Results 1 to 4 of 4

Thread: Cannot create file "C:\windows\system32\drivers\etc\hosts" access denied

  1. 2010-04-03, 23:04 #1
    Thedodgeneon
    Thedodgeneon is offline
    Junior Member
    Join Date
    Apr 2010
    Posts
    5

    Default Cannot create file "C:\windows\system32\drivers\etc\hosts" access denied

    I ran Spybot, and several items were fixed. However, I received the following error: Unexpected error fixing problems (Cannot create file "C:\windows\system32\drivers\etc\hosts" access denied)
    Fraud.WindowsProtectionSuite And Microsoft.Windows.RedirectedHosts
    Also HJT is having the same type of access error problems.

    IT SEEMS TO BE VERY SIMILAR TO THIS PROBLEM THAT WAS ALREADY POSTED AND SOLVED PREVIOUSLY. But I could not figure it out.
    http://forums.spybot.info/showthread.php?t=52865

    ANYWAYS i ran DDS Plz help me out.

    DDS (Ver_10-03-17.01) - NTFSx86
    Run by nasmazcar at 16:56:26.19 on Sat 04/03/2010
    Internet Explorer: 8.0.6001.18904
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.2381 [GMT -4:00]

    SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Hewlett-Packard\HP Odometer\hpsysdrv.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\PictureMover\Bin\PictureMover.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\LSI SoftModem\agrsmsvc.exe
    c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil10e.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Users\nasmazcar\Desktop\dds.pif
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0552.0\msneshellx.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0552.0\msneshellx.dll
    TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
    mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\cyberlink dvd suite deluxe\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\cyberlink dvd suite deluxe" updatewithcreateonce "software\cyberlink\PowerStarter"
    mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"
    mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"
    mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [hpsysdrv] c:\program files\hewlett-packard\hp odometer\hpsysdrv.exe
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
    mRun: [DVDAgent] "c:\program files\hewlett-packard\media\dvd\DVDAgent.exe"
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\pictur~1.lnk - c:\program files\picturemover\bin\PictureMover.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    IFEO: image file execution options - svchost.exe
    IFEO: mrt.exe - svchost.exe
    Hosts: 74.125.45.100 4-open-davinci.com
    Hosts: 74.125.45.100 securitysoftwarepayments.com
    Hosts: 74.125.45.100 privatesecuredpayments.com
    Hosts: 74.125.45.100 secure.privatesecuredpayments.com
    Hosts: 74.125.45.100 getantivirusplusnow.com

    Note: multiple HOSTS entries found. Please refer to Attach.txt

    ============= SERVICES / DRIVERS ===============

    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2009-9-15 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-9-15 66632]
    R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-3-30 1153368]
    S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
    S3 PCDSRVC{4F253FFC-7957E8FC-06000000}_0;PCDSRVC{4F253FFC-7957E8FC-06000000}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\pc-doctor for windows\pcdsrvc.pkms [2009-2-2 20848]
    S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-9-15 12872]
    S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-3 135664]

    =============== Created Last 30 ================

    2010-03-31 21:06:54 72704 ----a-w- c:\windows\system32\admparse.dll
    2010-03-31 02:11:58 0 d-----w- c:\program files\Trend Micro
    2010-03-31 02:11:29 0 d-----w- c:\programdata\Spybot - Search & Destroy
    2010-03-31 02:11:29 0 d-----w- c:\program files\Spybot - Search & Destroy
    2010-03-31 01:10:16 0 d-----w- c:\programdata\SUPERAntiSpyware.com
    2010-03-31 01:09:41 0 d-----w- c:\users\nasmaz~1\appdata\roaming\SUPERAntiSpyware.com
    2010-03-31 01:09:41 0 d-----w- c:\program files\SUPERAntiSpyware
    2010-03-31 01:09:19 0 d-----w- c:\program files\common files\Wise Installation Wizard
    2010-03-30 19:14:25 0 d-----w- c:\users\nasmaz~1\appdata\roaming\Malwarebytes
    2010-03-30 19:14:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-03-30 19:14:21 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-03-30 19:14:21 0 d-----w- c:\programdata\Malwarebytes
    2010-03-30 19:14:20 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-03-30 19:03:24 0 d-----w- c:\programdata\Sun
    2010-03-30 18:49:28 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-03-30 18:44:50 0 d-----w- c:\program files\Lavasoft
    2010-03-30 04:07:02 0 d-----w- c:\programdata\Office Genuine Advantage
    2010-03-30 01:56:02 181632 ------w- c:\windows\system32\MpSigStub.exe
    2010-03-30 01:34:52 0 d-----w- c:\windows\pss
    2010-03-27 15:19:21 0 d-sh--w- c:\programdata\CUHDQMDSA
    2010-03-27 15:18:48 0 d-sh--w- c:\programdata\049e462
    2010-03-10 08:00:21 24064 ----a-w- c:\windows\system32\nshhttp.dll
    2010-03-10 08:00:19 411648 ----a-w- c:\windows\system32\drivers\http.sys
    2010-03-10 08:00:19 30720 ----a-w- c:\windows\system32\httpapi.dll
    2010-03-10 00:43:56 0 d-----w- c:\program files\The Weather Channel FW

    ==================== Find3M ====================

    2010-03-30 03:49:15 51200 ----a-w- c:\windows\inf\infpub.dat
    2010-03-30 03:49:15 143360 ----a-w- c:\windows\inf\infstrng.dat
    2010-03-30 03:49:14 143360 ----a-w- c:\windows\inf\infstor.dat
    2010-03-09 08:28:20 411368 ----a-w- c:\windows\system32\deploytk.dll
    2010-02-23 06:39:13 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-02-23 06:33:45 71680 ----a-w- c:\windows\system32\iesetup.dll
    2010-02-23 06:33:45 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2010-02-23 04:55:36 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2010-02-22 00:55:34 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
    2010-01-31 08:15:14 665600 ----a-w- c:\windows\inf\drvindex.dat
    2010-01-25 12:00:35 471552 ----a-w- c:\windows\system32\secproc_isv.dll
    2010-01-25 12:00:35 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
    2010-01-25 12:00:35 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
    2010-01-25 12:00:22 471552 ----a-w- c:\windows\system32\secproc.dll
    2010-01-25 11:58:52 332288 ----a-w- c:\windows\system32\msdrm.dll
    2010-01-25 08:21:20 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
    2010-01-25 08:21:20 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
    2010-01-25 08:21:18 518144 ----a-w- c:\windows\system32\RMActivate.exe
    2010-01-25 08:21:18 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
    2010-01-23 09:26:13 2048 ----a-w- c:\windows\system32\tzres.dll
    2010-01-06 15:39:38 1696256 ----a-w- c:\windows\system32\gameux.dll
    2010-01-06 15:38:47 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
    2010-01-06 13:30:41 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
    2008-01-21 02:43:21 174 --sha-w- c:\program files\desktop.ini
    2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
    2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
    2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
    2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
    2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
    2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
    2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
    2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
    2009-10-24 19:12:08 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
    2009-05-19 01:46:55 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

    ============= FINISH: 16:56:47.67 ===============


    "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)
    Last edited by tashi; 2010-04-04 at 05:49. Reason: Provided link to this forum's FAQ as FYI ;-)
  2. 2010-04-04, 16:13 #2
    Thedodgeneon
    Thedodgeneon is offline
    Junior Member
    Join Date
    Apr 2010
    Posts
    5

    Default BUMP! Can Someone Help Me Please?

    BUMP! Can Someone Help Me Please?
  3. 2010-04-06, 21:49 #3
    Thedodgeneon
    Thedodgeneon is offline
    Junior Member
    Join Date
    Apr 2010
    Posts
    5

    Default

    I have done all of the steps i am suposed to do before posting. I am not sure why no one is responding??? Anyone out there?
  4. 2010-04-08, 19:49 #4
    tashi
    tashi is offline
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,961

    Default

    Hello Thedodgeneon,

    I added the link to this forum's FAQ into your first post.

    "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

    The FAQ, we have to keep adding when people don't read it so please take the time. We can only help if you help us by following it before starting a topic.

    • Posting additional comments or logs before a volunteer responds, can push you back instead of forward, because your thread ends up with a newer date. In addition helpers would think you are already being assisted because of the post count. For that reason we may merge such posts but please do not count on it.



    If the infection prevents HJT from running, please start a topic, make note of the situation and wait for a response.

    Please do not add logs from other scans.
    I see you have started a new topic: http://forums.spybot.info/showthread.php?t=56712

    Quote Originally Posted by Thedodgeneon View Post
    This is the post I was trying to follow to fix my problems. http://forums.spybot.info/showthread.php?t=52865
    Note that all instructions given are customized for that member's computer only, the tools used may cause damage if run on a machine with different specs/infections. Please do not take fixes given to another user and apply to your own machine.
    Please note this link-just in case. Post here if still waiting for help in the Malware Forum, (AFTER) FOUR days

    The four days begins from the date of your new topic. One reason we also say in the sticky, "Please do not start more than one topic for the same computer, during the same period."

    Best regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules