My Control Panel (access Denied) Problems with Running Applications after Malware

[SergioEspaillat]

Hello Everyone and thanks for looking, i really need help and any given i thanks i advance~

The problems all started after Microsoft ran a scan with with Hijackthis to solve a blue screen and Malware problems.

My control panel will not open and when i try to access my documents, pictures,music Etc. It says access is Denied is not accessible. It then tells me that "Register Server has stopped working"
I am Also Getting this Error Various Times when opening Apps

Erorr: The Procedure Entry Point OpenVxDHandle could not be located in the dynamic link library KERNEL32.dll

which then terminate the application.

and some programs like skype say "cannot load the DLL (Dsound.dll)
and when i try to install some programs it says
"windows Install has Stopped working" then it tells me the program was not installed correctly

I am Having so much trouble trying to open up my applications and files. i can get to my pictures from Start->Pictures but its blank does it mean its all gone? I am extremely worried. This is what i have done.

Another Scan with Hijackthis V2.02~

Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:51:58 PM, on 7/21/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Zune\ZuneLauncher.exe
C:\Windows\System32\wpcumi.exe
C:\Windows\vVX1000.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\sergiovsta\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CPMDJQCV\HiJackThis[2].exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [VX1000] C:\Windows\vVX1000.exe
O4 - HKLM\..\Run: [Verizon_McciTrayApp] "C:\Program Files\Verizon\McciTrayApp.exe"
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\rmtray.exe /H
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon/download/DSL/Verizon%20High%20Speed%20Internet%20Installer.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://oas.support.microsoft.com/ActiveX/MSDcode.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7153 bytes

I have Not REMOVED anything because i don't know how to work with HijackThis

And i have done a scan with Registry Mechanic and for some reason about 209 registry Problems cannot be resolved by it, it just ignores it automatically. And bad this is they are all Hi-Threat. It also tells me my system Health is Low.

Please can someone help me i am going through so many headaches to try and get my pictures and VERY IMPORTANT documents back but my computer does not let me! please and thank you

**EDIT**
Various times it also gives me this when trying to isntall a software (firefox this time)

"The Application Failed to Initiate Properly (0xc000000005), Click OK to terminate Application"

I am Also not Able to do a system restore because it keeps saying i have errors in C: drive that need to be fix before continuing i really want to perform a system restore, are there any methods on fixing C: drive errors? i have tried to do that scan for errors with the option it gives me but the scan i guess never starts because it just freezes

[ishaanarora]

try this:::
1. From the Start menu, choose Run...
2. type regedit
- You can screw things up if you go around changing things with regedit when you don't know what you're doing, so be careful here.
3. From the Edit menu, choose Find...
4. type (or copy and paste) NoControlPanel in the search box and uncheck "Keys" and "Data" (so only "Values" is checked)
5. Choose OK to begin the search. It should find an entry that looks like
NoControlPanel REG_DWORD 0x00000001

6. Double-click this. Change the value to 0 (zero) and choose OK
7. Press F3 to repeat the search. There may be multiple entries you need to change. Keep doing this until it reports it can't find any more

[SergioEspaillat]

When I tried this, These were the results

(default) REG_SZ Data not set

should i set this to 0?

**EDIT**
Nevermind i set that to 0 but its still not working

[jholland1964]

The problems all started after Microsoft ran a scan with with Hijackthis to solve a blue screen and Malware problems.

Microsoft could NOT have run a scan with anything. Scans have to be done by the user of the computer.
HiJackThis is NOT a fixer program, but only a scanner which gives a list of items running on the computer, installed on the computer and set to run at start up. It would not cause problems with the Control Panel unless the user chose to use HJT to remove something that should not have been removed. HiJackThis is also not generally used to solve blue screen problems. As stated, it is only a scanner, not a fixer.
Please don't use a program like Registry Mechanic. It won't solve your problems and very likely can cause problems if you don't understand the registry. Change or remove the wrong registry entry and you can totally disable the computer. Leave the registry alone.

I don't see any anti-virus program on the computer, but I do see uTorrent. When doing file sharing one is taking a huge risk without full security programs running and each and every shared file being scanned for malware or infection BEFORE it is opened. I don't really see any malware in the HJT log, though that doesn't mean there isn't any on the computer, especially one without proper security in force.

There are parental controls in force on this computer, are you the parent? If not then only the parent can disable them and many programs and files cannot be accessed unless they are turned off.

[SergioEspaillat]

Microsoft could NOT have run a scan with anything. Scans have to be done by the user of the computer.
HiJackThis is NOT a fixer program, but only a scanner which gives a list of items running on the computer, installed on the computer and set to run at start up. It would not cause problems with the Control Panel unless the user chose to use HJT to remove something that should not have been removed. HiJackThis is also not generally used to solve blue screen problems. As stated, it is only a scanner, not a fixer.
Please don't use a program like Registry Mechanic. It won't solve your problems and very likely can cause problems if you don't understand the registry. Change or remove the wrong registry entry and you can totally disable the computer. Leave the registry alone.

