Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cannot Open Any Programs In Normal Mode


  • Please log in to reply
18 replies to this topic

#1 jackeng

jackeng

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 18 February 2008 - 12:57 PM

I need help. When i try to open a program I get the following error message. (Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access them.) This just started in the past couple of days. I can open the programs in the safe mode. I also found out that by going to properties one by one I can access the programs under a differant user name, even though I selct my own user profile.

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,854 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:21 PM

Posted 18 February 2008 - 04:25 PM

Hello jackeng and welcome to BC :flowers:

We need to get some more information from you to help us diagnose what the cause of your problems is.

What is your operating system: Windows XP, Vista etc.?

Do you remember what you were doing before this started happening?

Do you have any security programs installed? If so, what are they?

Have you performed any scans with them?

Does this happen with all files and programs or just certain ones?

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 jackeng

jackeng
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 18 February 2008 - 04:46 PM

Hello Orangeblossom,

I am running windows xp Home Edition. I have Spyware Detector and Trend Micro PCillin ver 7 installed. I have scanned my computer with both and they have resolve some suspected files but have not cured the problem. I do not know what was running when this started as my wife was on at the time. I cannot open any files in the normal mode. I am the administrator of my computer but it treats me the same. I can right click on a program, go to properties, click advanced, run with different credentials, and select my same profile and it will open. Got me buffaloed. Thanks for your interest

#4 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,854 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:21 PM

Posted 18 February 2008 - 04:50 PM

Hello jackeng,

Please tell us what your security programs found. Include the file path of the files or folders in question.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#5 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:10:21 PM

Posted 18 February 2008 - 04:51 PM

will it allow you to access system restore to roll the computer back to a date when all WAS working ?

does your wife use the same profile as you ?

#6 jackeng

jackeng
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 18 February 2008 - 05:05 PM

Hello orangeblossom and ruby,

Sorry but I can't tell you what files the programs found because I didn't record them. I can get into restore through safe mode and have done that back a few days, but to no avaail. Thanks for your interest.

#7 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,854 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:21 PM

Posted 18 February 2008 - 05:44 PM

Hello jackeng,

See if you can find the logs for your security programs, the files should be listed there.

System Restore generally doesn't resolve computer problems when the problems are caused by an infection.

I suggest at this point to scan with SUPERAntiSpyware in Safe Mode. Of course, you will install it in normal mode.

Download and install SUPERAntiSpyware free found here: http://www.superantispyware.com/superantis...efreevspro.html

Be sure to click on the download button to the left, not on the free trial download on the right.

Install it and double-click the icon on your desktop to run it.
· It will ask if you want to update the program definitions, click Yes.
· Under Configuration and Preferences, click the Preferences button.
· Click the Scanning Control tab.
· Under Scanner Options make sure the following are checked:
o Close browsers before scanning
o Scan for tracking cookies
o Terminate memory threats before quarantining.
o Please leave the others unchecked.
o Click the Close button to leave the control center screen.
Reboot into safe mode and open SUPERAntiSpyware
· On the main screen, under Scan for Harmful Software click Scan your computer.
· On the left check C:\Fixed Drive.
· On the right, under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan. Please be patient while it scans your computer.
· After the scan is complete a summary box will appear. Click OK.
· Make sure everything in the white box has a check next to it, then click Next.
· It will quarantine what it found and if it asks if you want to reboot, click Yes.
Reboot into Normal mode
· To retrieve the removal information for me please do the following:
o After reboot, double-click the SUPERAntispyware icon on your desktop.
o Click Preferences. Click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o It will open in your default text editor (such as Notepad/Wordpad).
o Please highlight everything in the notepad, then right-click and choose copy.
· Click close and close again to exit the program.

Please post the log in your next reply.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#8 jackeng

jackeng
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 19 February 2008 - 09:05 AM

Ran the superspyware in normal mode. It would not run in safe mode. At any rate here is the log.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/18/2008 at 07:23 PM

Application Version : 3.9.1008

Core Rules Database Version : 3404
Trace Rules Database Version: 1396

Scan type : Complete Scan
Total Scan Time : 01:56:15

Memory items scanned : 461
Memory threats detected : 0
Registry items scanned : 6377
Registry threats detected : 0
File items scanned : 97345
File threats detected : 13

Adware.Tracking Cookie
C:\Documents and Settings\Jack Engleman\Cookies\jack engleman@questionmarket[1].txt
C:\Documents and Settings\Jack Engleman\Cookies\jack engleman@ehg-ittoolbox.hitbox[2].txt
C:\Documents and Settings\Jack Engleman\Cookies\jack engleman@hitbox[2].txt
C:\Documents and Settings\Jack Engleman\Cookies\jack engleman@atdmt[1].txt
C:\Documents and Settings\Jack Engleman\Cookies\jack engleman@tribalfusion[1].txt
C:\Documents and Settings\Jack Engleman\Cookies\jack engleman@itxt.vibrantmedia[2].txt
C:\Documents and Settings\Jack Engleman\Cookies\jack engleman@doubleclick[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adlegend[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@overture[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[2].txt
C:\Documents and Settings\Loretta Engleman\Local Settings\Temp\Cookies\loretta engleman@casalemedia[2].txt

#9 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,854 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:21 PM

Posted 19 February 2008 - 11:08 AM

Hello jackeng,

Were you able to find the logs from the scans you did with Spyware Detector and Trend Micro PCillin?

Also, please let us know what your operating system is.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#10 jackeng

jackeng
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 19 February 2008 - 05:06 PM

Here is the log from spyware detector. Am working on the Pcillin log.

Spyware Detector BHOs List Report,19-2-2008 15:53:31

[BHOs] BHO

[BHOs] {02478D38-C3F9-4EFB-9B51-7695ECA05670}
Class Name : Yahoo! Toolbar Helper
File Name : C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

[BHOs] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
Class Name : Adobe PDF Reader Link Helper
File Name : C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[BHOs] {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
Class Name : Yahoo! IE Services Button
File Name : C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll

[BHOs] {5CA3D70E-1895-11CF-8E15-001234567890}
Class Name : DriveLetterAccess
File Name : C:\WINDOWS\system32\dla\tfswshx.dll

[BHOs] {65E03378-E22E-4f50-BE9D-588A889B24C9}
Class Name : DeskalertsBHO
File Name : C:\Program Files\DeskAlerts\deskbar.dll

[BHOs] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
Class Name : SSVHelper Class
File Name : C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

[BHOs] {AA58ED58-01DD-4d91-8333-CF10577473F7}
Class Name : Google Toolbar Helper
File Name : c:\program files\google\googletoolbar2.dll

[BHOs] {BA463437-C3DE-47da-8280-87596824388A}
Class Name : XBTB06823 Class
File Name :

[BHOs] {CDEEC43D-3572-4E95-A2A5-F519D29F00C0}
Class Name : Advanced Searchbar
File Name : C:\PROGRA~1\ADVANC~1\ADVANC~1.DLL

[BHOs] {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D}
Class Name : SidebarAutoLaunch Class
File Name : C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll

[BHOs] {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}
Class Name :
File Name :

#11 jackeng

jackeng
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 19 February 2008 - 05:12 PM

Hello Orangeblossom,

I am running Windows XP Home Edition with Service Pack 2. Thanks for your interest. I am trying to get the Pcillin log, but because of my problem it is very difficult to toggle back and forth between programs.

#12 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,854 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:21 PM

Posted 19 February 2008 - 11:05 PM

Hello jackeng,

Thanks for the log. That gives us a bit more to work with. A number of the BHO entries are fine. Some I don't recognize, but the following

[BHOs] {BA463437-C3DE-47da-8280-87596824388A}
Class Name : XBTB06823 Class
File Name :


according to my research is connected to a trojan. At this point, I'm going to turn this thread over to someone with more experience than I.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,140 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:21 PM

Posted 20 February 2008 - 08:23 AM

I have Spyware Detector and Trend Micro PCillin ver 7 installed.

Since your using Trend, please see this discussion thread at Microsoft TechNet before doing anything else.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 jackeng

jackeng
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 20 February 2008 - 02:07 PM

Boy O Boy Quietman and Orangeblosson. How can I ever thank you enough. Such a simple fix and my computer works like a new one. Thank you, Thank you, Thank you. I did as the thread suggested and Walla the problem went away. In my searching of the net in the past days I saw where someone said that it was amazing how deep IE ingrains itself into a computer. That is for sure. Interestingly enough I talked to Trend Micro the other day and they refused to help me because the girl told me that it was a Windows problem. Oh well. Again thank you two for all of your help.

#15 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,140 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:21 PM

Posted 20 February 2008 - 02:59 PM

Your welcome.

Now for the BHO related to this CLSID: BA463437-C3DE-47da-8280-87596824388A - the offending file is missing (already removed)

Download ToolbarCop.
  • Extract (unzip) the file, and save the executable to a permanent folder, not a Temp directory. This is because ToolbarCop creates the Undo (.reg) files in the same directory from where it's launched.
  • Double-click on ToolbarCop.exe to launch.
  • Scroll through the list and look for the Add-on (Object Type/Class ID) BA463437-C3DE-47da-8280-87596824388A.
  • Right-click (highlight) the Add-on and choose Delete the selected item.
ToolbarCop Usage Instructions if needed.

Or if you have Spybot S&D installed, launch it, go to mode and click Advanced. Then go to Tools and make sure there is a check mark next to BHOs on the right. Under Tools click on BHOs and scroll through the list for an entry related to the CLISD to remove. Click on the entry to highlight it, then select "Remove".
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users