Ingen programmer vil innstallere - feilmelding om manglende administrative rettigheter

[Alastor]

Min samboers pc har fått et rart problem, den vil ikke lenger innstallere noen programmer i det hele tatt. Små som store - alle gir feilmelding om at hun ikke har administrative rettigheter, og at innstallasjonen avsluttes.

 

Hun bruker windows xp, og i brukerkontopanelet der står hun oppført som administrator. Hun har kjørt online virusscan fra trendmicro og spybot, men de finner ikkenoe. Det finnes kanskje andre løsninger?

 

Hun får som sagt ikke innstallert ting, så er vanskelig å bruke guiden øverst. Kjenner noen til at det kan være virus som oppfører seg slik? Maskinen fungerer helt knall ellers. OS'et er innstallert for ca 2 måneder siden.

[snippsat]

Ja du har virus som forander policy rettigheter.

 

Se manuelt i register er en mulighet,men da bør man vite hva man ser etter.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System

 

Combofix viser som regel registeroppføringer som er endret.

 

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programmet kjører.

post logg C:\combofix.txt

 

MBAM bruker og fixe opp i dette og.

 

Last ned MBAM til skrivebordet.

Velg Norsk språkdrakt-->kjør hurtig systemskann.

Når MBAM er ferdig åpner den en logg,den poster du.

 

Og du har mulighet of sette den tilbake til en dato pcen virket.

 

Start->kjør

Lim inn fet tekst %systemroot%\system32\restore\rstrui.exe

Endret 1. oktober 2008 av SNIPPSAT

[Alastor]

Skal vi se.

 

Combofix:

 

ComboFix 08-09-30.03 - Karianne 2008-10-01 22:02:32.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1044.18.420 [GMT 2:00]

Running from: D:\Documents and Settings\Karianne\Skrivebord\ComboFix.exe

* Created a new restore point

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\xcrashdump.dat

 

.

((((((((((((((((((((((((( Files Created from 2008-09-01 to 2008-10-01 )))))))))))))))))))))))))))))))

.

 

2008-10-01 20:59 . 2008-10-01 21:01 <DIR> d-------- D:\Documents and Settings\All Users\Programdata\Microsoft Help

2008-09-30 17:58 . 2008-09-30 17:58 <DIR> d-------- D:\Programfiler\YouTube Downloader

2008-09-28 03:00 . 2008-09-28 03:00 <DIR> d-------- D:\WINDOWS\LastGood

2008-09-27 22:01 . 2008-09-27 22:01 540,672 --a------ D:\Programfiler\mss32_s.dll

2008-09-24 19:48 . 2008-09-24 20:34 <DIR> d-------- D:\Documents and Settings\Karianne\.housecall6.6

2008-09-24 15:34 . 2008-09-24 15:34 <DIR> d-------- D:\Programfiler\Alwil Software

2008-09-24 15:17 . 2008-09-24 15:18 <DIR> d-------- D:\Programfiler\Spybot - Search & Destroy

2008-09-24 15:17 . 2008-09-24 15:25 <DIR> d-------- D:\Documents and Settings\All Users\Programdata\Spybot - Search & Destroy

2008-09-16 20:45 . 2008-09-16 20:45 8,512 --ah----- D:\WINDOWS\system32\mlfcache.dat

2008-09-12 12:59 . 2008-09-12 12:59 <DIR> d-------- D:\Programfiler\GetData

2008-09-12 12:59 . 2008-09-12 13:40 <DIR> d-a------ D:\Documents and Settings\All Users\Programdata\TEMP

2008-09-11 09:21 . 2008-09-24 15:13 <DIR> d-------- D:\Programfiler\NOS

2008-09-11 09:21 . 2008-09-24 15:13 <DIR> d-------- D:\Documents and Settings\All Users\Programdata\NOS

2008-09-08 21:10 . 2008-04-13 11:45 26,368 --a--c--- D:\WINDOWS\system32\dllcache\usbstor.sys

2008-09-06 13:02 . 2008-09-06 13:04 <DIR> d-------- D:\Jan Guillou - Arn 1-3 Lydbok

2008-09-06 02:40 . 2008-09-06 05:34 <DIR> d-------- D:\Programfiler\Fellesfiler\Blizzard Entertainment

2008-09-02 20:39 . 2008-09-02 20:39 <DIR> d-------- D:\Programfiler\friends

2008-09-02 19:52 . 2008-09-02 19:52 <DIR> d-------- D:\Programfiler\steam

2008-09-02 19:51 . 2008-09-02 20:08 <DIR> d-------- D:\Programfiler\steamapps

2008-09-02 19:51 . 2008-09-02 19:51 <DIR> d-------- D:\Programfiler\logs

2008-09-02 19:51 . 2008-09-26 13:43 <DIR> d-------- D:\Programfiler\appcache

2008-09-02 19:50 . 2008-09-02 19:50 <DIR> d-------- D:\Programfiler\skins

2008-09-02 19:50 . 2008-09-27 22:01 <DIR> d-------- D:\Programfiler\resource

2008-09-02 19:50 . 2008-09-27 22:01 <DIR> d-------- D:\Programfiler\Graphics

2008-09-02 19:50 . 2008-09-06 00:12 <DIR> d-------- D:\Programfiler\config

2008-09-02 19:50 . 2008-09-27 22:01 3,073,272 --a------ D:\Programfiler\Steam.dll

2008-09-02 19:50 . 2008-09-27 22:01 2,909,432 --a------ D:\Programfiler\SteamUI.dll

2008-09-02 19:50 . 2008-09-27 22:01 2,585,848 --a------ D:\Programfiler\steamclient.dll

2008-09-02 19:50 . 2008-09-27 22:01 1,039,192 --a------ D:\Programfiler\dbghelp.dll

2008-09-02 19:50 . 2008-09-27 22:01 1,017,080 --a------ D:\Programfiler\GameOverlayUI.exe

2008-09-02 19:50 . 2008-09-27 22:01 371,184 --a------ D:\Programfiler\vstdlib_s.dll

2008-09-02 19:50 . 2008-09-27 22:01 251,128 --a------ D:\Programfiler\WriteMiniDump.exe

2008-09-02 19:50 . 2008-09-27 22:01 244,208 --a------ D:\Programfiler\tier0_s.dll

2008-09-02 19:50 . 2008-09-27 22:01 244,208 --a------ D:\Programfiler\GameOverlayRenderer.dll

2008-09-02 19:50 . 2008-09-27 22:01 112,128 --a------ D:\Programfiler\CSERHelper.dll

2008-09-02 19:46 . 2008-09-27 22:01 <DIR> d-------- D:\Programfiler\Public

2008-09-02 19:46 . 2008-09-27 22:01 <DIR> d-------- D:\Programfiler\bin

2008-09-01 23:21 . 2008-09-01 23:21 <DIR> d-------- D:\WINDOWS\Sun

2008-09-01 23:21 . 2008-06-10 02:32 73,728 --a------ D:\WINDOWS\system32\javacpl.cpl

2008-09-01 23:20 . 2008-09-01 23:21 <DIR> d-------- D:\Programfiler\Java

2008-09-01 23:20 . 2008-09-01 23:20 <DIR> d-------- D:\Programfiler\Fellesfiler\Java

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-28 02:18 --------- d-----w D:\Documents and Settings\Karianne\Programdata\uTorrent

2008-09-27 20:01 588,549 ----a-w D:\Programfiler\ClientRegistry.blob

2008-09-27 20:01 57,329 ----a-w D:\Programfiler\SteamUI_659.mst

2008-09-27 20:01 36,731 ----a-w D:\Programfiler\Steam.log

2008-09-26 11:53 69,487 ----a-w D:\Programfiler\AppUpdateStats.blob

2008-09-26 11:53 1,929 ----a-w D:\Programfiler\GameOverlayRenderer.dll.log

2008-09-24 13:25 --------- d-----w D:\Documents and Settings\All Users\Programdata\avg8

2008-09-02 18:18 16,962 ----a-w D:\Programfiler\GameOverlayUI.exe.log

2008-09-02 17:47 14 ----a-w D:\Programfiler\Steam_46.mst

2008-09-02 17:47 1,271,032 ----a-w D:\Programfiler\Steam.exe

2008-08-30 14:09 --------- d-----w D:\Programfiler\uTorrent

2008-08-29 21:08 --------- d-----w D:\Programfiler\VideoLAN

2008-08-29 14:11 --------- d-----w D:\Programfiler\TGTSoft

2008-08-29 11:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Winamp

2008-08-28 17:15 --------- d-----w D:\Programfiler\AVG

2008-08-28 17:04 --------- d-----w D:\Documents and Settings\All Users\Programdata\Messenger Plus!

2008-08-28 16:59 413,696 ----a-w D:\WINDOWS\system32\wrap_oal.dll

2008-08-28 16:59 110,592 ----a-w D:\WINDOWS\system32\OpenAL32.dll

2008-08-28 16:59 --------- d--h--w D:\Programfiler\InstallShield Installation Information

2008-08-28 16:59 --------- d-----w D:\Programfiler\Fellesfiler\Creative Labs Shared

2008-08-28 16:59 --------- d-----w D:\Programfiler\Creative

2008-08-28 16:59 --------- d-----w D:\Documents and Settings\All Users\Programdata\Creative

2008-08-28 16:38 --------- d-----w D:\Programfiler\Logitech

2008-08-28 16:38 --------- d-----w D:\Documents and Settings\All Users\Programdata\Logitech

2008-08-28 16:35 --------- d-----w D:\Programfiler\Ventrilo

2008-08-28 16:35 --------- d-----w D:\Programfiler\Fellesfiler\Wise Installation Wizard

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Logitech

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\LimeWire

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\InstallShield

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Hamachi

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\CyberLink

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Creative

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Azureus

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\ATI

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Apple Computer

2008-08-28 16:26 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Ahead

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\WTablet

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\vlc

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Ventrilo

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\teamspeak2

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Sony

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\skypePM

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Skype

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Screenshot Sender

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\Publish Providers

2008-08-28 16:25 --------- d-----w D:\Documents and Settings\Karianne\Programdata\MusicIP

2008-08-28 16:20 --------- d-----w D:\Programfiler\Winamp

2008-08-28 16:13 --------- d-----w D:\Programfiler\Messenger Plus! Live

2008-08-28 16:10 --------- d-----w D:\Programfiler\Fellesfiler\InstallShield

2008-08-28 16:05 --------- d-----w D:\Programfiler\Windows Live

2008-08-28 16:04 --------- dcsh--w D:\Programfiler\Fellesfiler\WindowsLiveInstaller

2008-08-28 16:03 --------- d-----w D:\Documents and Settings\All Users\Programdata\WLInstaller

