Windows group policies help

[Faz]

I've got a mates laptop to fix, it had various viruses and ad/spy ware. I have cleaned this up but the windows firewall is switched off and cannot be switched on as it is being controlled by "group policies" is there a way i can change this policy to enable the firewall.

It's running winxp home.

I've tried to start in in services, but it still won't enable.

Any one any ideas apart from a re install?

Cheers

Faz

 

[M0KUJ1N]

gpedit.msc, computer configuration,Admin templates,Network,Network Connections.

Check that "Prohibit use of IFC on your DNS domain" is set to "not configured"

Then go into the "Windows Firewall" tab, Standard Profile and make sure everything there is set to "not configured".
Do the same for "Domain profile".

Robert should be your father's brother

 

[Faz]

Thanks for the reply, unfortunately gpedit is not recognised

Maybe it's because Robert is my father

 

[M0KUJ1N]

using XP Home then? Try opening "My Computer", to to Tools, Folder Options, View and tick "show hidden files and folders" and untick "hide protected system files". Go to "C:\Windows\System32 and move the "GroupPolicy" folder somewhere else i.e. your desktop. open a command prompt and type "gpupdate /force". Not sure if this will work on an XP Home machine but worth a try. Of course the next question is how did it get group policy applied to it in the first place!

 

[Jonny69]

using XP Home then? Try opening "My Computer", to to Tools, Folder Options, View and tick "show hidden files and folders" and untick "hide protected system files". Go to "C:\Windows\System32 and move the "GroupPolicy" folder somewhere else i.e. your desktop. open a command prompt and type "gpupdate /force". Not sure if this will work on an XP Home machine but worth a try. Of course the next question is how did it get group policy applied to it in the first place!

Don't know but I've seen it too. I can't remember which spyware caused it but the firewall was off permanently and controlled by group policy. I could override it by setting up another group policy to make sure the firewall was always on whether it was switched off manually or not. It was a bit of a bodge but it worked.

 

[Faz]

using XP Home then? Try opening "My Computer", to to Tools, Folder Options, View and tick "show hidden files and folders" and untick "hide protected system files". Go to "C:\Windows\System32 and move the "GroupPolicy" folder somewhere else i.e. your desktop. open a command prompt and type "gpupdate /force". Not sure if this will work on an XP Home machine but worth a try. Of course the next question is how did it get group policy applied to it in the first place!

There's no group policy folder lol.

He bought it of the company he used to work for, could it have been set up by them?

 

[M0KUJ1N]

If it's XP Home it won't be able to join a domain so dont think thats the problem.

I'm starting to think the "group policy" is a red herring tbh- when group policy is applied it changes registry keys. However if those keys are changed manually it will have the same effect.
I found a virus that does precisely this at:

http://securityresponse.symantec.com/avcenter/venc/data/w32.dopbot.html

If you set the registry keys as detailed in that guide, particularly the Windows Firewall and Security Center ones it *should* fix your problem

 

[Jonny69]

There's no group policy folder lol.

He bought it of the company he used to work for, could it have been set up by them?

When you try and enable the firewall in Network Connections is the option to enable the setings greyed out? I seem to remember there was a button there to edit your group policy settings.

Try in services.msc too, maybe it was there when I tried to enable the firewall service.

 

[Faz]

Thanks for the help gents.

I've tried the registry changes as per symantecs web site and it's still the same.

In services, it says the firewll is started, I've tried stopping it and re starting it but no change on the group policy message.