rogue local policy

[Corky D]

I was advised to post here. I have a client who has SBS 2003 r2. On the VP's
workstation, he downloaded
a cutesy screen saver. Then he removed it. Damage done! He now cant remote
into his workstation. Error message is that the local policy wont permit it!
I have logged on locally as admin and cant turn off windows firewall (greyed
out), which somehow got turned on. Ran all the virus and spyware scans.
Nothing. The remote exception is enabled. I think I might have to wipeout
his workstation and re-install. Not what I want to do. Any suggestions?
Thank You, Corky

 

[Daniel Petri]

Can you take a look at the local GPO? Run GPEDIT.MSC and try to look at
those areas you've mentioned.

Also, it might be useful to find out the name and source of that bugger,
looking for more infor on dedicated forums that deal with malware removal.

While there is a posibility to restore at least parts of the local GPO back,
in some cases a wipe and re-install would be much simpler and safer,
especially if you've got his data backed up properly.

--
Daniel Petri
www.petri.co.il



"Corky D" <astroman707@hotmail.com> wrote in message
news:%23%23zEFHEuIHA.3792@TK2MSFTNGP02.phx.gbl...
>I was advised to post here. I have a client who has SBS 2003 r2. On the
>VP's workstation, he downloaded
> a cutesy screen saver. Then he removed it. Damage done! He now cant remote
> into his workstation. Error message is that the local policy wont permit
> it!
> I have logged on locally as admin and cant turn off windows firewall
> (greyed
> out), which somehow got turned on. Ran all the virus and spyware scans.
> Nothing. The remote exception is enabled. I think I might have to wipeout
> his workstation and re-install. Not what I want to do. Any suggestions?
> Thank You, Corky
>
>
>

 

[PA Bear [MS MVP]]

If you must make identical posts to multiple newsgroups, please cross-post
one (1) message to all of them. Thank you.

Multiposting vs Crossposting:
http://www.blakjak.demon.co.uk/mul_crss.htm
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Corky D wrote:
> I was advised to post here...

 

[Corky D]

Sorry, I didnt know how to cross post. Thank you for your help.

"PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
news:%23FvZp9FuIHA.4528@TK2MSFTNGP03.phx.gbl...
> If you must make identical posts to multiple newsgroups, please cross-post
> one (1) message to all of them. Thank you.
>
> Multiposting vs Crossposting:
> http://www.blakjak.demon.co.uk/mul_crss.htm
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> Corky D wrote:
>> I was advised to post here...
>