Warning: Monday is Obamahead day

happygeek 0 315 Views

Some school kids in Louisiana got a surprise last Monday when sitting at their computers: the floating head of Barack Obama on-screen. They were amongst the first to be infected with the Obama-head worm which spreads via USB memory sticks courtesy of the Windows Autorun feature which is causing widespread problems for victims of the conficker worm right now.

Obama-head has not infected millions of computers though, nor has it sunk the Royal Navy, in fact it has hardly made an impact at all. Yet.

Which is hardly surprising seeing as all it seems to do is float that disembodied head of the 44th President of the United States around the bottom of your desktop. What's more, it only does so on Mondays! Trouble is, appearances can be deceptive and suggest that this is such a badly coded bit of junk that it eats up system resources and eventually grinds your PC to a halt, preventing the execution of just about any other files.

Dani AI

Generated

As pointed out, infections that ride on removable media are best handled with quick isolation plus a few low-risk cleanup steps. Below are practical containment, removal and prevention actions for shared Windows machines (schools, labs, kiosks) so the problem can't spread or recur.

Immediate containment and quick cleanup

  • Unplug the machine from the network and eject any USBs. Do not run unknown files or shortcuts.
  • Scan the removable media and the PC with an up-to-date AV on a known-clean system or use a vendor rescue ISO.
  • To remove the common hidden autorun file from a drive (replace X: with the drive letter), run an elevated command prompt and:
cd /d X:
attrib -s -h -r autorun.inf
del /f /q autorun.inf
dir /a

If deletion fails, take ownership first: takeown /f X:\autorun.inf and then retry. After cleanup, format the USB if you cannot guarantee it is clean. (techcult.com)

Disable AutoPlay/AutoRun system-wide
Use Group Policy (gpedit.msc) on managed machines: Computer Configuration → Administrative Templates → Windows Components → AutoPlay Policies → Turn off Autoplay → Enabled (All drives). For scripted or non-GPO environments, administrators can set the NoDriveTypeAutoRun policy under the Explorer policies to disable autorun classes. Prefer policy-based controls over ad-hoc registry edits on many endpoints. (learn.microsoft.com)

Hardening for schools and public labs
Block or restrict USB use with endpoint controls (device control/allowlists), push the AutoPlay policy via domain GPO or MDM (Intune), enforce centralized AV/EDR scans, and teach staff to never run unexpected files from removable media. Regular image backups and a tested recovery plan make cleanup far less disruptive. (cisa.gov)

Caution: when in doubt, image the drive and recover data from known-good backups before trusting a cleaned system. If multiple machines are affected, treat it as an incident and follow your institution’s containment procedures.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview