jepiper76 Posted July 24, 2009 ID:101762 Share Posted July 24, 2009 I have been trying to remove Home Antivirus 2010 for awhile now. I used the avenger program to remove some files. I have search through several HKEY Registry's, files and delete all I could find. I then go to run the malwarebytes program and I start a quick scan. After about ten to fifteen seconds the program just stops. I then try to reopen the program and it will not let me giving me the following window "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."I have tried reinstalling malwarebytes to the same result.I have uninstalled malwarebytes shutdown and then reinstalled to the same result.What now? Link to post Share on other sites More sharing options...
jepiper76 Posted July 24, 2009 Author ID:102000 Share Posted July 24, 2009 I have been trying to remove Home Antivirus 2010 for awhile now. I used the avenger program to remove some files. I have search through several HKEY Registry's, files and delete all I could find. I then go to run the malwarebytes program and I start a quick scan. After about ten to fifteen seconds the program just stops. I then try to reopen the program and it will not let me giving me the following window "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."I have tried reinstalling malwarebytes to the same result.I have uninstalled malwarebytes shutdown and then reinstalled to the same result.What now?I have also tried running hijackthis program to the same effect as malwarebytes. It starts the program but then part way through it stops the program then it gives me a pop that says "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item" any time I try to reopen. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 7, 2009 Root Admin ID:106984 Share Posted August 7, 2009 Sorry for the long delay, if you still need help please let me know Link to post Share on other sites More sharing options...
jepiper76 Posted August 7, 2009 Author ID:107074 Share Posted August 7, 2009 Sorry for the long delay, if you still need help please let me knowYes, please, as I have yet to be able to run malwarebytes. I have removed the virus, but I would still like to be able to run malware. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 8, 2009 Root Admin ID:107378 Share Posted August 8, 2009 What happens or what error do you get?Please run the following.Download DDS and save it to your desktophttp://download.bleepingcomputer.com/sUBs/dds.scrDisable any script blocker if your Anti-Virus/Anti-Malware has it.Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.Then double click dds.scr to run the tool.When done, the DDS.txt will open.Click Yes at the next prompt for Optional Scan.When done, DDS will open two (2) logs:DDS.txtAttach.txtSave both reports to your desktopPlease include the following logs in your next reply: DDS.txt and Attach.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 9, 2009 Root Admin ID:108004 Share Posted August 9, 2009 Please post a status update on this. Thanks Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 11, 2009 Root Admin ID:108628 Share Posted August 11, 2009 Are you still with us? Link to post Share on other sites More sharing options...
jepiper76 Posted August 11, 2009 Author ID:108772 Share Posted August 11, 2009 Yes, I am. I downloaded the DDS module. I ran it but I do not recieve a yes prompt. I think that I have disabled all the scipt blockers but am unsure as I have norton antivirus corporate installed.I have tried just typing yes into the DDS text prompt but to noavail.What next? Link to post Share on other sites More sharing options...
jepiper76 Posted August 11, 2009 Author ID:108815 Share Posted August 11, 2009 I have a screen print of the D.D.S. command prompt.dds_screen_print.docdds_screen_print.doc Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 12, 2009 Root Admin ID:109120 Share Posted August 12, 2009 it should have created the log files already. You just need to attach them.Please try running the following.Please download the following scanning tool. GMERDownload the randomly named EXE and copy the file to your Desktop. Remember what its name is.Double click on random named exe file and run it.It may take a minute to load and become available.Do not make any changes. Click on the SCAN button and DO NOT use the computer while it's scanning.Once the scan is done click on the SAVE button and browse to your Desktop and save the file as GMER.LOGZip up the GMER.LOG file and save it as gmerlog.zip and attach it to your reply post.DO NOT directly post this log into a reply. You MUST attach it as a .ZIP file.Click OK and quit the GMER program.How To Use Compressed (Zipped) Folders in Windows XPCompress and uncompress files (zip files) in Vista Link to post Share on other sites More sharing options...
