tjg81296

Well, after running netsh winsock reset catalog I had to also rebuild the IP stack (netsh int ip reset logfile) and reboot. Then at login it BSOD'd with an 8E stop error. I rebooted into safe mode and reran Service Pack 3. After the reboot all seems well again. This is the latest HJT Log file: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:04:44 PM, on 7/29/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Intel\AMT\atchksrv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\ifxspmgt.exe C:\WINDOWS\system32\ifxtcs.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Intel\AMT\LMS.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\lotus\notes\ntmulti.exe C:\WINDOWS\system32\IfxPsdSv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\AMT\UNS.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE c:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\cwbunplp.exe C:\WINDOWS\system32\userinit.exe C:\Program Files\Intel\AMT\atchk.exe C:\WINDOWS\system32\userinit.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe C:\Program Files\Hewlett-Packard\Embedded Security Software\PSDrt.exe C:\Program Files\eFax Messenger 4.4\J2GTray.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\cmd.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = knl-eg-proxy1:80 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = currents.knoll.com;reff.knoll.com;dividends.knoll.com;ftp1.knoll.com;ftp2.knoll. com;*.knoll.com;*.local;192.168.129.223;<local> O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [setRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe O4 - HKLM\..\Run: [sDMSSplash] "C:\Program Files\HP_SDMS\SDMSSplash\launcher.exe" "launchdir=C:\Program Files\HP_SDMS\SDMSSplash" O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [iFXSPMGT] C:\WINDOWS\system32\ifxspmgt.exe /NotifyLogon O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe" O4 - HKLM\..\Run: [Client Access PC5250 Sound] "C:\Program Files\IBM\Client Access\Emulator\pcssnd.exe" O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe" O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [eFax 4.4] "C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe" /R O4 - Startup: eFax 4.4.lnk = C:\Program Files\eFax Messenger 4.4\J2GTray.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://egnotes1.knoll.com/iNotes6W.cab O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1201534182368 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1220459614249 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = knoll.com O17 - HKLM\Software\..\Telephony: DomainName = knoll.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = knoll.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = knoll.com O20 - AppInit_DLLs: APSHook.dll O20 - Winlogon Notify: OneCard - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Intel® Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iSeries Access for Windows Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\ifxspmgt.exe O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\ifxtcs.exe O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Intel® Active Management Technology Local Management Service (LMS) - Intel - C:\Program Files\Intel\AMT\LMS.exe O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus\notes\ntmulti.exe O23 - Service: Personal Secure Drive service (PersonalSecureDriveService) - Infineon Technologies AG - C:\WINDOWS\system32\IfxPsdSv.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Intel® Active Management Technology User Notification Service (UNS) - Intel - C:\Program Files\Intel\AMT\UNS.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe -- End of file - 13771 bytes

netsh winsock reset catalog Corrected the error when using ping. Still no access to the domain. I am talking to myself here. Should I not be doing this? I don't want to annoy you all. I just want to keep you in the loop with the changes. Thanks, Tom

OK - Good news and bad news. I was able to clean out and get to run MBAM and HJT. This is the HJT logfile. I cannot get to the domain to login and tried removing from and re-adding to the domain no good. When I ping the domain I get a beep and then it pings with replies but it is appending "[

MBAM Log File: Malwarebytes' Anti-Malware 1.39 Database version: 2526 Windows 5.1.2600 Service Pack 3 7/29/2009 12:17:47 PM mbam-log-2009-07-29 (12-17-47).txt Scan type: Full Scan (E:\|) Objects scanned: 260817 Time elapsed: 59 minute(s), 27 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 21 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: e:\jgewc.exe (Trojan.TDSS) -> Quarantined and deleted successfully. e:\mauekmrb.exe (Trojan.Dropper) -> Quarantined and deleted successfully. e:\pmhbdhn.exe (Trojan.Dropper) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\Temp\efkh.exe (Trojan.Downloader) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\Temp\UAC26f1.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\Temp\UAC2897.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\temporary internet files\Content.IE5\30JPYI9P\firewall[1].dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\temporary internet files\Content.IE5\82MO4EI5\cwwjobbg[1].htm (Trojan.TDSS) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\temporary internet files\Content.IE5\9LD0DJD5\ziwwofwj[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\temporary internet files\Content.IE5\9LD0DJD5\heebsfwko[1].htm (Trojan.Dropper) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\temporary internet files\Content.IE5\GE50A10W\atghycdqhi[1].htm (Trojan.Dropper) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\temporary internet files\Content.IE5\MHHMQ2NM\SetupAdvancedVirusRemover[1].exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\temporary internet files\Content.IE5\MHHMQ2NM\mm[1] (Trojan.Downloader) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\temporary internet files\Content.IE5\NSSLGR2Z\yiwwnbsww[1].htm (Trojan.TDSS) -> Quarantined and deleted successfully. e:\documents and settings\ttorrice\local settings\temporary internet files\Content.IE5\NSSLGR2Z\vfsgt[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully. e:\program files\advancedvirusremover\PAVRM.exe (Rogue.Installer) -> Quarantined and deleted successfully. e:\system volume information\_restore{8d290bb5-e59c-462b-a0ee-e8949a1e4344}\RP331\A0020164.old (Rogue.Installer) -> Quarantined and deleted successfully. e:\WINDOWS\system32\ghaf8jkdfd.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. e:\WINDOWS\system32\netlogon.dll (Rootkit.Agent) -> Quarantined and deleted successfully. e:\WINDOWS\system32\winhelper.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. e:\WINDOWS\system32\winupdate.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

The user went to a random site and ended up with "Advanced Virus Remover" Pretty impressive looking. I have tried the following with no avail: Disabled all startup and services. Reboot to safe mode. Took ownership of directory thinking permissions were changed. Reinstall Mbam in safe mode and then start scan, gets through 1 file and poof gone! permissions error returns "Windows cannot access specified device, path, or file. You may not have the appropriate permissions to access the item." when starting mbam.exe. When not in safe mode cannot run regedit, task manager. Current running processes in safe mode (show process from all users): taskmgr.exe explorer.exe svchost.exe svchost.exe svchost.exe lsass.exe services.exe winlogon.exe csrss.exe smss.exe System System Idle Process - User Name - System Regedit does run in safe mode. Current entries in HKLM\Software\Microsoft\Windows\CurrentVersion\Run: C:\Windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto - This should just be to bring up the Config utility on startup. I have removed the drive and am running MBAM against it in another workstation. I will post the results. Any thoughts? TIA, Tom

Maniac, Thanks for the info. I probably should start another thread for the issue I have but as mentioned Mbam and HJT doesn't run so we can't post a log file from it. I have removed the drive and put in another workstation and I am scanning it there. I will post the results. Thanks, Tom

I have a similar issue. The user went to a random site and ended up with "Advanced Virus Remover" Pretty impressive looking. I have tried the following with no avail: Disabled all startup and services. Reboot to safe mode. Took ownership of directory thinking permissions were changed. Reinstall Mbam in safe mode and then start scan, gets through 1 file and poof gone! permissions error returns "Windows cannot access specified device, path, or file. You may not have the appropriate permissions to access the item." when starting mbam.exe. When not in safe mode cannot run regedit, task manager. Current running processes in safe mode (show process from all users): taskmgr.exe explorer.exe svchost.exe svchost.exe svchost.exe lsass.exe services.exe winlogon.exe csrss.exe smss.exe System System Idle Process - User Name - System Regedit does run in safe mode. Current entries in HKLM\Software\Microsoft\Windows\CurrentVersion\Run: C:\Windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto - This should just be to bring up the Config utility on startup. Any thoughts? TIA, Tom