Virus? - Disable .EXE, .COM, .LNK and group policy.

From: Brian Hoyt (hoyty_at_hoyty.com)
Date: 05/25/05 

Date: Wed, 25 May 2005 05:46:04 -0700

First I want to say I am not interested in removing the problem as I can
reimage machines, I am more interested in figuring out the cause and
prevention methods.

We have recently started seeing behavior on laptops that appears to be a
virus, I am however having great problem tracking it down. The symptoms
include but are limited to:
Disable in registry .EXE, .LNK and .COM
Disable most (if not all) Group Policy settings
Add a security warning on pressing CTRL-ALT-DEL on login screen that is
random characters.
Disable Shutdown from startup screen
Disalbe display of proper icons, I belive this is related to the .LNK but it
doesn't always happen.

Once this happens a user can login to a machine. Applications cannot be
directly started but they can be started via opening an existing document for
example. I have attempted to fix the registry to allow programs to run but I
haven't had any luck.

Some background on the machines. The machines are of varied platforms of
laptops and tablets. All are running custom images and the problem has
ocurred across multiple images. The machines have Symantec Corporate
Anti-Virus and Lavasoft Ad-Aware Plus running in realtime. They are all XP
SP2 with patches within a month or two of recent.

These are all student machines so I don't get a lot of detail of cause. In
almost all cases the machines either have AOL or AIM and sometimes it is the
last thing the students ran. Most describe a burst of network traffic and
then the problem ocurrs. In most cases they continue to work fine until they
reboot and that is when all the links and applications stop working. In a
few rare cases Ad-Aware catches the registry changes and I have been able to
see some of them happen, I have not been able to find the cause though.

Any help or pointers on this much appreciated. If there are any further
details I can offer let me know.

Relevant Pages

  • Use Threaded Display ("Group Messages by Conversation" in OE)
    ... Subject: IE 6 hangs without http:// header in URL ... check of the registry values below confirmed that they did not ... Norton Internet Security 2004 to Internet Security 2006. ... The two machines are disseperate machines. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Home Networking Again
    ... From the Dell, ... In both machines, I can ping the router and both machines ... The Compaq lists the Dell when I look at the Network ... Have you used the Registry Editor before? ...
    (microsoft.public.windowsxp.network_web)
  • "google" will open "http://www.google.com"
    ... check of the registry values below confirmed that they did not ... Windows XP Professional SP2, ... Norton Internet Security 2004 to Internet Security 2006. ... The two machines are disseperate machines. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Exceptional Error - Custom Menus deleted at startup of Access
    ... One MVP told me to delete all the keys in command bar key of ... > I had gone through this Registry settings as well, ... >> be making this kind of problems then why other machines are NOT ... >> It is possible that the updates are not able to get installed correctly ...
    (microsoft.public.access.formscoding)
  • Re: Local networking problems on XP
    ... >trying to connect my laptop and desktop using an ethernet cable. ... >machines are running Windows XP home. ... Make sure the browser service is running on the desktop computer. ... Have you used the Registry Editor before? ...
    (microsoft.public.windowsxp.network_web)