[slipperx]

Hi
I have been referred here from the Virus Infection Forum having completed a thorough process to try to uncover any virus or infection which might induce thios problem.
The computer is a laptop which was infected with the Zlob virus from a video codec that was downloaded. After the infection when the computer boots into normal mode and I log on the computer produces a 'Windows cannot access the specified device. You may not have the appropriate permission to access the item.'

This warning or error if you like appears whenever any program is attempted to start, .exe, .bat and .cmd files. Also cannot access most of control panel nor open a dos screen with the Start-Run process. In short just about nothing works. In safe mode however there are no issues using the same profile to log on. The profile is set up as an Adminstrator. I have reset permissions and file associations numerous times with Dial-a-fix running it from safe mode. I can access internet and run all programs from safe mode.

One interesting thing is that I found occasionally I could access a program if I clicked on the icon immediately it appears on startup - then one in ten times maybe I could get a programme to run but this functionality has now disappeared as we have been cleaning the computer.

I have tried everything I can think of but still no joy. I also set up a new user as Administrator but same issue with that account too. i do not know what else to try - it is like the registry gets hijacked as it starts up and does some permission manipulation to refuse access to everything. Any help would be much appreciated.

[Advertisements]

you will need to run sfc /scannow...lowdown is here

could you give me the link to your malware thread...

Edited by happyrck, 22 July 2008 - 12:08 PM.

[happyrock]

you will need to run sfc /scannow...lowdown is here

could you give me the link to your malware thread...

Edited by happyrck, 22 July 2008 - 12:08 PM.

[slipperx]

Hi
Many thanks for response.

Here is the malware forum link http://www.geekstogo...tc-t204488.html

I have a problem running sfc /scannow because in safe mode it reports RPC error (I guess because that service doesn't start in safe mode) and in normal boot I get the 'Windows cannot find the path you may not have permissions error which I get with every program I try to run.

Also I do not have an original XP CD for the laptop since Sony did not provide one. There is a - recover original factory software option - which will let me go back to the stoneage - but I am trying to avoid that because there are hundreds of installed programmes on the disk and I don't have a backup for the laptop - duh! I must stop avoiding doing a backup but its hard on laptops with limited storage or I need to learn more and store the backups elsewhere.

Now I do have several original Xp disks of various flavours and I also have a Bart PE startup CD with windows shell on that I can use - however I am not sure that will help much as I am not sure where the original XP files might be stored on the laptop - I guess they must be somewhere for the Sony utility to be able to go back to square 1.

Any ideas of how best to proceed here? Maybe I could manually check the Xp files to see which ones were recently created (or can that date be manipulated by the virus writers to further confuse - could also compare files with other installations I suppose somehow but I am not sure if either idea is even a runner.

Thanks for your assistance again.

[happyrock]

Now I do have several original Xp disks of various flavours

use the same flavor as the laptop and use the repair option that will take you to a dos prompt
and then run sfc /scannow from there
nojoy...
then try creating another user account... give it admin rights...see if that account has the same issues

Edited by happyrck, 28 July 2008 - 04:37 PM.

[slipperx]

Hi
Thanks for that but repair option from CD will only let you run a specific set of commands as far as I can see. I tried typing in sfc /scannow from the default directory (c:\windows) and also from c:\windows\system32 but it says command not supported. Have already tried creating a new user with Admin priviledges - see earlier thread - that just gives all the same issues but not that those issues do not affect safe mode - that is why I think the permissions are getting hijacked at startup but the alterations to stop me running programs etc. are reversed maybe so that in safe mode they are not affected. Or of course I might be totally barking up the wrong tree with that.

Did try to run using Bart disk but it will not run under that either. Also tried two new accounts - one with limited priveledges adn one Administrator but again both are refused access to all programs in normal mode.

Hitting a lot of brick walls here. Maybe a system file has been overwritten with code that refuses all access. Where to next?

Regards
Ian

[happyrock]

then you will have to do a repair on xp...great instructions here by Fred Langa ...
READ THE WHOLE THING FIRST

Edited by happyrck, 29 July 2008 - 11:06 AM.

[slipperx]

Hi
Well it was a lastish resort but the repair did work. I created a slipstreamed SP2 disk and reinstalled. Beware however that the windows key has to reinstalled and if using a laptop it might not work - well it didn't for me. I managed to complete the installation using another key and then telephoned Microsoft to explain the situation who I have to say were most helpful in getting me up and running again. Laptop users with no backup XP install disk beware - if you don;t have one I suggest going about finding out how to create one since even though I have a legal pre-installed windows XP on my laptop I do not have any install disks just a repair to original link on my desktop which I am pretty sure takes you back to the virgin windows installation minus all your programs. Thank you happycrk for your help.

[happyrock]

your welcome...I also have had to call MS and get a new key to activate laptops...only took about 5 minutes though...
thanks for letting us know...