Access Denied/Hijacked Policies...?

G1_Queen · Apr 2, 2014

Back in February 2014 I logged onto my system to be greeted with a black desktop and a warning screen saying my copy of Windows might be pirated, and to follow a link to get a valid copy. I knew this to be a lie and immediately went to run Malwarebytes (hit windows logo on keyboard & I able to access my desktop) and noticed that my Malwarebytes had been removed. I tried reinstalling directly from Malwarebytes site, but noticed my browser was being hijacked and redirecting me to various sites, so I disconnected from that. I already had HitmanPro installed so after several freezes, not being able to access the internet, and constant manual reboots, I decided to run HitmanPro and use it to clean up my system (so I thought).

HitmanPro detected a Trojan and Malware on my system, and cleaned it. However, I still have “Access is Denied” problems and I don’t feel my browser is completely secured.

I'm getting "Access is Denied" to random programs, I cannot load my computer in regular mode at all because it completely freezes and I have to constantly manually reboot, and I cannot download Malwarebytes in any mode or means.

I need professional help cleaning up my system

I have followed the steps in the "Read Me First" steps and attached some logs. There is no Malwarebytes log because I cannot access it, and there is no RogueKiller log. After 3 tries I was unable to obtain a log from RK because I get a BSOD every time RK is reading “MBR” during its scan, and then the system reboots.

Kestrel13! · Apr 3, 2014

Hi there. Not really seeing alot in the way of malware/junk...

Re run Hitman and have it remove all that it finds.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;192.168.*.*

R3 - URLSearchHook: (no name) - {cce665dd-f6dd-4808-968e-eaec971f70ef} - (no file)

O18 - Protocol: soloresinterneteng - {F39B538C-60AA-4030-8A8C-1D337F8DC5E6} - (no file)

After clicking Fix exit HJT.

Is this visible to you? Do you know what it is?

C:\ProgramData\{$3002-6298-3953-7668$}

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

Vista/Windows 7/8 users right-click and select Run As Administrator

Click on the Scan button.

AdwCleaner will begin...be patient as the scan may take some time to complete.

After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).

The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.

Attach the logfile to your next next reply.

A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

The below takes a while, so be sure to go off and do something else for a while as it runs.

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)

Now select the Start Repairs tab.

The click the Start button.

Create a System Restore point if prompted.

On the next screen, click the Unselect All button to first deselect all repairs.

Now select the following repair options:

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Proxy Settings

Repair Windows Updates

Set Windows Services To Default Startup

Now on the lower right side check the box to Restart/Shutdown System When Finished

Then make sure the Restart System radio button is enabled.

Shutdown any other programs that you are running now before continuing.

Now click the Start button.

Be patient while the tool repairs the selected items.

It should reboot automatically when finished.

After reboot, check to see if it has changed anything.

G1_Queen · Apr 3, 2014

Thank you so much for your assistance. I am about to follow the step for Windows repair...

To answer your question about "C:\ProgramData\{$3002-6298-3953-7668$}," yes, that is visible to me, and I have absolutely no idea what that is exactly. However, HitmanPro labeled some folders/files in there as Malware and a Trojan, 6 items in total (2/8/14). It was quarantined, not deleted.

Kestrel13! · Apr 3, 2014

yes, that is visible to me, and I have absolutely no idea what that is exactly.
Click to expand...

You can delete it then.

As for Hitman, feel free to run another scan with it after following all of the other instructions, and attach the log for me to see if anything is left to remove.

Log in or Sign up

Access Denied/Hijacked Policies...?

G1_Queen Private E-2

Attached Files:

TDSSKiller.3.0.0.26_02.04.2014_10.28.09_log.txt

HitmanPro_20140402_1045.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

G1_Queen Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member