cant install anti malware apps. "permission virus" HELP

tongueohlsen · Sep 1, 2009

I have a virus that takes away permisssion for me to run any anti malware or other applications such as hijack this. i can run the program once i install it, then during a scan or an update it will close and i lose permissions.

every time i click on the program a message reads:

""windows cannot access the specified device, path or file. you may not have appropriate permmissions to access the item.""

i have followed other threads about this and tried everything shown but cant seem to get close to finishing it off.

the only anti malware programs i can run are

IObit security 360 free license and
ESET NOD32 Antivirus 3.0.672. Business Edition.

eset identifies it as as a

Win32/TrojanDownloader.FakeAlert.AHT trojan

and a free scan by stopzilla identified it as a

Win32K.Stream trojan

it has hijacked my web browser and redirects me.

I am running winXP pro SP3

I really need some help and if anyone has any ideas please reply.

TimW · Sep 5, 2009

Welcome to Major Geeks!

Please read ALL of this message including the notes before doing anything.

Pleases follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide

and attach the requested logs when you finish these instructions.

**** If something does not run, write down the info to explain to us later but keep on going. ****

Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

tongueohlsen · Sep 6, 2009

Alright, well first off thank you very much for helping me out. i am very grateful.

So i went throught the entire XP cleaning procedure like you asked and came up with this.

-Superantispyware closes unexpectedly during scan and then i lose permissions.

-MBAM closes during scan and i lose permissions. and when downloading this i renamed it from mbam-setup.exe to mb.exe, hopeing the virus wouldnt identify it.

- Combofix alerts me saying that i have webroot spy sweeper running (which i have installed before unsuccessfully) and i have to uninstall it and that if i continue there are unknown results, so i tried to unininstall it but it is not in add/remove programs list, nor in ccleaners version of add/remove programs list, and its also not in program files, so i dont know where the directory would be that let combofix even find it.

-RootRepeal produced a log the first time i ran it but that was not a file scan log. i have attached it and hopefully it is of use. after that i ran the file scan and it closed unexpectedly and i lost permissions.

-MGlogs surprisingly ran Exceptionally and produced a zip file that i attached. hopefully we can work off of this.

Also two unknown registry entries i have noticed were from

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\NordBull

HKEY_CURRENT_USER\Software\Monopod

I dont know if these are of use to you but hopefully they are from the virus and help.

thanks again and i will check tomarrow night for a reply.

TimW · Sep 9, 2009

Please double-click the RootRepeal.exe previously downloaded.

Select File then Scan

On the Select Drives form select drive C by "ticking" the box for drive C and click OK

When the scan is complete - highlight each of the following file(s) (one at a time if more then one is listed) by left clicking it. Then use right mouse click and select the Wipe File option only for each file.

C:\WINDOWS\win32k.sys:1

C:\WINDOWS\win32k.sys:2

After Wiping all files, immediately reboot your pc!

You MUST follow these steps exactly and they MUST be performed in the order written.

Download The Avenger by Swandog46, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop but DO NOT RUN IT.

Now download and save the below two files to the root folder of your Windows boot drive. Normally this would be drive C. If you do this correctly, you will then see C:\MGtools.exe and FixAVP.exe

FixAVP

Now run MGtools.exe by following the instructions given here Using MGtools which will help your understand how to run it and what will happen. You don't need to worry about attaching the MGlogs.zip file that it mentions yet because we have more to do and new log will be obtained later.

Now run the FixAVP.exe file by double clicking on it. This will attempt to automatically run Avenger (which you downloaded above) and it should also try to reboot your PC so don't be alarmed when this happens.

After Reboot, and if all goes well, a new scan by MGtools should automatically take place because Avenger will try to run C:\MGtools\GetLogs.bat which will begin all the scans again.

When GetLogs.bat finishes running, there will be a new C:\MGlogs.zip file and now it will be time to attach it to your next message. Make sure that you allow GetLogs.bat to finish running. It will tell you when it is finished. Do not close the command prompt window on your own until it is finished.

Click to expand...

Then run this:
Win32KDiag - How to run

Log in or Sign up

cant install anti malware apps. "permission virus" HELP

tongueohlsen Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

tongueohlsen Private E-2

Attached Files:

RRlog.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

cant install anti malware apps. "permission virus" HELP

tongueohlsen Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

tongueohlsen Private E-2

Attached Files:

RRlog.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches