Avatar of skitterling
skitterling
Flag for United States of America asked on

No safe mode, disabled regedit, disabled task manager, gpedit does not have entries needed to fix

have a dell latitude d810 with XP sp3.  seem to have a virus which has disabled regedit and task manager.  can't boot into safe mode - get a blue screen stop error 0x0000007B which says may have a virus.  when I go to gpedit.msc to re-enable regedit and task manager, under user config:administrative templates:there is only windows components.  it does not show system options.

ran malwarebytes anti-malware - found Backdoor.Bot, quarantined and deleted successfully
Anti-Virus Apps

Avatar of undefined
Last Comment
skitterling

8/22/2022 - Mon
epochasset

Did you try booting with last-known good config option on the bootup F8 menu?
skitterling

ASKER
Yes.  It did not make a difference.
epochasset

Try resetting local group policy to defaults.  This procedure should work, http://escapelogic.com/main/node/2.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
Detoxicated

First of all, check the filtering options in Group Policy - Administrative Templates (Right Click - View - Filtering - Make sure that nothing is filtered).

If this is not the case, do the following:
1. Right click Administrative Templates under User Configuration
2. Choose Add/Remove Templates
3. Click the button that says "Add"
4. If the window does not already take you there, browse to %windir%\inf\ (ie. c:\windows\inf\)
5. Choose the system.adm template
6. Click the button that says "Close"
epochasset

Also another solution to resetting group policy is to simply delete the %Systemroot%\System32\GroupPolicy folder and reboot.  See https://www.experts-exchange.com/questions/21988937/Reset-XP-work-station's-local-group-policy-to-default.html.
skitterling

ASKER
tried resetting group policy to default - made no difference.  I'll try to delete the folder.  I'll also check filtering options in group policy to see if that's set.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
skitterling

ASKER
okay, enabled system.adm and made sure regedit setting were okay.  rebooted.  still no joy - everything's still disabled.
skitterling

ASKER
epochasset - there is no grouppolicy folder to delete in that location.
DezzyMelb

Try making a backup of the profile that is affected by logging in as another user (You may need to reboot) and renaming that users profile folder located in %Systemroot%\documents and settings\. By doing this the next time you log onto the computer you computer will start a fresh profile. All you need to do from there is copy your fav's documents desktop and any other items you have in your old profile to the new one.

Be sure to virus scan your old profile items prior to copying them back to the new one.

One example would be if you normally logged in as skitterling with luck there will be a folder in %systemroot%\documents and settings called skitterling all you need to do is log in as an admin and rename this folder to skitterling.old. With any luck When you next log in as skitterling your profile and settings will be set back to default. all you need to do then is copy your desktop fav's and documents from the skitterling.old folder to the new skitterling folder.
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
DezzyMelb

Don't forget you will need to setup any mail clients and other specialised software IE MSN and outlook.
skitterling

ASKER
thanks DezzyMelb, but this problem is present on all profiles on this laptop.
DezzyMelb

Have your attempted to delete the Default or all users profiles?
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
skitterling

ASKER
DezzyMelb, I have to admit, I don't see what profiles have to do with most likely having a boot sector virus.  Can you explain?
DezzyMelb

I was under the assumption that because you could access the computer you have already repaired the Boot sector issue and was attempting to restore access to your registry and group policy to remove the windows side of the virus?

Is this not the case?
skitterling

ASKER
Not the case.  I can't seem to get rid of the virus.  I can access the computer as normal except in Safe Mode.  While in XP however, regedit and task manager are disabled and I have not been able to get them re-enabled.  Without those tools, I have not been able to find the virus to get rid of it.
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
skitterling

ASKER
hey all, I'm going offline, I'll be back at this at 8:30am EST.  I will gladly try any suggestions I find when I get back.  Thanks in advance!
Detoxicated

You can use Panda Active Scan to detect what kind of "malicious software" you are dealing with: http://www.activescan.com. It is one of the best free tools out there so if I were you I would try a complete system scan.
skitterling

ASKER
back online!

Thanks Detoxicated, I'll try that now.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
skitterling

ASKER
Panda Active Scan won't update and, therefore, won't scan.  Sigh...

Any other suggestions, anyone?
Detoxicated

What do you mean by "won't update"? Do you get an error message? I have just run a full system scan in my machine and worked perfectly...

If you want to "cure" your machine, the first thing that you need to do is use the best antivirus software out there.

I would definitely recommend Panda Active Scan since it's free (at least for viruses, worms and Trojans) and has minimum installation needs.
skitterling

ASKER
No error message.  I downloaded and installed the piece Active Scan wants you to, then it goes to the screen that says it is updating, but nothing updated or happened for over an hour.
Your help has saved me hundreds of hours of internet surfing.
fblack61
epochasset

Download a program called security task manager here, http://www.neuber.com/taskmanager/index.html.  When running it your looking for anything with very high ratings, meaning they are suspect as being malicious.  Look for anything in the high ratings that is not something you would expect to be installed.  If anything sticks out see if its corresponding file is present on the filesystem.  With most viruses you wont be able to find the file as its being hidden, but you can kill it from within security task manager then try and rename the file via a command prompt.  Once killing everything try running virus scanner updates, etc again, and if you are able to rename (to keep from loading) anything malicious you may be able to boot without the affective issue.
epochasset

For example, not more than a week ago I had a workstation which after a few minutes post bootup it would stop wanting to load any new programs.  Security task manager showed a DLL running in System32 which I could not find (was running in kernel mode).  I was able to kill it with security task manager and then rename the dll from a prompt (if you cant see the file it doesnt mean you cant do stuff to it from a prompt).  After rebooting it did not load again, and the workstation hasn't had an issue since.
warturtle

Hmmm.. I have read all the comments and would suggest you to download ComboFix and save it with a different name like CoF.exe or something different from the actual filename. Then disable your antivirus and firewall and run it. Do not use mouse or keyboard while its running though. The virus that you might have in your system might prevent the installation of antiviruses if it can recognise the name, so best to rename all scanners and use.

Secondly, download SuperAntiSpyware, update it and do a scan. Don't forget to change the name after downloading though.

Thirdly, you can send us a HijackThis log after doing the scans, that will help us see what is still left on your system.

Hope it helps.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
ASKER CERTIFIED SOLUTION
skitterling

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.