gpedit.msc, access denied

Recently four computers in my office (3 XP SP2 and 1 Vista SP1) are affected
by virus win32.sillyFDC. Although the virus is detected and deleted by Norton
anti-virus, something is wrong with all our computers. Here are the symptons:
1 The adiministration tools (event viewer, services, computer management
etc.) in control panel can't be opened. The error messages is
"C:\WINDOWS\system32\eventvwr.msc, access denied".
2 Run gpedit.msc and get "access denied" error. But it works under command
prompt: C:\mmc %SystemRoot%\system32\gpedit.msc.
3 System restore is disabled by group policy.
4 Remote desktop no loner works.
Any help will be greatly appreciated!

Leonard wrote:

Recently four computers in my office (3 XP SP2 and 1 Vista SP1) are
affected by virus win32.sillyFDC. Although the virus is detected and
deleted by Norton anti-virus, something is wrong with all our computers.
Here are the symptons: 1 The adiministration tools (event viewer,
services, computer management etc.) in control panel can't be opened. The
error messages is "C:\WINDOWS\system32\eventvwr.msc, access denied".
2 Run gpedit.msc and get "access denied" error. But it works under command
prompt: C:\mmc %SystemRoot%\system32\gpedit.msc.
3 System restore is disabled by group policy.
4 Remote desktop no loner works.
Any help will be greatly appreciated!

Possibilities:

1. Your computers are still not clean. Go through more thorough malware
removal steps per:

http://www.elephantboycomputers.com/...moving_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. PLEASE DO NOT
POST LOGS IN THE MS NEWSGROUPS.

2. The malware has permanently damaged the operating system. In this case,
wipe and clean-install Windows. An effective disaster plan strategy for
businesses is to create an image of a new working install, perfectly set
up. Your case is an excellent example of when to apply that image to
workstations. You can be up and running in a few minutes and only need to
apply any updates that have occurred since the image was created.

Since data should never be saved locally on workstations, data will not be
lost.

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

"Leonard" wrote:

Recently four computers in my office (3 XP SP2 and 1 Vista SP1) are affected
by virus win32.sillyFDC. Although the virus is detected and deleted by Norton
anti-virus, something is wrong with all our computers. Here are the symptons:
1 The adiministration tools (event viewer, services, computer management
etc.) in control panel can't be opened. The error messages is
"C:\WINDOWS\system32\eventvwr.msc, access denied".
2 Run gpedit.msc and get "access denied" error. But it works under command
prompt: C:\mmc %SystemRoot%\system32\gpedit.msc.
3 System restore is disabled by group policy.
4 Remote desktop no loner works.
Any help will be greatly appreciated!


Run a thorough scan by doing the following steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start Control Panel Double click Network and Internet
Connections Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from he
Download and Update SuperAntispyware and run a complete scan - Free
http://www.superantispyware.com/supe...freevspro.html
http://www.malwarebytes.org/rr-update/rr-free-setup.exe
http://onecare.live.com/site/en-gb/d....htm?s_cid=sah

Run a scan from here on-line:
http://security.symantec.com/sscv6/d...d=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from he
http://www.avast.com/eng/avast-virus-cleaner.html
Comodo BOClean : Anti-Malware Version 4.27
http://www.comodo.com/boclean/boclean.html

Download Hijackthis and analysis the log or send to one of many forums on
the internet!
Download Hijackthis.
(http://www.trendsecure.com/portal/en...hijackthis.php)

HTH,
nass
---
http://www.nasstec.co.uk

I ran into the same issue and fixed the problem by re-associating .msc
files with the Microsoft Management Console (mmc.exe). Navigate to the
C:\Windows\System32 folder and right-click the eventvwr.msc file (or any
.msc file). Choose 'Open With'. If you see the Microsoft Management
Console listed at the top of the next window, click on it to highlight.
If you do not see the Microsoft Management Console, click Browse,
navigate to C:\Windows\System32, and double-click the mmc.exe file.
With the Microsoft Management Console or mmc highlighted in the Open
With box, check the box for 'Always use the selected program to open
this kind of file'. Click OK and see if the issue is resolved.


--
bono
------------------------------------------------------------------------
bono's Profile: http://forums.techarena.in/members/bono.htm
View this thread: http://forums.techarena.in/windows-security/1065754.htm

http://forums.techarena.in

BONO.... thank you so much for the info... it helps a lot...
it works... all i did was follow your instruction and it solved my
problems... with the gpedit.msc...
thanks again and GOD BLESS


--
kateisha
------------------------------------------------------------------------
kateisha's Profile: http://forums.techarena.in/members/kateisha.htm
View this thread: http://forums.techarena.in/windows-security/1065754.htm

http://forums.techarena.in

Thank you BONOOOO
first time i solve a prlbm as quick as today.


--
usefkhoury
------------------------------------------------------------------------
usefkhoury's Profile: http://forums.techarena.in/members/usefkhoury.htm
View this thread: http://forums.techarena.in/windows-security/1065754.htm

http://forums.techarena.in