I don't see any anti-virus program on the computer, but I do see uTorrent. When doing file sharing one is taking a huge risk without full security programs running and each and every shared file being scanned for malware or infection BEFORE it is opened. I don't really see any malware in the HJT log, though that doesn't mean there isn't any on the computer, especially one without proper security in force.

There are parental controls in force on this computer, are you the parent? If not then only the parent can disable them and many programs and files cannot be accessed unless they are turned off.

Alright lets get things Cleared, Yes i am the parent but my kids surf the internet all the time they might have downloaded Utorrent. I can also say that microsoft indeed did perform the scan and with it fixed a bluescreen. The Representative was using Pc Control and as I instructed i had important data which I need but after the Problem was solved my pictures were not there and i can recall him using the Software HijackThis to scan and delete the results. I can stick to what I say because i was there and i saw him check everything off and click repair button. Now i Just want to ask you something like you said could it cause the control panels? and can this program delete my pictures and documents? just want to clear that up please.

Thanks for the help by the way.

[jholland1964]

You did not say earlier that this was done by a Microsoft Tech using screen sharing, all you said was that it was done by Microsoft. How are we to know if we are not told this?
It should not have caused the loss of the Control Panel access and should not have caused the loss of the ability to access your pictures either. I have worked on forums such has this one for several years and I have never seen it cause the loss of photos. Nor can I ever recall it removing the ability to access the Control Panel.
Do you happen to have the original log that the Tech used? If so I might be able to figure out what it was he may have removed.

I had to ask the question about parental controls because we just never know. If you were NOT the parent it certainly would not have been the first time a teen posted a question about the inability to access something, while posing as the parent, but was actually asking how to turn off parental controls. That is just something we don't give instructions for and no reputable forum such as this one would give instructions on how to do that. This is why I had to ask, I was not implying anything.

It sounds to me like a key file or files been corrupted or removed. NOT by HiJackThis. Honestly, I have never seen HiJackThis used to correct a blue screen error, ever and this really surprised me that it was used.

You might try running System File Checker to see if the key files can be repaired. You may need your Vista Disk while doing this.
To run System File Checker in Vista do the following:

1/ Click the Start button

2/ From the Start Menu, Click All programs followed by Accessories

3/ In the Accessories menu, Right Click on the Command Prompt option

4/ From the drop down menu that appears, Click on the 'Run as administrator' option

5/ If you have the User Account Control (UAC) enabled you will be asked for authorisation prior to the command prompt opening. You may simply need to press the Continue button if you are the administrator or insert the administrator password etc.

6/ In the Command Prompt window, type: sfc /scannow and then press Enter

7/ A message will appear stating that 'the system scan will begin'

8/ Be patient because the scan may take some time

9/ If any files require replacing SFC will replace them. You may be asked to insert your Vista DVD for this process to continue

10/ If everything is okay you should, after the scan, see the following message "Windows resource protection did not find any integrity violations"

11/ After the scan has completed, Close the command prompt window

[jholland1964]

By the way, I would get rid of the uTorrent program if I were you. Just my opinion but since you don't use it personally and didn't know it was there then I would remove it. File sharing can bring in a whole lot of things you just don't want.
And get yourself a good antivirus program, there are some super FREE ones available
Avira or Avast are both excellent.

[SergioEspaillat]

Everything is well understood since you have more experience then me obviously i will not go against anything you have said.
Additionally i am also sorry for not supplying this information, its just that i am worried files might have been lost and i wanted an answer fast, My documents,pictures, videos,info etc are not showing up. As for what you have instructed I am going to Try it out as soon as i find the install disk.
I also want to address that i do not know where the logs are stored and when i find the log i will post it up right away.

[jholland1964]

If the logs were not saved then they are probably not available. Don't panic, unless the MS tech actually deleted the pictures they are probably there someplace. Try the System File Checker and see what happens there.

[SergioEspaillat]

I found the disk and ran the scan today and it gave me this message
"Windows Recource Protection Could Not Perfom the requested opertaion"

From there on it doesn't do anything, any ideas?

[jholland1964]

Try this:
tap F8
choose repair my computer
choose command prompt
type chkdsk /f c:

[SergioEspaillat]

Try this:
tap F8
choose repair my computer
choose command prompt
type chkdsk /f c:

alright great! i did what you said and it returned me all my files
thanks a lot !!
But still control Panel does not work,
i have done some research and found out that having your
C:system>system32 in read only can cause many problems,
the thing is when i uncheck it, it tells my that all files "access denied"
so thats no good any idea?
and im still getting the horrible error 0xc0000005
Yesterday i ibought norton and backed up my important file.
Thanks for the help btw

[jholland1964]

Try solutions given HERE

[Ms Technology]

JHolland,i have the same problem but when i tried ur steps i got a message saying" Window Resources Protecting could not start repair service" is there something else i gould possibly do??

[crunchie]

JHolland,i have the same problem but when i tried ur steps i got a message saying" Window Resources Protecting could not start repair service" is there something else i gould possibly do??

Hi and welcome to the Daniweb forums :).

==========

There is something you can do. Start your own thread explaining exactly what your problems are and somebody will be able to better assist you on an individual basis.