Can't remove Old S&D files to reinstall Spybot

Have been working with ken545 your Security Expert for the past week and we finally have my system working. The last step was to uninstall spybot and reinstall because very time i tried to start it I would get this Error:

"Windows Cannot Access the specified deice,path or file.
You may not have the appropriate permissions to access the item"

as instructed I uninstalled it and I always check to see if everything was removed and I found 3 files that i cannot remove..See attached screen shot.

He then advised me to post here.

Not very comfortable with S&D off line...:sad:
please advise.

Thanks
HR

I have the same problem. I just got infected with something that disabled my McAfee VS, Spybot S&D and Malwarebtes' Anti-Malware. It also disabled my internet connection in normal mode.
I'm normally pretty good at finding and fixing siple infections, but this one had me puzzled (I ended up paying McAfee techs $98 to fix it remotely).
Anyway, after disenfecting, I ununstalled Spybot and downloaded a fresh copy.
When I went to install, it wouldn't let me because of a file in the C:\Program Files\Spybot - Search & Destroy folder called C:windows\program files\spybot S&D.exe (or similar).
I tried to delete and shred the C:\Program Files\Spybot - Search & Destroy folder but it is marked as read only and would not let me delete it. I get the same message you are getting!
Anyone help?

Hello,

Sounds like you are infected with a Rootkit.
For more informations please have a look at this link.

Best regards
Sandra
Team Spybot

Morning Sandra,
YES I was infected with the "Rootkit" bug and it took over a week of work from
Your Teammate ken545 Spybot Security Expert to clean it up and has released me today to work with This team to get rid of these 3 files..

I have done all steps as listed they cannot be deleted or renamed.
I'v tried in both standard and safe mode and get the same Error.

"Windows Cannot Access the specified deice,path or file.
You may not have the appropriate permissions to access the item"

Ken545 has again instructed me to follow this team instructions on removing and reinstalling S&D.
Please advise Next step.

Thanks
HR

Hello,

Did you have a look at your taskmanager if there is anything running from Spybot? If you see the SpybotSD.exe there you can kill the process.

Are you logged in as admin or only as user with admin rights?

Have you tried to delete the whole folder and not the single files?

Best regards
Sandra
Team Spybot

Quote:

---

Originally Posted by spybotsandra

Hello,

Did you have a look at your taskmanager if there is anything running from Spybot?
NO checked before and just checked again
If you see the SpybotSD.exe there you can kill the process.

Are you logged in as admin or only as user with admin rights?
as Admin

Have you tried to delete the whole folder and not the single files?
Yes and get the same error as above

Best regards
Sandra
Team Spybot

---

some other things you should know

* removed application S&D by control panel "add & remove Programs"
it said could not remove all files.

*Checked properties of each file have 'Read only" and "Hidden" checked and
Hidden is Grayed out. If I uncheck the "read only" box and hit apply i get this error.
"An Error occurred applying attributes to this file Access is Denied" same for the folder "Skybot -Search and Destroy

*verified folder options "show hidden files" is checked

The malware that had (been removed) infected my system Changed and locked these files so i cound not run this program..

* when you click on theSpybotSD.exe you get this error:
"Windows Cannot Access the specified deice,path or file.
You may not have the appropriate permissions to access the item"

So how do we fix what the nasty little Bug did..:flame:

Hello,

I am sorry, but then I do not think that your system is clean.
Did you try to download a fresh installation of Spybot and copy it over the existing file?

Best regards
Sandra
Team Spybot

I am having same problem with a clients computer. The properties box for the SpybotSD.exe file is different than normal application programs. Instead of the normal "General", "Version", "Compatibility", "Digital Signatures", and "Summary" tabs the dialogue box has "General", "Program", "Fonts", "Memory", "Screen", "Miscellaneous", "Compatibility", and "Security" tabs like the .pif shortcut files that are required to run DOS applications under Windows. I was able to successfully delete the old SpybotSD.exe file and the directory by using bootable CD-ROM disk. Before deleting the program and it's directory I couldn't re-load Spybot. After deleting, I was able to load a new copy, but it will not run with the: "Windows Cannot Access the specified deice, path or file.
You may not have the appropriate permissions to access the item" error message.

I have forward this back to the Malware Removal Team that was working
with me this week, they are working on it.

When you go into the properties of "spybotsd.exe" the security group is fake: it is called "everyone". You have to remove that group, and find and add "Administrators", at which point you can change the access, and "spybotsd.exe" will run, FOR A LITTLE WHILE. Then it bombs out, and when you check the properties of "spybotsd.exe" the security group has been changed back to the fake"everyone".

If you boot into safe mode, you can go to c:\program files\spybot search & destroy using a DOS (Command) prompt, although this is HARD to do!

c:
cd\program files
cd spy [hit the tab key, then enter]

anyway, then you
attrib /? to see the command line options for the attribute command
attrib -r -a -s -h *.*

this will unhide the various files, confirm by
dir spy*.* /a

you can then
del spybotsd.exe

this will finally clear the "spybotsd.exe" file from the directory, at which point to can copy a new version.

UNFORTUNATELY, it runs at first, then bombs out, then -- you guessed it:
you return to "spybotsd.exe" and the security group is again the fake "everyone" !!

So there has to be a background program running that detects when something in Spybot is running and immediately kills it and sets up all the access permissions to the fake "everyone"