2008-08-28 15:55 --------- d-----w D:\Programfiler\NVIDIA Corporation

2008-08-28 15:44 --------- d-----w D:\Programfiler\microsoft frontpage

2008-08-28 15:43 --------- d-----w D:\Programfiler\Elektroniske tjenester

2008-08-28 15:42 --------- d-----w D:\Programfiler\Fellesfiler\Tjenester

2008-08-28 15:40 --------- d-----w D:\Programfiler\Windows Media Connect 2

2008-08-01 06:38 3,266,560 ----a-w D:\WINDOWS\system32\drivers\ati2mtag.sys

2008-08-01 05:40 9,928,704 ----a-w D:\WINDOWS\system32\atioglxx.dll

2008-08-01 04:58 253,952 ----a-w D:\WINDOWS\system32\atiok3x2.dll

2008-08-01 04:33 425,984 ----a-w D:\WINDOWS\system32\ATIDEMGX.dll

2008-08-01 04:32 311,296 ----a-w D:\WINDOWS\system32\ati2dvag.dll

2008-08-01 04:23 184,320 ----a-w D:\WINDOWS\system32\atipdlxx.dll

2008-08-01 04:23 143,360 ----a-w D:\WINDOWS\system32\Oemdspif.dll

2008-08-01 04:22 43,520 ----a-w D:\WINDOWS\system32\ati2edxx.dll

2008-08-01 04:22 26,112 ----a-w D:\WINDOWS\system32\Ati2mdxx.exe

2008-08-01 04:22 143,360 ----a-w D:\WINDOWS\system32\ati2evxx.dll

2008-08-01 04:21 573,440 ----a-w D:\WINDOWS\system32\ati2evxx.exe

2008-08-01 04:19 53,248 ----a-w D:\WINDOWS\system32\ATIDDC.DLL

2008-08-01 04:10 3,917,568 ----a-w D:\WINDOWS\system32\ati3duag.dll

2008-08-01 03:59 2,183,552 ----a-w D:\WINDOWS\system32\ativvaxx.dll

2008-08-01 03:46 48,640 ----a-w D:\WINDOWS\system32\amdpcom32.dll

2008-08-01 03:42 376,832 ----a-w D:\WINDOWS\system32\atikvmag.dll

2008-08-01 03:40 35,328 ----a-w D:\WINDOWS\system32\atiadlxx.dll

2008-08-01 03:40 17,408 ----a-w D:\WINDOWS\system32\atitvo32.dll

2008-08-01 03:39 53,248 ----a-w D:\WINDOWS\system32\drivers\ati2erec.dll

2008-08-01 03:39 307,200 ----a-w D:\WINDOWS\system32\atiiiexx.dll

2008-08-01 03:34 561,152 ----a-w D:\WINDOWS\system32\ati2cqag.dll

2008-07-31 19:05 593,920 ------w D:\WINDOWS\system32\ati2sgag.exe

2008-07-18 20:10 94,920 ----a-w D:\WINDOWS\system32\cdm.dll

2008-07-18 20:10 53,448 ----a-w D:\WINDOWS\system32\wuauclt.exe

2008-07-18 20:10 45,768 ----a-w D:\WINDOWS\system32\wups2.dll

2008-07-18 20:10 36,552 ----a-w D:\WINDOWS\system32\wups.dll

2008-07-18 20:09 563,912 ----a-w D:\WINDOWS\system32\wuapi.dll

2008-07-18 20:09 325,832 ----a-w D:\WINDOWS\system32\wucltui.dll

2008-07-18 20:09 205,000 ----a-w D:\WINDOWS\system32\wuweb.dll

2008-07-18 20:09 1,811,656 ----a-w D:\WINDOWS\system32\wuaueng.dll

2008-07-18 20:07 270,880 ----a-w D:\WINDOWS\system32\mucltui.dll

2008-07-18 20:07 210,976 ----a-w D:\WINDOWS\system32\muweb.dll

2008-07-15 15:23 72,728 ----a-w D:\WINDOWS\system32\CTHWIUT.DLL

2008-07-15 15:23 170,520 ----a-w D:\WINDOWS\system32\CT20XUT.DLL

2008-07-15 15:22 1,323,544 ----a-w D:\WINDOWS\system32\CTEXFIFX.DLL

2008-07-14 23:08 24,089,151 ----a-w D:\WINDOWS\system32\AppSetup.exe

2008-07-11 13:53 86,016 ----a-w D:\WINDOWS\system32\ctcoinst.dll

2008-07-11 13:53 181,248 ----a-w D:\WINDOWS\system32\ctdvinst.dll

2008-07-11 13:53 11,776 ----a-w D:\WINDOWS\INRES.DLL

2008-07-11 13:51 34,816 ----a-w D:\WINDOWS\system32\a3d.dll

2008-07-11 13:51 27,648 ----a-w D:\WINDOWS\system32\ac3api.dll

2008-07-11 13:50 45,056 ----a-w D:\WINDOWS\system32\CTxfiSpk.dll

2008-07-11 13:50 35,840 ----a-w D:\WINDOWS\system32\CTxfiBtn.dll

