error 5:Acess denied

[ICIT2LOL]

@ICit2lol,

GMER is not my choice. There are other programs that are much more User friendly.

Right now, need to see what is in that system, before the User runs any other program.

Yep mate but there are a ton of other rootkit scanners in that list it was really meant as a last ditch suggestion.

Ah well probably out of my league then as I am not into all that stuff that Jacee quoted I might move on.

Good luck!

 

[cottonball]

@ICit2lol,

...that GMER is on that list too only I don't know quite how to decypher some of it I have used it in the past and it was fairly thorough but the readouts were a bit tough for me to understand. What do you reckon?

GMER was the only thing I was addressing, answering your question.

Some of those RootKit scanners are good, and, some of them I will not use (like Norton's).
Some, I have never used, and therefore, will not ask someone to use if I have not done so myself.

Rootkit scanners play with fire, and sometimes the computer gets burned. IMO, until you check them out and know what they do, they are not an option fo me. Just a personal preference...

 

[ICIT2LOL]

@ICit2lol,

...that GMER is on that list too only I don't know quite how to decypher some of it I have used it in the past and it was fairly thorough but the readouts were a bit tough for me to understand. What do you reckon?

GMER was the only thing I was addressing, answering your question.

Some of those RootKit scanners are good, and, some of them I will not use (like Norton's).
Some, I have never used, and therefore, will not ask someone to use if I have not done so myself.

Rootkit scanners play with fire, and sometimes the computer gets burned. IMO, until you check them out and know what they do, they are not an option fo me. Just a personal preference...

Ok point taken I must be honest and admit I haven't used them all just TDSS Avast Trend Hitman pro Sophos the only one I would not touch is the Comodo utilities one listed right at the bottom it ran my tester into all sorts of strange features.

Like I said I have used GMER and also DrWeb but they are too tech for me
Though I am very curious how the Malwarebytes one will go in fact I am going to test it out right now on the Sandy.

But I think I may have done what I can here so may as well just sit it out to see what comes up, no use gumming up the works .

 

[gopu2013]

Are you able to run the Farbar Service Scanner as Administrator, in normal Windows (not in Safe Mode)?

i ran tdsskiller in normal mode...same problem "cant load driver" n 1 sec scan
so i ran it in safe mode...will upload d log file

ran aswMBR and will upload its lof file (note:fix attemp was not done)

and here is d link of d virus tool page
https://www.virustotal.com/en/file/...c96ac40740309dc56dbc1fd6/analysis/1365564062/

note: d above actions were carried out in safe mode

yes i am able to run FSS as admin in normal mode

when i received d log file i compared it to my previous one ... wil upload d new fss log file ....have a luk....there r alot many services not running as mentioned in d 1st lof file...but in d recent one it says tht oly 1 service isnt running

 

[cottonball]

Let's see if we can beat the "Can't load driver"...

There are infections that include a rootkit protecting the main executable for certain malware from being terminated or removed.

Please do the following with TDSSKiller...
Download from here:
TDSSKiller Download
Download the .EXE, and save it to the Desktop.

Double-click on it to run the program. When it states that it Can't Load Driver, just press the OK button.
TDSSKiller should now start.
Please run the program as previously instructed.
(Post #17 - http://www.sevenforums.com/system-security/285407-error-5-acess-denied-2.html#post2357373)

When done, please post its new report to see if it states that a locked service was found.

================================================================================
2013/04/09 10:10:28.0859 Scan finished
2013/04/09 10:10:28.0859 ================================================================================
2013/04/09 10:10:28.0875 Detected object count: 1
2013/04/09 10:10:41.0250 Locked service(xxxxxxx) - User select action: Skip (xxxxxxx = random name)
2013/04/09 10:10:52.0937

Also download DDS:
Link 1: http://download.bleepingcomputer.com/sUBs/dds.com
Link 2: http://download.bleepingcomputer.com/sUBs/dds.scr
Save it to your Desktop.

Disable any script blocking protection, if you have any
Double click DDS to run the tool.
When done, two reports open:
DDS.txt
Attach.txt
Save both reports to your Desktop.

Please provide both reports, DDS.txt and Attach.txt, in your reply.



>>Did you follow Post #40 - http://www.sevenforums.com/system-security/285407-error-5-acess-denied-2.html#post2357373

 

[gopu2013]

should i follow post #40 and then follow ur post #38 after completeing #40?

