Hello...

I was wondering if anyone had any insight on how to fix the following issue my friend is experiencing on his machine.

I've run through Howard's 15 preliminary steps as best I could, installed all requested applications, applied updates, ran the scans, etc., and I believe I successfully removed all the infected files that were found. As of yesterday, the AVG, AVGSpyware, SS&D, AdAware scans were all coming up "clean". The Panda rootkit scan also came up clean (no rootkits).

I had some problems running the SmitFraudFix application. It was able to create a log but when running selection #2 (Clean) it just "hung" after "Killing processes" and then "Hosts"....I left it alone for 30 minutes but there was nothing further so I stopped it. Also there was an issue running Combofix - as the functions "scrolled by", it appeared that it could a lot of "loading" of files was "not successfull", and that it did not find files or directory "runs.dat". Saving of registry key windows\currentversion\run to temp00.hiv was not successful, etc. It did go through all the stages, and perhaps these messages are indicative of nothing being found, but it is not clear to me that Combofix was successful.

I've attached the requested scan logs for HJT, Combofix, and AVG Antispyware (post scans). Actually, I'm running the AVG Antispyware again because it did not save the report from yesterday. I will post as soon as it is done, but here are the other two logs.

However, I am still experiencing a problem with administrative rights. In addition to the built-in administrator account, my friend only had his user account with full administrative rights that he used for everything. Of course, this lead to some really ugly virus/spyware/malware installations on his system.

When logging in under either his personal account (which has full administrative rights) or the built-in administrative account, I keep getting "access is denied" errors for the following : attempting to install new hardware (the monitor driver has a problem and every time the machine boots it wants to reinstall the driver to fix it - however, instead of being allowed to fix it, I get the message that I don't have sufficient rights to install new hardware and to see my system administrator).

As part of the ongoing challenge of cleaning his machine, I did a windows repair, which reverted the system back to service pack 3. I downloaded Service Pack 4 for Windows 2000 and attempted to install it and received an error that access to certain registry keys was denied (install was being done as an administrator). I believe the error was something along the lines of the client not holding sufficient priveleges for that key). I have not been able to upgrade to service pack 4.

Also, I cannot do windows updates on the system through the automatic update. I get notified the the updates are available, however, if I attempt to download the updates it just quietly does nothing. Same thing if i go to MS webpage to manually update - system just hands at the point that the download is supposed to take place.

On the other hand, I was able to download and install all the recommended antivirus and spyware software , so it does not appear that ALL admin rights have been restricted, just certain ones.

I have event viewer errors every time I boot up that say "The Point to Point Protocol module C:\\WINNT\System32\rastls.dll returned an error while initializing. The network request is not supported.", "The Control Protocol EAP in the Point to POint Protocol module C:\\WINNT\System32\rasppp.dll returned and error while initializing. The network request is not supported.", "Remote Access Connection Manager failed to start because the Point to Point Protocol failed to initialize. The network request is not supported., "The Remote Access Connection Manager service terminated whith the following error: The network request isn ot supported."/ "The Internet Connection Manager service which failed to start because of the following error: The network request is not supported.", "Remote Access Connection Manager failed to start because it could not create buffers. Restart the computer. Access is denied.","The Remote Access Connection Manager service terminated with the following error: Access is denied". I understand that these services are related to network connectivity and this is a standalone machine, but I don't believe I should be receiving these errors (maybe someone can clarify).

A week or so ago he had some ugly malware/spyware/virus infections on his system (including rootkits) that now appear to be gone (based on the scans), but I can't rest until this administrative rights issue is resolved. I've created a regular user account and instructed him on its use so hopefully this does not happen again (well, that, and along with the fortress of antispyware/virus software that is now installed on the machine).

Would another windows repair do the trick as far as getting back admni rights? I ran the windows repair utility at one point when the machine would only boot into safe move to see if it would fix it (it didn't - there was a driver conflict between Kaspersky antivirus and the logitech camera that had be resolved to be able to boot into normal windows), but I DID appear to have admin rights for about a day after the windows repair (before, I assume, a resident virus/malware/rootkit/whatever took it away again).

Sorry for the long post, I just wanted to be as specific as possible...Any ideas, help, please? I realize that by this point in time I could have done a complete system restore (and maybe should have), but my friend didn't want to go that route due to potential loss of data and is about to buy a Macbook and relegate this windows machine to very basic use....

Hello and welcome to Techspot.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

FGLRXUTIL (FGLRXUtil)

Close the services window.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

frxhser.exe
frxhapp.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [Frxmxins] frxmxins

O23 - Service: FGLRXUTIL (FGLRXUtil) - ATI Technologies, Inc. - C:\WINNT\System32\frxhser.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or folders(if there).

C:\WINNT\System32\frxhser.exe
C:\WINNT\system32\frxhapp.exe

Reboot into normal mode and rehide your protected OS files.

Post fresh HJT and Combofix logs. Please let me know if you`re still having problems and what they are.

Regards Howard :wave: :wave:

This thread is for the use of Sillykitty only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Hi Howard,

Thanks so much for your speedy response.

As instructed, I booted into safe mode and logged into a regular user account.

