Spybot won't run, insufficient rights ...?

[JHebert]

Hi. I think I have a virus on my computer. I'm trying to fix my computer, and someone told me to use Spybot. I installed it successfully (I think), but when I tried to run it, it immediately closed. When I tried to run it again, an error message popped up saying I did not have sufficient rights to run the program. I get the same error when running in safe mode. Help!

The exact error looks like:
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

The only option is to hit OK.

Please note that I am logged in under the Administrator account in safe mode.

[drragostea]

What Operating System are you running?

[spybotsandra]

Hello,

Please try to rename the SpybotSD.exe into explorer.exe and try to run it.

* Using Windows Explorer navigate to:
o C:\Program Files\Spybot - Search & Destroy
* In the Tools menu select Folder Options…
* In the Folder Options dialog select the View tab.
* Uncheck the following option:
o Hide protected operating system file (Recommended)
* Click the Apply button.
* Click the OK button.
* The SpybotSD.exe should be visible now.
* Rightclick the file and choose rename.
* Give it a different name like explorer.exe and try again to run it.

If this does not help this problem you experience may be caused by an infection. Just to make sure you are not infected with a rootkit, please run a scan for rootkits. Rootkits are a technology that is more and more often used by malware to hide themselves on system level, making themselves invisible to standard tools. Our RootAlyzer shows you anything that uses certain rootkit technologies, even if it's not in Spybot-S&Ds detection database.

The RootAlyzer is a single tool which goes through the file system, the registry and process related lists. When you start RootAlyzer, it performs a very quick scan of a few important places, taking about a second on modern machines. To check the full system, you have the possibility of choosing a Deep Scan.

Currently, the RootAlyzer is a work in progress (with a new project tools category in our forum to track bugs and feature requests), but it's already helping to easily locate most of the current malware rootkits. It is compatible with Windows NT/2000/XP/2k3 and Vista. If you like to check out the new RootAlyzer you will find it in our forum: http://forums.spybot.info/showthread.php?t=24185

Here is also the direct download link.

Please set your computer to show all files.

* Double-click My Computer.

* Click the Tools menu, and then click Folder Options.

* Click the View tab.

* Clear "Hide file extensions for known file types."

* Under the "Hidden files" folder, select "Show hidden files and folders."

* Clear "Hide protected operating system files."

* Click Apply, and then click OK.

Please select the tab 'deep scan' and let it fully scan your Pc. The scan will take a moment, please be patient. After the scan is done please click on 'pack suspicious files' which is located right at the bottom. This will create a .cab file on your desktop which contains the log and the suspicious files the scan has found. Please attach this .cab file to your next mail to: detections(at)spybot.info .

Please also download gmer: www.gmer.net and let it do a full scan on your Pc. Subsequent you will be allowed to save the log created during the scan. Please also send us this log.

Thanks!

Best regards
Sandra
Team Spybot

[JHebert]

What Operating System are you running?

Windows XP Media Center Edition 2005

[JHebert]

Tried to rename SpybotSD.exe to explorer.exe as requested. Error reads:

Error Renaming File or Folder
Cannot rename SpybotSD: Access is denied.
Make sure the disk is not full or write-protected
and that the file is not currently in use.

[JHebert]

I have sent the RootAlyzer .cab file and the GMER log to detections@spybot.info as requested.

[nightowl007]

Hi. I think I have a virus on my computer. I'm trying to fix my computer, and someone told me to use Spybot. I installed it successfully (I think), but when I tried to run it, it immediately closed. When I tried to run it again, an error message popped up saying I did not have sufficient rights to run the program. I get the same error when running in safe mode. Help!

The exact error looks like:
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

The only option is to hit OK.

Please note that I am logged in under the Administrator account in safe mode.

I am working on one with the same issue.

None of the malware removal apps will run more than once. Install them, launch them, they start to run and the abruptly exit, never to run again.

Autoruns, HijackThis, MBAM, etc. All exhibit the same issue. It's some type of startup service/driver that is causing it. I can't run anything on it to figure out what it is (yet).

[JHebert]

Well, another day is gone and I'm still fighting with this thing.

A friend of mine directed me to the program Combofix, but it doesn't work. I had him look at my computer and he found a directory on the C drive labeled "32788R22FWJFW". The directory is filled with .reg, .exe, and .bat files, and my friend said it was a virus. I deleted it, but when I tried to run Combofix "32788R22FWJFW" came back, and Combofix would never run. A blue progress bar came up, but the program never started. I know I'm not supposed to run programs like this unless asked to by a moderator...sorry. I'm just trying to be proactive...besides, it didn't work anyway.

My friend also suggested Hijackthis, and Malwarebytes, but they cause the same issue as Spybot: they open once, start to scan, close, and will never reopen.

Digging around on my own, I found a command to restore default security settings:

secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose

Running this command allowed me to run Spybot, but again only once before it would no longer open.

I'm hoping someone will come up with a fix for this!

[tashi]

Hello,

Users with infected personal computers please see this FAQ: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

If the infection prevents HJT from running, please start a topic anyway and make note of the situation.

Best regards.

[JHebert]

Hello,

Users with infected personal computers please see this FAQ: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

Best regards.

I believe I've tried everything in the FAQ. I'm sorry, but is there something else I'm supposed to be doing?