Cannot install any antivirus program

thomasm

Hi There, Looking for help with an issue on my laptop.

I can't seem to run any antivirus software. I'm able to download all the ones recommended in the stickys and they all start to run for me but after the scan has begun and starts listing infections the scanning tool shuts down and when I try to reopen it tells me a number of different messages

For Microsoft Security Essentials is states Access is denied, Error code 0x8007000s
For Malwarebytes, Kapersky and Superantispyware it states Windows cannot access the specified drive, you may not have appropriate permissions.

My login is the administrator on the machine so not sure why this is the case and the fact it allows me start the scan and gives some results seems odd.

I have gone through step one in the sticky 'So you think you have a virus but cannot get past step two for the reasons above.

I’m running Windows XP, and the windows firewall is on but need to get some antivirus working. This is the laptop,

Motherboard: TOSHIBA | | Portable PC Processor: Intel(R) Core(TM)2 Duo CPU T7500 @ 2.20GHz | uFC-PGA Socket | 1184/200mhz


To my limited knowledge on this it seems some infection is stopping the spyware running... is this possible ??


Any help appreciated, thanks

ScumLord

Are you running the AV in safe mode? I think you'll have problems installing/running MSC in safe mode. Malwarebytes will install and run in safe mode and that's the one I usually use when I'm being prevented from running a virus scan in windows normally. Safe mode will stop what evers loading so you can run the scan.

Blikes

As scumlord said above, Safe mode is your best bet, select safe mod with networking if you need to download malwarebytes first!

yoyo

Sounds like a mbr rootkit, I'd use Kaspersky Live CD, update it and run a scan, if it picks up anything then remove the disc, boot into Windows Safe Mode with Networking and install and update mbam, super as etc and run a scan

Nick

thomasm

Thanks for all the suggestions, I will look at this tonight

thomasm

Ok have tried to run AV in safe mode but I get the same issue referring to access and permissions again. I have looked under user accounts and the only ones that are listed are one under my name and it states I'm the Computer Administrator plus a guest account which states ' guest account is off '

However when I went to log in under safe mode I was presented with two login options, one for my log in and another for administrator. I tried my password under administrator but it did not work. I worked on my login.

So I'm guessing I need to find some how to make the administrator account appear under user accounts and set a password. Again any thoughts appreciated

uch

Just do what yoyo says

Blikes

thomasm wrote: »

Ok have tried to run AV in safe mode but I get the same issue referring to access and permissions again. I have looked under user accounts and the only ones that are listed are one under my name and it states I'm the Computer Administrator plus a guest account which states ' guest account is off '

However when I went to log in under safe mode I was presented with two login options, one for my log in and another for administrator. I tried my password under administrator but it did not work. I worked on my login.

So I'm guessing I need to find some how to make the administrator account appear under user accounts and set a password. Again any thoughts appreciated

You need only run the anti-virus/anti-malware under your account as you do not use the administrator account in your day to day usage!

yoyo

thomasm wrote: »

Ok have tried to run AV in safe mode but I get the same issue referring to access and permissions again. I have looked under user accounts and the only ones that are listed are one under my name and it states I'm the Computer Administrator plus a guest account which states ' guest account is off '

However when I went to log in under safe mode I was presented with two login options, one for my log in and another for administrator. I tried my password under administrator but it did not work. I worked on my login.

So I'm guessing I need to find some how to make the administrator account appear under user accounts and set a password. Again any thoughts appreciated

You have a MBR rootkit virus i.e: that virus (av blocker) is injected into the os on boot, you'll need to remove it outside of Windows, with the KAV Rescue Disc I linked to earlier, if you don't have a CD/DVD drive use a USB key drive, just boot off it same way as you would install Windows, I linked to a step by step guide how to use the rescue disc, its pritty simple really

Nick

thomasm

Got to download the resuce disk and the rescue disc maker but when I try and run the resuce disc maker it gives me 'Error 0x00000c0 has been encountered when creating USB resuce disk'. Google has no answer to that message but on investigation I think the error is in relation to my system not having enough power to run the disk maker. It specifies you need 300ghz processor or higher and my one is only 2.20ghz. Is this the end of the road or is there another option. Thanks again

200motels

thomasm wrote: »

Got to download the resuce disk and the rescue disc maker but when I try and run the resuce disc maker it gives me 'Error 0x00000c0 has been encountered when creating USB resuce disk'. Google has no answer to that message but on investigation I think the error is in relation to my system not having enough power to run the disk maker. It specifies you need 300ghz processor or higher and my one is only 2.20ghz. Is this the end of the road or is there another option. Thanks again

If you can install a fresh Operating System on your Laptop from boot up either with a DVD or USB. What OP do you have?

Blikes

thomasm wrote: »

Got to download the resuce disk and the rescue disc maker but when I try and run the resuce disc maker it gives me 'Error 0x00000c0 has been encountered when creating USB resuce disk'. Google has no answer to that message but on investigation I think the error is in relation to my system not having enough power to run the disk maker. It specifies you need 300ghz processor or higher and my one is only 2.20ghz. Is this the end of the road or is there another option. Thanks again

that 300ghz must be a typo, 2.20 should run it fine, the problem is somewhere else.

yoyo

thomasm wrote: »

Got to download the resuce disk and the rescue disc maker but when I try and run the resuce disc maker it gives me 'Error 0x00000c0 has been encountered when creating USB resuce disk'. Google has no answer to that message but on investigation I think the error is in relation to my system not having enough power to run the disk maker. It specifies you need 300ghz processor or higher and my one is only 2.20ghz. Is this the end of the road or is there another option. Thanks again

Are you making a Rescue Cd or USB key? If USB key format the key first prior to using the rescue disc maker tool (FAT32/Quick format will do). Also if using vista/7 make sure to run the rescue disc maker as admin (Right click its exe>Run as Administrator). If your burning it to CD I would reccomend using ImgBurn

Nick

thomasm

yoyo wrote: »

Are you making a Rescue Cd or USB key? If USB key format the key first prior to using the rescue disc maker tool (FAT32/Quick format will do). Also if using vista/7 make sure to run the rescue disc maker as admin (Right click its exe>Run as Administrator). If your burning it to CD I would reccomend using ImgBurn

Nick

Thanks I'll give this a try

thomasm

yoyo wrote: »

Are you making a Rescue Cd or USB key? If USB key format the key first prior to using the rescue disc maker tool (FAT32/Quick format will do). Also if using vista/7 make sure to run the rescue disc maker as admin (Right click its exe>Run as Administrator). If your burning it to CD I would reccomend using ImgBurn

Nick

I have tried this but am hit with the issue from an earlier post about not being the admin on the machine. Can anyone recommend a password cracking tool of some sort. Bit weary of downloading one without a recommendation.

MrVestek

thomasm wrote: »

I have tried this but am hit with the issue from an earlier post about not being the admin on the machine. Can anyone recommend a password cracking tool of some sort. Bit weary of downloading one without a recommendation.

BackTrack has some tools for cracking Windows passwords.

paddybongo

Try running Rkill,and then malwerebytes.;)

www.bleepingcomputer.com/download/rkill/

Verres

I'm guessing that this is an non-Op bump from June, but reading through the thread - the Ops spent nearly a week trying to get this stuff to run?! All the advice is correct and accurate and everything, but I can't fathom spending so long on something like that!

Here's the quick & secure way:

i) back up anything you want to keep (this should be done regularly anyway, so it'll be a quick job)
ii) DBAN the disk (this kills everything)
iii) re-install your OS
iv) Install your programs as needed.

The only long part of this is the DBAN process, but since it run unattended you can just start it running and then leave it for 12 / 24 / 48 hours as needed.

The rest you'll have wrapped before lunch on a Saturday.

I'm all for restore points and rescue disks when it something that can be done in < 2 hours. If it's taking longer than that I always just nuke it from orbit.

BostonB

Verres wrote: »

...
I'm all for restore points and rescue disks when it something that can be done in < 2 hours. If it's taking longer than that I always just nuke it from orbit.

+1 nuke it. Its just quicker.