I ran the services.msc and found the FGLRXUTIL (FGLRXUtil) service. It was set to automatic, but the service was in a stopped mode.

I got an access denied error when attempting to change the startup to "disabled", so, I logged into an account with admin rights, and was able to do it there. I logged back into a regular user account and verified that the startup for this service retained the "disabled" selection.

Neither processes frxhser.exe or frxhapp.exe were running in the task manager.

Unfotunately, when closing all windows and running HJT, I got this error: "For some reason your system denied write access to the Hosts file. If any hijacked domains are in this file, HijackThis may NOT be able to fix this. If that happens, you need to edie the file yourself. To do this, click Start, Run and type: notepad C:\\WINNT\System32\Drivers\etc\hosts and press Enter. Find the line(s) HighjackThis reports and delete them. Save the file as 'hosts." (with quotes), and reboot. For Vista: simply, exit HiJackThis, right click on the HijackThis icon, choose "Run as Administrator". I simply clicked OK. I assume this message was due to using a regular user account, since I have not been getting it previously.

I put a check mark into the O4 - HKLM\..\Run: [Frxmxins] frxmxins but the other selection (O23 - Service: FGLRXUTIL (FGLRXUtil) - ATI Technologies, Inc. - C:\WINNT\System32\frxhser.exe) did not appear as a service in HJT any longer (though I see that it was there in my original log). I fixed the O4 - HKLM\..\Run: [Frxmxins] frxmxins using HJT, but was not able to fix the FGLRXUtil (as it did not appear this time as a selection).

I checked for the two files you indicated in the system32 directory. Both are there (frxhapp.exe and frxhser.exe), but neither allow me to delete. Gave me the error "Cannot delete frxhapp: Access is denied. The source file may be in use". Same error when I attemped to delete frxhser.exe. I logged into a user account (still in safe mode) that had admin rights - this time I was able to delete both these files and emptied the recyle bin.

Unfortunately, when I rebooted into normal Windows I still had the error "You do not have sufficient security privileges to install devices on this computer. Please contact your site administrator, or log out and log in again as an administrator and try again".

Also still could not connect to any Microsoft update sites and still getting exact same event viewer errors.

Here are the fresh HJT and Combofix log, along with the AVG Spyware log I had running today.

Anything more I can do??

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT and Combofix log.

Regards Howard

This thread is for the use of Sillykitty only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Hi Howard,

Ok, so I ran downloaded the avenger.txt file and ran it using the avenger program as you described. I've attached the log.

Also attached are fresh HJT and Combo Fix logs.

There's been no change in status of the of the system - admin rights are still funky!

I don't know if it makes a difference, but that FGLRXUtil service, though disabled, still shows up in my services.msc - I was only able to disable it as it does not show up in my HJT scan so I can "fix" it.

Let me know what you think...

Carla

HJT log is clean.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Click start/run and type regedit into the run box and press the enter key. When the window appears maximise it. Click file/export and save a copy of your registry to wherever you want.

Navigate to the following bold entries and delete them.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Frxmxins

Then, in regedit do the following.

Click edit and choose find. Type FGLRXUTIL
into the dialogue box and click the find next button. Regedit will now search your registry for any entries that contain a reference to FGLRXUTIL
and display them in the righthand pane. Right click on any such FGLRXUTIL
entries and choose delete.

Now click edit again and choose find next. Again, delete any entries that reference FGLRXUTIL.

Repeat the above, until no more FGLRXUTIL entries are found.

If none of the above helps, I suggest you try a Windows repair as per this thread HERE.

If that still doesn`t help, then a reformat and reinstall may be the only option left.

Regards Howard

This thread is for the use of Sillykitty only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Hi Howard,

Thanks for all the help you've provided me today.

I deleted "Frxmxins" from the registry as indicated in your message below.

I was able to delete one registry key that referenced FGLRXUTIL, however, there is another key: My Computer\Hkey_Local_Machine\System\Controlset001\Enum\Root\Legacy_FGLRXUTIL that won't delete - I get the error "Cannot delete Legacy_FGLRXUTIL: Error while deleting key." Do you know of any other way to delete this from the registry? If there is another way, I'd like to try but recognize the limitations of what can be done at this point but I'm hoping against hope that maybe if I can get rid of this the admin rights might be rectified. I rebooted into normal Windows after deleting what I could from the registry and still have the troublesome symptoms, however, upon checking my services.msc FGLRXUTIL no longer shows up (though the legacy entry still does).

Otherwise, a window repair option is possible, but I don't think my friend will go for reformatting at least until he gets a new machine - he's willing to limp along as it is, funky admin rights and everything.

You might want to try the RegASSASSIN 1.02 and see if that lets you delete the regkey.

Please let me know the results.

Regards Howard

This thread is for the use of Sillykitty only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

Howard,

I tried. Unfortunately this thing is stubborn. I get to the message that RegASSASSIN could NOT remove the registry key. :-(

I'm going to try it again in safe mode...just in case.

Ok, good luck. I`ll try and see if I can find any more info that might help get rid of this bugger.

Regards Howard

This thread is for the use of Sillykitty only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.