[Closed] Microsoft GROUP POLICY (MGP) gone ROGUE via unidentified Hack

Good evening/morning - In summary, I bought a HP Pavilion Media Center m8430f PC a year and a half ago to be used for recreational purposes only. I am the sole owner and user of my PC and in no way is my PC used by any other friends/family/housemates. MY PC is used for gaming, editing photos and video and surfing the web. I have never used my PC for work (except emails). I also live alone and all my friends and family are computer illiterate meaning they can barely turn on a computer by themselves. I am above avg regarding my computer knowledge and ever since I began trying to figure out what was wrong with my PC only a month after I bought it, my skills have increased exponentially. Please..this is no joke and everything Im noting is true. Ive asked for help on several of these sort of sites and Ive bought several books, but have yet to solve my problem.. If you're asking why would someone do this to my computer and the answer is that I lived in a shady middle class neighborhood which I think people didnt like my ex-wife or my barking lab at night and I was broken into many many times while at work (found out w/ hidden cameras months later.)…had $2,000 dollars worth of computer games and sofware stolen. but I never disrespected anyone in the area, I have no enemies that Im aware of and I have never been arrested . My driving record is even fine, SO Im clueless . And I welcome anyone to come onto my PC remotely to have look for yourself. I have logs and documnets proving my theory. My exwife moved out a year before I bought this PC and she lives far away now and there is no incentive for her to have any part in this…We arent even enemies anymore.

PROBLEMI - As simply put as possble, my ENTIRE PC's registry is rebooted/re-confugured via Microsoft GROUP POLICY (MGP) objects every 90 minutes or so with an unidentified set of controls/parameters/ settings, ect. and NOONE will assist me in removing / deleting and/or even taking back control of the MGP so that I can finally secure my PC again. I bought the factory discs and the disc drive went crazysomehow and ruined the discs (this sounds nuts, but a hacker configured my PC to defend against any type of restore or factory reset/reformat. Again, I failed counyless times at trying to restore my computer. .I could write forever telling you all the things that have went crazy on my computer, but I will let you ask me relevant questions rather than me blab on about non-pertinent information.

I know my Operating system, which is VISTA HOME PREMIUM doesnt have some parts of the MGPO, but TRUST me they are hidden. THis hacker who is in charge of this operation is a GENIUS, SO please please please, take a look for yourseld and help me egt my computer back to normal…. my email removed,MrC


I will give my cell phone too you or use a neighbors computer b/c obviously all of this Im sending you will be seen by the hacker/enemy. I would love to tell anyone some of the amazing things that was done using ths MGP remotely…INCREDIBLE

THANKS, Kevin

[external image: Posted Image]

First of all: Never post your email address in a public forum.


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.



Please do not delete anything unless instructed to.


We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache


Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  [external image: Posted Image]
• When the scan is complete, click OK, then Show Results to view the results.
• [external image: Posted Image]
• Then click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste". .

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic