Admin account restricted - missing control panel

[BBCMember]

A client of mine has a system whose administrator account has been restricted. No Windows Update, no Control Panel, can't RIGHT-click on My Computer and select Properties.

Solution?

 

[stash]

Restricted by what? Group Policy? Is it a member of a domain? If so, talk to the admins.

 

[BBCMember]

There are no admins. This system is in a home office. I've already done scans with the following programs:

Ad-aware
SUPERAnti-Spyware
Trojan Hunter

They all found threats. And AVAST found a couple of Trojan Horses, which were quarantined.

Same issue still exists.

 

[mechBgon]

First thing to do: back up all important data. Emails, contacts, files, bookmarks, etc.

 

[stash]

If this machine is not a member of a domain, and the owner did not make those changes himself, that box needs to be blown away. Those sorts of changes do not happen out of the blue, and the machine is almost certainly been owned. Backup the critical data and reinstall.

 

[bruceb]

You already said you found multiple issues with the Spy, Virus & Trojan programs.
If in fact that is the case, back up all the important personal data & prepare to
reinstall the OS to the computer ... once everything is back up and ok make an
Image with Acronis TruImage or Ghost so you have something to restore to when / if
it or something new happens again. Of course, if new images are not done on a regular
basis, personal data files will not be up to date, as will any newly installed programs put
in after the image was made.

 

[mechBgon]

Also, educate the user that "all that glitters is not gold" and see if you can get them onto a Limited account for daily-driver purposes and keep other people out of the Admin account.

 

[BBCMember]

I ran the following programs:

Ad-aware
Spybot
SUPERAntispyware
AVAST
Trojan Hunter

They all found threats, which were removed.

I was able to get Control Panel back and can now access MY COMPUTER>PROPERTIES again (Spybot fixed this). But I still can't access Windows Update, nor can I run gpedit.msc.

Do you still suggest to just reinstall the OS? What about a repair install?

 

[BBCMember]

Just so you know, this system has XP Home, which does not have gpedit.msc. How can I get access to Windows Update again, and get the links back (missing from IE, and get an error when I go to windowsupdate.com)?

 

[mechBgon]

I agree with stash, nuke it.

 

[RebateMonger]

Also, consider installing Windows Home Server on a PC in the home office. That'll give you automated data backups onto redundant hard drives, as well as the ability to restore a PC to an uncontaminated earlier state.

 

[Tarrant64]

When did this start?

There were a few new spyware/malware/viruses that prompted a few updates from Symantec, Adaware, Spybot, etc. just a few days ago. I know because a user at my work was foolish enough to click on a popup that said, "Hey, idiot, you might have spyware. Why don't you click on this link and allow me to take control for you and take care of that problem for you? Come on, do it." (not worded exactly, but you get the point).

When I initially ran scans, nothing was found. I didn't realize the updates were a couple weeks behind, did some research, did the updates. I ran the scans again and what was found was exactly what the definition updates were for. Trojan.KillAV(old, but recently updated), as well as a few other *.exe programs possibly resulting from the same virus(printer.exe found in c:\windows\ as well as something similar to winavex.exe, also found autorun.exe found in startup folder for 'All Users').

"Operation has been cancelled due to resirictions in place by the administrator" - or close to was the message given when trying to do anything. A repair install of the Windows OS didn't help either, it actually gave that error.

When I get into work Monday morning i will be nuking it. I was stubborn and wasted 4 hours on it Friday morning.

 

[BBCMember]

Took your advice and did a format and install. Was almost done when I tried installing Roxio Easy CD Creator 6, and messed up the install. The system would not boot up via normal or safe mode. So, I am attempting to do a repair install, but not sure if it will work, or if I will be able to successfully uninstall Roxio after the repair.

Should I stick with the repair install of the OS if it works (if everything works and I can successfully uninstall Roxio), or will it definitely create havoc, even if it seems like it will work at first?

 

[BBCMember]

The repair install seemed like it worked, but when I went into Add/Remove programs to uninstall Roxio, NOTHING appeared. It was blank. When I rebooted, it did the same thing ( would not boot up fully).

Have to do a reinstall again.

 

[bruceb]

Roxio 4 thru 6 have had some issues ... Roxio 6 even had a major patch put out
about 1 1/2 years back. Best suggestion is not to use Roxio 6 but the latest version
if you really like the Roxio products. Myself, I prefer Nero 6.6 .. Nero 7 is way to
gaudy, takes up way too much space and in my view (and others) doesn't work that
well. Nero had issues with audio burning in V7 that was not present in V6 and I do
not know if that was solved yet.

 

[BBCMember]

OK. Thanks for the info.