jepiper76 Posted August 12, 2009 Author ID:109218 Share Posted August 12, 2009 I downloaded the GMER file onto the desktop.I double clicked, and it opened the scan portion.I started the scan. It scanned for about an hour an one half (not for sure because I walked away from the computer). When I came back the scan screen was closed out, and I cannot open GMER file again nor can I delete the file and start over. Here is the message I recieve when I try to reopen "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."What now? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 13, 2009 Root Admin ID:109378 Share Posted August 13, 2009 Step #11. Go to Start->Run and type in notepad and hit OK. 2. Then copy and paste the content of the following codebox into Notepad:@echo offcopy C:\WINDOWS\system32\dllcache\scecli.dll c:\scecli.dllExit3. Save the file as "fixes.bat". Make sure to save it with the quotation marks.4. Double click fixes.bat.Step #2We need to execute an Avenger2 scriptNote to users reading this topic! This script was created specificly for the particular infection on this specific machine! If you are not this user, do NOT follow these directions as they could damage the workings of your system.Please download The Avenger2 by SwanDog46.Unzip avenger.exe to your desktop.Copy the text in the following codebox by selecting all of it, and pressing (<Control> + C) or by right clicking and selecting "Copy"Files to move:c:\scecli.dll | C:\WINDOWS\system32\scecli.dllNow start The Avenger2 by double clicking avenger.exe on your desktop.Read the prompt that appears, and press OK.Paste the script into the textbox that appears, using (<Control> + V) or by right clicking and choosing "Paste".Press the "Execute" button.You will be presented with 2 confirmation prompts. Select yes on each. Your system will reboot.Note: It is possible that Avenger will reboot your system TWICE.Upon reboot, a command prompt window will appear on your screen for a few seconds, and then Avenger's log will open. Please paste that log here in your next post.Step #3Now try running Malwarebytes, then post the logs here, or let me know what happens. Link to post Share on other sites More sharing options...
jepiper76 Posted August 13, 2009 Author ID:109543 Share Posted August 13, 2009 I ran Malwarebytes, and it stopped again with no log file.I tried to reopen Malewarebytes, and it gives me a popup "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."Still working. Link to post Share on other sites More sharing options...
jepiper76 Posted August 13, 2009 Author ID:109545 Share Posted August 13, 2009 I thought that I posted the avenger log, but it did not show up so here it is again (I also attached the txt file):Logfile of The Avenger Version 2.0, © by Swandog46http://swandog46.geekstogo.comPlatform: Windows XP*******************Script file opened successfully.Script file read successfully.Backups directory opened successfully at C:\Avenger*******************Beginning to process script file:Rootkit scan active.No rootkits found!Error: file "c:\scecli.dll" not found!File move operation "c:\scecli.dll|C:\WINDOWS\system32\scecli.dll" failed!Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not existCompleted script processing.*******************Finished! Terminate.avenger_july_13.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 13, 2009 Root Admin ID:109739 Share Posted August 13, 2009 Do you have a Windows XP CD or access to one so that you can replace that file? Link to post Share on other sites More sharing options...
jepiper76 Posted August 14, 2009 Author ID:109881 Share Posted August 14, 2009 Do you have a Windows XP CD or access to one so that you can replace that file?Yes, I have my original XP Install CD.Can I do this without loosing all my files? Or do I need to save all files to an extral or disc and completely reboot Windows XP?How do I find just the one file to reinstall?Thank you for your time. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 14, 2009 Root Admin ID:110221 Share Posted August 14, 2009 Take a look here on how to install and run the Recovery Console. http://support.microsoft.com/kb/307654I would first copy the file scecli.dll from the CD to a new folder you create such as C:\NEWThen after installing and booting to the Recovery Console use the COPY command to copy the file C:\NEW\scecli.dll to C:\WINDOWS\system32\scecli.dll and overwrite the current one there.Then reboot back into normal Windows and run Combofix again and post back that log. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 18, 2009 Root Admin ID:111355 Share Posted August 18, 2009 Please post a status update on this.Thanks. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 19, 2009 Root Admin ID:111940 Share Posted August 19, 2009 Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you. Link to post Share on other sites More sharing options...
Recommended Posts