 

[gopu2013]

i followed d post #40...and ran flush.bat
d command prompt windows does its operation but d pc dsnt seem to reboot itslf...its not switching off

and also adware tool....after clicking delete it says it has to reboot d system in order to completely remove d suspicious objects....i click ok....it then tells adware will now reboot d system...when i click ok it dsnt reboot itslf

 

[gopu2013]

i dont get an automatic report frm tdsskiller....after d scan is completed i go to reports ....copy d contents ... paste it in a notepad n save it....em uploading tht file...

and here r dds n attach file logs

 

[ICIT2LOL]

Sorry cottonball but it is painful to watch gopu to save me looking back through the thread what AV do you have installed?

 

[Anak]

Sorry cottonball but it is painful to watch gopu to save me looking back through the thread what AV do you have installed?

KIS 2013 Post #11

 

[Anak]

gopu,

I'd like to check if there is anything wrong with your operating system installation.
Please follow the instructions in this tutorial, and post the results in one of your next replies:
http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

 

[gopu2013]

@ anak

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0x800706be
Windows Product Key: *****-*****-X92GV-V7DCV-P4K27
Windows Product Key Hash: aU2z1/fnhnLHmhBm699qYZT2E6s=
Windows Product ID: 00426-OEM-8992662-00400
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {D0E80BA7-BFB9-4131-9FE8-40E581F8BDC2}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.130104-1431
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{D0E80BA7-BFB9-4131-9FE8-40E581F8BDC2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-P4K27</PKey><PID>00426-OEM-8992662-00400</PID><PIDType>2</PIDType><SID>S-1-5-21-659727603-1867771639-4004724754</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron N4030</Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A07</Version><SMBIOSVersion major="2" minor="6"/><Date>20110323000000.000000+000</Date></BIOS><HWID>E6853707018400FC</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>India Standard Time(GMT+05:30)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL </OEMID><OEMTableID>WN09 </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00178-926-600400-02-1033-7600.0000-0462013
Installation ID: 016136374711054802825014496172259365469570657611581023
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: P4K27
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/11/2013 12:05:15 AM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 2:26:2013 12:48
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LAAAAAEAAQABAAEAAAABAAAAAgABAAEAJJTWnnTcqFXg9fxc3J64qU4CXF0=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC DELL WN09
FACP DELL WN09
HPET DELL WN09
MCFG DELL WN09
SSDT AMICPU PROC
SLIC DELL WN09
OSFR DELL M08

 

[gopu2013]

Sorry cottonball but it is painful to watch gopu to save me looking back through the thread what AV do you have installed?

Kaspersky Internet Security 2013

 

[Anak]

gopu, could you please enclose your MGDiag report in a Code box


The # icon = a code box It makes it much easier to read.

 

[ICIT2LOL]

Sorry cottonball but it is painful to watch gopu to save me looking back through the thread what AV do you have installed?

Kaspersky Internet Security 2013

gopu mate could you just do one thing for me and check the version you have. Open the GUI click on support and see what version you have.

If and again I cannot remember you have reinstalled the program if you use the Start list removal it isn't sometimes as good as doing it the "long way" round. That is because they have set it so you can save settings form the previous install but I ma not a great lover of that feature.

 

[NoelDP]

I don't recall ever seeing a 0x800706be error in an MGADiag report.
It translates as being an 'RPC_S_CALL FAILED' - which I freely admit doesn't mean much to me!

Let's see if we can tease a little more information out...

Please attempt validation at www.microsoft.com/genuine/validate using Internet Explorer - what happens?

Please then run another MGADiag, and post the new report.

 

[Jacee]

Is this an upgrade from Vista?

This is a well known Windows 7 Ultimate license that has been used all over the web:
Windows Product Key: *****-*****-X92GV-V7DCV-P4K27

 

[NoelDP]

The Key in use is the proper Dell OEM_SLP Key with which the machine is shipped pre-installed.
It's all over the web because there are millions of machines with it - and it's public knowledge.
It is of no use to anyone without the proper SLIC table in the BIOS and the proper licenses in the installed OS.

 

[ICIT2LOL]

Well Jacee and Noel in the absence of the OP I guess he might be still in the and of nod do you think what I suggested maybe the reason or part thereof of the TDSS not running?

Or are you thinking the problem is not malware based if so I'll butt out:huh:

 

[gopu2013]

I don't recall ever seeing a 0x800706be error in an MGADiag report.
It translates as being an 'RPC_S_CALL FAILED' - which I freely admit doesn't mean much to me!

Let's see if we can tease a little more information out...

Please attempt validation at www.microsoft.com/genuine/validate using Internet Explorer - what happens?

Please then run another MGADiag, and post the new report.

i dont have internet explorer installed....and d system isnt allowing me to install / uninsatll any programms

should i follow dis post using google chrome?