would suggest, if it isn't too obvious, that the primary means by which an office network should be protected from infection by XCP (and other disk-borne malware) is to make sure that all normal users do not have adminstrator privileges. The XCP software (including the rootkit) cannot install without adminstrator privileges.

I would also respectfully suggest that just globally disabling autoplay may not be such a good idea. If your office has many users who might be flummoxed by putting in a CD-ROM (containing something innocent, such as a training course) expecting it to 'work' and finding it doesn't, expecially if they have used such a disk previously, then globally disabling autoplay could cause a lot more trouble than it saves.

If all such users' administrator privileges are removed instead, that will be a better and surer way to protect the office network.

To check if a computer is already infected, I suggest either an up-to-date virus checking program or RootkitRevealer:

http://www.sysinternals.com/Utilities/RootkitRevealer.html

Read the information on this site, and also:

http://www.sysinternals.com/Blog/
0 Votes
+ -
Agreed
george_ou 21st Nov 2005
I completely agree with you. There are some organizations who won't do this and they need an alternative. This is the easiest emergency procedure available.
0 Votes
+ -
registry method
terrym0021 23rd Nov 2005
1. Run the "Registry Editor" ("Start | Run | RegEdit.exe | ENTER")
2. Select "HKEY_LOCAL_MACHINE
\System\CurrentControlSet
\Services\CdRom"
3. Double click on "Autorun"
4. Change the value from "1" to "0"
0 Votes
+ -
Rootkit? whats the point of it?!
jesus_of_suburbia344 6th Dec 2005
well it's sony's fault the bloody rootkit came out, and then wreaked havoc an all of our computers

isn't there a way to like, wipe the strings off the program, but still keep it?
0 Votes
+ -
Wish I would have bought one of these CDs
Anthony S. 20th Jan 2006
Would have been neat to just "innocently" play the music on my school's computers...

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix