Multitude of problems that I can't figure out

[tld6008]

I posted the below message to the Bleeping computer site also.



I just spent 30 minutes typing my problem and went to attach a screenshot and my firefox browser closed.
This reminded me what first brought my attention to my problem
I have a Dell Latitude notebook running Win 7 Enterprise 64 bit. I have had this computer for several years and the yrs ago upon my retirement 3 years ago was given the computer without any adjustment by the IT dept so I log in just like I did when connected to the work domain
My story:
About 3 months ago I noticed when I tried to attach something to an email message my Firefox browser would shut down this only happened with the local IP email program, they couldn't explain it and I have a Yahoo acct so I could use that for email attachments. That is what just happened with my first lengthy message to this forum but it was lost when I reopened the browser.
Abut the same time as the attachment problem I noticed an installed program called Bit( started blocking automatic updates from Malewarebytes, I also discovered I could not manually run a scan or get an update etc. Also I found I could not run CCleaner, Bit9 blocked it.
I also noticed I could not run a downloaded .exe file (virus detection program) Bit 9 blocked the opening of any executable file now
I ran several bootable virus programs but nothing was found
I log into SafeMode but the screen just flashes at .5 second intervals like the computer is rapidly restarting
This also happens when I log on as another user, the screen just flashes
If I select the Remove Program feature in Control Panel Control Panel closes.
I read that the Sality virus has symptoms like I am experiencing but how do I determine it that is the cause?


Prior to the start of all these problems I can olny remember the Bit 9 program refusing to open an .exe file 2 or 3 times


Please Help!

 

[RolandJS]

What is Bit9? BitDefender version 9? Changing gears -- I'm wondering if your work domain quietly removed some functionality.

 

[Bree]

What is Bit9?....

Apparently a form of AV.

Bit9® + Carbon Black®, the leader in Next-Generation Endpoint Security (NGES)

Bit9 + Carbon Black is Now Carbon Black | VMware Carbon Black

 

[torchwood]

Hi

As your running an ex company machine
Its likely there are group policy restrictions in-place, Especially if your comp is STILL connected to thier domain - any changes they make will filter down to you

For practical purposes it might be better for you to clean install the version of W7 shown on the COA product sticker
It is advised to copy any personal files to an external media device, but can you??


Roy

 

[tld6008]

I am sure that the Bit 9 program is meant to enforce company policies/restrictions but I never had a problem with it until recently. I also am fairly certain that I am not connected to my former company via this computer. I checked the Bit 9 revision info and it was last updated in 2015.
What is the COA product sticker?
I would first like to determine if I have some kind of virus as there are many things my computer is doing that seem connected i.e. cant access Remove Program utility, cant attach email files, cant log into Safe Mode

 

[torchwood]

Hi

OK

for starters if Bit9 is an AV/company restriction program and its not been updated since 2015, thats a big problem
In theory your IT dept should have removed any/all proprietry programs before passing it on

COA sticker is the MS Certificate of Authenticity - likely in the battery compartment

If your still logging in with your old companies user ID, you likely are still "attached"
your quote
so I log in just like I did when connected to the work domain

see if you can run either of these

https://go.microsoft.com/fwlink/?LinkID=56062

note im not looking to see if its not genuine - it will tell me if your still connected to them

if the above fails run from an elevated command mode

slmgr /dlv

post the output


notes
Local Security Policy settings for a computer connected to a domain using Active Directory can only be changed by the network administrator

Local Group Policy - Reset to Default


malware removal programs are by default executables, .exe, can you get into Bios?

 

[tld6008]

Thanks for the response,
I was able to run both suggestions The first one had a copy feature but it did not work so in both cases I had to use the Snip tool then copy and past the results of that due the additional problem I have that if I attempt to attache something to a message my browser closes. Any way both results are below. I also read the Local Group Policy info you suggested and I don't really understand the implications of that subject although I could easily follow the directions.
Yes I can get into the Bios
Hope to hear from you again


EDIT: It turns out that I cant attach or copy the Snip results to my reply. It says there that are too many characters when I try to paste into the message and I have mentioned the attachment problem previously

 

[torchwood]

Hi

can you tell me from the MS tool your info here

Windows Product ID Type: 2
Windows License Type: OEM SLP

and here, are they the same as mine, last block of numbers, just tells me the servers its going to

Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340

IF there different DO NOT post them.


Roy

 

[tld6008]

Product ID Type: 6 - Volume MAK
Windows License Type: There is no heading like this or anything with OEM SLP in it


My numbers are the same as those you listed


I'm going to try and reply from a different Browser and post the original results

 

[tld6008]

Tried from IE but doesn't work

 

[tld6008]

Here it is sent from different computer

 

[townsbg]

I would wipe that off and start over. Since that is computer designed for a work environment there's no telling what kind of policy restrictions and spyware are on there. On top of that you have no legal basis on which to run 7 enterprise and at any time it can be deactivate. As stated this all could have started because of a policy change on the domain that your computer automatically downloaded.

 

[torchwood]

Hi

Thats good means your not updating via your old company
see that bleepingComputers, Oh My aka Gary,has joined the battle

He's an expert, so i will bow out for the time being.

i noticed this
if you cannot run those 3 programs directly, download them to your other comp and transfer it to a USB and run them from it.


Roy

 

[tld6008]

Thanks for your help. I am worried about the 3 Rkill progs, I will load them to USB from another computer but if they are exe files I am doubtful if they will run

 

[torchwood]

Hi

been hunting around to find out what that program is

was originally bit9 but now part of Carbon Black, it has 3 level protection, administered via its own consel

Defend (Antivirus - used to be Conifer)
Protect (Application Protection/Whitelisting)
Response (Visibility/Recovery)

if the exe is not on the whitelist its automatically quarenteened

CB Defense: How to Uninstall Windows Sensor - Carbon Black Community


Roy

 

[tld6008]

Well originally Malwarebytes would have been on it as my previous employer used it. Since retiring I purchased a premium account and it has worked fine since mid 2016 but last 3 months or so it no longer updates.