Permissions Are Hijacked

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by masterterminal, Jun 6, 2016.

  1. masterterminal

    masterterminal Private E-2

    I started seeing problems on my Window 7 64 bit system a couple of weeks ago when windows search started to give no enough resources error message when clicking on the "more results". 3 days ago it got worse, it is giving me permission errors when trying to run almost anything, e.g. Windows explorer, Textpad, Firefox. Error pop-up shows "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item. I only have one account on the system. It even gives error at reboot when trying to open windows desktop: "The visual styles could not be applied. Access is denied."
    I disabled all startup programs and the problems is the same.
    I can run in safe mode without the permission errors.
    I googled for these errors and could not find anything, so I thought it might be maleware.
    Runing in Safe mode, I followed the instructions in the Readme and have attached the logs generated.
    If you could look at the logs and have advice that would be greatly appreciated.
    Thanks/Steve
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It doesn't look like malware is your problem. Let's try this before I send you to the software forum:

    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the + Repairs tab.
    • Then click the + Open Repairs button down on the bottom right.
    • This will automatically begin a registry backup, so wait for it to complete and when it finishes, you will see a list of many possible different repairs and they are all selected by default. At the bottom of this form there is a not so obvious Unselect All Repairs check box which is to the right of a check box with a green check mark in it. Please click the Unselect All Repairs box. The green check mark box is to Select All Repairs. The ony way you see what these boxes are is when your mouse hovers over them.
    • Now select the following repair options ( the numbers at the begin are the current repair numbers but this is subject to change.)
      • 01 - Reset Registry Permissions
      • 02 - Reset File Permissions
      • 03 - Reset Service Permissions
      • 04 - Register System Files
      • 05 - Repair WMI
      • 06 - Repair Windows Firewall
      • 10 - Remove Policies Set By Infections
      • 13 - Network
      • 14 - Repair Proxy Settings
      • 15 - Repair Windows Updates
      • 21 - Repair MSI (Windows Installer)
      • 23 - Repair File Associations (12 )
      • 26 - Restore Important Windows Services
      • 27 - Set Windows Services To Default Startup
    • Now on the right side under the When Repairs Complete title, check the box for Restart/Shutdown System and then make sure the Restart System radio button is enabled not the Shutdown System button.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start Repairs button at the lower right.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished. If it does not then reboot it yourself.

    It will take a while so run it and go do something else until it is finished.
     
  3. masterterminal

    masterterminal Private E-2

    Thanks for the swift response. I performed the steps you advised and the problem is still there.
    I ran after configuring to safe mode, and "run as administrator". I also ran Repair_windows twice, as it suggested in their instructions.
    I did notice some errors in the logs related to permissions, so I attached them for your review.
    Any additional assistance you can provide would be greatly appreciated.
    Thanks/Steve
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Since this is not a malware issue, please post in the software forum for additional assistance.

    Since you are not having any malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8 or 10, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds