Access denied everywhere and low memory warnings

[starshaped69]

Hi

I have suddenly started to get access denied warnings on my PC running W7 Home Premium.

I am getting the following - 'The system administrator has set policies to prevent this installation'

And on trying to uninstall a program, in this case the Nokia software Updater -

'You do not have sufficient access to uninstall Nokia Software Updater please contact your system administrator'

(in fact I can't uninstall any program)

I have tried to follow advice from some sites I googled, but every time I try to get into any admin type stuff I get denied entry.

I have also all of a sudden started getting low memory warnings although I have 2GB of ram installed on my laptop. Tried defragmentizing but again denied access !

This problems have all seemed to start at the same time everything was fine before.

Can anybody help?

Steve

 

[logicearth]

You probably installed some malware. Try running Malwarebytes in safe mode.

 

[starshaped69]

Hey thanks for the reply.

I tried downloading both spybot and the malwarebytes software but the problem itself on the PC prevented it. So then i tried downloading both programs on a disc drive from another PC. Again my PC stopped it. So I am stuck now.

Any suggestions?

Or am i going to have to do a fresh re-install of windows 7 again!

Steve

 

[Brink]

Hello Steve,

You could use another computer to create a bootable USB/DVD of Microsoft Standalone System Sweeper to scan your computer at boot with to see if it may find and get rid of any malware.

Hope this helps,
Shawn

 

[starshaped69]

Hi Shawn

Thanks for that, you guys are great, just downloading right now to a USB drive, fingers crossed it will work!

 

[starshaped69]

good news and bad news.

Managed to get the scan working and it dredged up a Trojan and Adware virus. I removed the two offending items and re-booted. However I am still getting access denied warnings

So then I tried updating the sweeper program itself thinking that maybe the update might dredge up more viruses.

Did a full scan again - but it came up clean!

So I am baffled now, any suggestions?

Steve

 

[Jacee]

What was the name of the Trojan?

 

[starshaped69]

Hi it's win32/matex.gen!E

Does that help ?

 

[Jacee]

Did you spell that right? matex or malex?
Trojan:Win32/Malex.gen!E [Microsoft] | ThreatExpert Statistics

 

[starshaped69]

Oops yes typo, it's malex

 

[Jacee]

Some Trojan:Win32/Malex.gen!E infections contain trojan and keyloggers which can be used to steal sensitive data like passwords, credit card, bank account information etc. You will need to change all your passwords using a 'clean' computer, not the infected one.

Let's flush the dirty DNS cache and restore MS's Hosts file:

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.
Vista and Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.

Next, download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

• Double click combofix.exe and follow the prompts.
• When finished, it will produce a log for you. Post that log

Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
***A guide and tutorial on "How to use Combofix" can be found here:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

IF CF won't run:
During the download, rename Combofix.exe to sVchost.exe

 

[starshaped69]

Hi Jacee

Thanks for the post. I am going round in circles at the moment

I managed the first bit okay and then re-booted and...

Virus will not let me disable AVG or let me run the Combo file. Tried to rename it once it was downloaded but again PC would not let me.

Couldn't work how to rename whilst actually downloading it but that might be irrevelant anyway seeing as I couldn't disable AVG.

The strange thing is I did a scan with AVG and it came up clean and also the microsoft sweeper program didn't find anything after it's initiall detection and supposed removal of the aforementioned Trojan virus.

 

[Jacee]

If you can, download it to a 'clean' flash drive, then change the name.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Plug the flash drive in, right click and choose "run as Administrator".

 

[starshaped69]

Hi Jacee

Once again managed to run the flash.bat file and successfully re-boot. I then ran the Combo file (renamed) in safe mode with networking and it did start to run. However I realised that I was still connected to the internet so I stopped it and then disabled my connection and tried to start it again. I then got a warning box come up with Abort, re-try etc.

I then on tried on several occasions over a few hours with a different USB drive in both normal boot and in safe mode networking to run the program but the warning dialogue box came up instantly everytime.

Time to give up and re-install windows 7??

Steve

 

[Jacee]

Hi Steve, do you want to try Dr.Web to remove Trojan:Win32/Malex.gen!E? It's free and the instructions are here
Dr.Web Anti-virus - How To Remove Virus (Trojan:Win32/Malex.gen!E) - [DRWEBHK.COM]
When the scan has finished, in the menu, click file and
choose save report list ...save it to your desktop. The report will be called
DrWeb.csv
Close Dr.Web. Reboot your computer....it could be possible that files in
use will be moved/deleted during reboot. After reboot, post the contents of the log from Dr.Web

Did you change your passwords using a known 'clean' computer?
Let's make sure your USB drive is 'vaccinated' Panda USB Vaccine - Free software downloads and software reviews - CNET Download.com

Delete the copy of Combofix you have.