removed administrator rights

[lowen]

I had virus/trojans and have managed to run Spybot and Malwarebyte but I have lost my administrator rights.

Any clues??

[Elise]

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

• The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  
• Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  
• The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  
• Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
  

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
    

  [*]Save it to your desktop.

  [*]Double click on the icon on your desktop.

  [*]Click the "Scan All Users" checkbox.

  [*]Push the button.

  [*]Two reports will open, copy and paste them in a reply here:

  • OTListIt.txt <-- Will be opened
    
  • Extra.txt <-- Will be minimized
    

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and re-enable all active protection when done.
  

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

• A detailed description of your problems
  
• A new OTL log (don't forget extra.txt)
  
• GMER log
  

[lowen]

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

• The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  
• Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  
• The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  
• Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
  

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
    

  [*]Save it to your desktop.

  [*]Double click on the icon on your desktop.

  [*]Click the "Scan All Users" checkbox.

  [*]Push the button.

  [*]Two reports will open, copy and paste them in a reply here:

  • OTListIt.txt <-- Will be opened
    
  • Extra.txt <-- Will be minimized
    

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and re-enable all active protection when done.
  

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

• A detailed description of your problems
  
• A new OTL log (don't forget extra.txt)
  
• GMER log
  

OTL.Txt

OTL.Txt

[Elise]

Hello again,

Please rerun OTL, make sure under Extra Registry "use safelist" is checked and rerun the scan. This will create extra.txt. Please post that in your next reply (you posted two times otl.txt now ).

Please run also GMER. If it gives you trouble, try to run it with only the Sections option checked.

Your log shows you are using the following proxy server to connect to the internet: "ProxyServer" = proxy.willand.devon.sch.uk:8080

Can you confirm you are indeed using this?

[lowen]

Hi Elise

Have run the first program and attached the logs. However cannot run second program as it comes up with error not a Win 32 programme.

Hope you can help!

Extras.Txt

OTL.Txt

[lowen]

Hi Elise

Have run the first program and attached the logs. However cannot run second program as it comes up with error not a Win 32 programme.

Hope you can help!

Have tried to run in Safe mode but still comes up with error not a valid Win32 application. Yes proxy is correct. Sorry to have sent a couple of times - new to this!!

[Elise]

Most likely that means the download was not complete. Please try to redownload GMER, and try to run it again.

Please reply using the "add reply" button, not the "quote" button, that makes things easier to read for me, thanks

[lowen]

Most likely that means the download was not complete. Please try to redownload GMER, and try to run it again.

Please reply using the "add reply" button, not the "quote" button, that makes things easier to read for me, thanks

HI Elise

Thanks for the quick response. I have downloaded the program to an external drive and it has now run. Here is the file.

gmer_.txt

[Elise]

Sorry, but this is not the log I need to see

Rerun GMER, and on the main tab (do not change the tab!), make sure the Sections option is checked and click Scan.

Once done, post me the log.

[lowen]

Sorry, but this is not the log I need to see

Rerun GMER, and on the main tab (do not change the tab!), make sure the Sections option is checked and click Scan.

Once done, post me the log.

Ran GMER in Safemode and at the end of the scan there was nothing on the screen. It took about 9 hours to run.

[lowen]

Hi Elise

Bad day at the office!! Obviously running in Safemode does not pick up everything. I am now running again logged on as administrator and already there is something on the screen. Will send another reply when the scan is complete.

[Elise]

Hi Iowen, you need only to run the GMER scan with the Sections option checked This will be a shorter scan.

[lowen]

Hi Iowen, you need only to run the GMER scan with the Sections option checked This will be a shorter scan.

Have attached txt file - hope this helps.

gmer.txt

[Elise]

Hello again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[lowen]

Hello again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[lowen]

Hi Elise

Ran Combo last night but would not allow connection to the internet. Had internet connection before running Combo but as soon as you run it it closes the connection and does not work until a reboot- and therefore unable to download recovery console from Microsoft. Tried to find the download from the Microsoft site to put in on manually but can't find it. Have had to remove all virus software as could not disable (as no administrator rights)

Unable to download any programs from internet to computer now. I get the feeling that it might be just worth reloading windows onto the machine and over-write everything. What do you think??

Have attached the log file

log.txt

[Elise]

Hi please try this In case you have trouble with disabling AV programs, just ignore them.

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Go to Microsoft's website => http://support.microsoft.com/kb/310994

Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

Note: If you have SP3, use the SP2 package.

---------------------------------------------------------------------

Transfer all files you just downloaded, to the desktop of the infected computer.

--------------------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

• Drag the setup package onto ComboFix.exe and drop it.
  
• Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
  
  
• At the next prompt, click 'Yes' to run the full ComboFix scan.
  
• When the tool is finished, it will produce a report for you.
  

Please post the C:\ComboFix.txt in your next reply.

[lowen]

Hi please try this In case you have trouble with disabling AV programs, just ignore them.

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Go to Microsoft's website => http://support.microsoft.com/kb/310994

Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

Note: If you have SP3, use the SP2 package.

here it is

---------------------------------------------------------------------

Transfer all files you just downloaded, to the desktop of the infected computer.

--------------------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

• Drag the setup package onto ComboFix.exe and drop it.
  
• Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
  
  
• At the next prompt, click 'Yes' to run the full ComboFix scan.
  
• When the tool is finished, it will produce a report for you.
  

Please post the C:\ComboFix.txt in your next reply.

COMBIlog.txt

[Elise]

Hello again, can you please let me know how things are running now?

Your logs show you are logged in as Administrator and I do not see any policies or restrictions set. Could you please give me some examples as to what admin rights you do not have at the moment?

[lowen]

Hello again, can you please let me know how things are running now?

Your logs show you are logged in as Administrator and I do not see any policies or restrictions set. Could you please give me some examples as to what admin rights you do not have at the moment?

I have reinstalled McAfee and because there are no administrator rights you cannot disable the software - it is greyed out. In other words the computer does not recognise you as an administrator. It is the same for any user - and even added new user and still does not work.

Had problems downloading software as well.

Any ideas??

[Elise]

Do you have any other issues besides with McAfee? Or is McAfee the only program you cannot disable?

Because, if you were able to install, you definitely have Admin rights. If not, you wouldn't have been able to install the software. I think its more likely your McAfee installation is broken somehow.

What we can do is run a McAfee utility that completely removes any components and then reinstall.

[lowen]

Do you have any other issues besides with McAfee? Or is McAfee the only program you cannot disable?

Because, if you were able to install, you definitely have Admin rights. If not, you wouldn't have been able to install the software. I think its more likely your McAfee installation is broken somehow.

What we can do is run a McAfee utility that completely removes any components and then reinstall.

I have not checked again but before I could not roll back the computer to an early state.

Let's try to uninstall McAfee and see if that works.

[Elise]

Okay, please follow these steps.

Dowload and save McAfee Removal Tool to your desktop.

Run it to remove McAfee. After this, please restart your computer.

[lowen]

Okay, please follow these steps.

Dowload and save McAfee Removal Tool to your desktop.

Run it to remove McAfee. After this, please restart your computer.

Dont think that this is the problem. I cannot download any programmes direct to the laptop. I have to use another machine and put in onto an external hard drive. Cannot even get the webpage open for the McAfee site.

[lowen]

Dont think that this is the problem. I cannot download any programmes direct to the laptop. I have to use another machine and put in onto an external hard drive. Cannot even get the webpage open for the McAfee site.

Hi

Does not work because it is not the consumer version that it running. Work pays for all home laptops to have McAfee professional version.