I also got him to check there weren't any active Software Restriction Policies in gpedit.msc but that showed none are defined. We did manage to uninstall Avast in this mode though, which we couldn't before. HKCU\Software\InstallCore|tb () -> Data: 0O1O1FtGtCtH1T1M1R1XtGtB -> No action taken.Ĭ:\Users\Steve\AppData\Roaming\Babylon () -> No action taken.Ĭ:\Users\Steve\AppData\Roaming\Babylon\log_file.txt () -> No action taken.Įven in Safe Mode with Networking there's still no Internet Access, so I can't TeamViewer in and fix anything and my brother will have to reboot to the VHD to upload any diagnostic logs we create. HKCU\SOFTWARE\INSTALLCORE () -> No action taken.
HKCU\Software\BabSolution\Updater () -> No action taken. HKCU\Software\DataMngr () -> No action taken. HKCU\SOFTWARE\DataMngr_Toolbar () -> No action taken. Windows 7 Service Pack 1 圆4 NTFS (Safe Mode) Whilst the outdated MBAM running from the infected Windows did identify some problems: Time elapsed: 1 hour(s), 40 minute(s), 45 second(s) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM MBAM from the VHD scanning the infected Windows didn't find anything: So if someone could advise and assist, that would be much appreciated. I've also downloaded Combofix.exe, dds.scr, OTL.exe, Securit圜heck.exe and _windows_repair_aio.zip, as I can't download anything from the infected Windows but I understand I need to boot into that to run them and I'm not sure I'll be able to. Luckily I put a VHD on his system, so I'm booted to that now so that I could download and install/update MBAM and I'm running that scan. He said he updated Avast the other night, although he had an error from that sometime about being unable to access the DNS server so maybe it didn't actually update. It seems it was intermittent for a while and he managed to use Iron Portable to access the Net but now even that doesn't work.
So my brother appears to have picked up a virus that is preventing him doing anything, accessing the Internet, uninstalling software, etc as every time he tries it says the Group Policy does not allow him to and he should contact his System Administrator.
0 kommentar(er)