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

"MsnMsgr"="D:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"Steam"="D:\Programfiler\Steam.exe" [2008-09-02 1271032]

"SpybotSD TeaTimer"="D:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Launch LCDMon"="D:\Programfiler\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 2051096]

"Launch LGDCore"="D:\Programfiler\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 2095640]

"WinampAgent"="D:\Programfiler\Winamp\winampa.exe" [2008-08-04 36352]

"SunJavaUpdateSched"="D:\Programfiler\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

"CTxfiHlp"="CTXFIHLP.EXE" [2008-07-11 D:\WINDOWS\system32\Ctxfihlp.exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"D:\\Programfiler\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"D:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"D:\\Programfiler\\Windows Live\\Messenger\\livecall.exe"=

"F:\\mIRC\\mirc.exe"=

"D:\\Programfiler\\uTorrent\\uTorrent.exe"=

"D:\\Programfiler\\steamapps\\kranna\\counter-strike\\hl.exe"=

"F:\\World of Warcraft\\BackgroundDownloader.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

 

R1 aswSP;avast! Self Protection;D:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]

R2 aswFsBlk;aswFsBlk;D:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]

R3 ha20x2k;Creative 20X HAL Driver;D:\WINDOWS\system32\drivers\ha20x2k.sys [2008-07-15 1173016]

S2 CTAudSvcService;Creative Audio Service;D:\Programfiler\Creative\Shared Files\CTAudSvc.exe [2008-04-30 417792]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;D:\Programfiler\Fellesfiler\Creative Labs Shared\Service\CTAELicensing.exe [2008-08-28 79360]

 

*Newly Created Service* - PROCEXP90

.

.

------- Supplementary Scan -------

.

FireFox -: Profile - D:\Documents and Settings\Karianne\Programdata\Mozilla\Firefox\Profiles\0y9n1avt.default\

FF -: plugin - D:\Documents and Settings\Karianne\Programdata\Mozilla\plugins\npoctoshape.dll

FF -: plugin - D:\Programfiler\Mozilla Firefox\plugins\np_gp.dll

.

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-01 22:03:28

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

CTxfiHlp = CTXFIHLP.EXE?

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2008-10-01 22:03:50

ComboFix-quarantined-files.txt 2008-10-01 20:03:48

 

Pre-Run: 6 822 608 896 byte ledig

Post-Run: 6,965,051,392 byte ledig

 

221 --- E O F --- 2008-10-01 01:00:21

 

 

MBAM:

Malwarebytes' Anti-Malware 1.28

Database versjon: 1225

Windows 5.1.2600 Service Pack 3

 

01.10.2008 22:08:35

mbam-log-2008-10-01 (22-08-35).txt

 

Skanntype: Rask Skann

Objekter skannet: 37969

Tid tilbakelagt: 1 minute(s), 5 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

 

Ting ser jo rimelig clean ut?

[snippsat]

Ser rimlig bra ut ja.

 

Når skjedde dette?

 

Jeg tipper 2008-09-24 15:34

Da ble avast innstalert.

Sammtidig ble også spybot innstalert.

 

Det kan ha blitt konflikt med avg som har vært på pcen før.

 

Dette er en kjent problem at rester fra andre antivirus skaper konflikt.

Eller at avast har lagd noe surr selv.

 

Da er jo systemgjoppretting til før den dato en løsning.

Endret 1. oktober 2008 av SNIPPSAT