cannot delete access denied...maybe a virus?

here is the next set:

SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

No Hidden Processes found

******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
Service Name: ---
Module Base: B436F000
Module End: B4387000
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
Service Name: ---
Module Base: B85D2000
Module End: B85D4000
Hidden: Yes

Module Name: \??\C:\DOCUME~1\Home\LOCALS~1\Temp\aswMBR.sys
Service Name: aswMBR
Module Base: B2A78000
Module End: B2A84000
Hidden: Yes

******************************************************************************************
******************************************************************************************
SSDT:
Function Name: ZwAddBootEntry
Address: B4467DC4
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwAllocateVirtualMemory
Address: B44F4904
Driver Base: B44E9000
Driver End: B453A000
Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS

Function Name: ZwAssignProcessToJobObject
Address: B4468832
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwClose
Address: B4494ABD
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwCreateEvent
Address: B446D25C
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwCreateEventPair
Address: B446D2A8
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwCreateIoCompletion
Address: B446D39A
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwCreateKey
Address: B4494471
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwCreateMutant
Address: B446D1CA
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwCreateSection
Address: B446D2EC
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwCreateSemaphore
Address: B446D212
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwCreateTimer
Address: B446D354
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwDeleteBootEntry
Address: B4467E10
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwDeleteKey
Address: B4495183
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwDeleteValueKey
Address: B4495439
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwDuplicateObject
Address: B446A920
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwEnumerateKey
Address: B4494FEE
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwEnumerateValueKey
Address: B4494E59
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwFreeVirtualMemory
Address: B44F49DE
Driver Base: B44E9000
Driver End: B453A000
Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS

Function Name: ZwLoadDriver
Address: B4467AA2
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwModifyBootEntry
Address: B4467E5C
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwNotifyChangeKey
Address: B446AC94
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwNotifyChangeMultipleKeys
Address: B4468AD6
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenEvent
Address: B446D286
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenEventPair
Address: B446D2CA
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenIoCompletion
Address: B446D3BE
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenKey
Address: B44947CD
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenMutant
Address: B446D1F0
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenProcess
Address: B446A490
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenSection
Address: B446D326
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenSemaphore
Address: B446D23A
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenThread
Address: B446A6C4
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwOpenTimer
Address: B446D378
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwProtectVirtualMemory
Address: B44F4B4A
Driver Base: B44E9000
Driver End: B453A000
Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS

Function Name: ZwQueryKey
Address: B4494CD4
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwQueryObject
Address: B44689A2
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwQueryValueKey
Address: B4494B26
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwRenameKey
Address: B44FE858
Driver Base: B44E9000
Driver End: B453A000
Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS

Function Name: ZwRestoreKey
Address: B4493AE4
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwSetBootEntryOrder
Address: B4467EA8
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwSetBootOptions
Address: B4467EF4
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwSetSystemInformation
Address: B4467B12
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwSetSystemPowerState
Address: B4467CB6
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwSetValueKey
Address: B449528A
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwShutdownSystem
Address: B4467C5E
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwSystemDebugControl
Address: B4467D26
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwTerminateProcess
Address: B44F4C0A
Driver Base: B44E9000
Driver End: B453A000
Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS

Function Name: ZwVdmControl
Address: B4467F40
Driver Base: B444F000
Driver End: B44E9000
Driver Name: \SystemRoot\System32\Drivers\aswSnx.SYS

Function Name: ZwWriteVirtualMemory
Address: B44F4A8A
Driver Base: B44E9000
Driver End: B453A000
Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS

******************************************************************************************
******************************************************************************************
Kernel Hooks:
Hooked Function: ZwCreateProcessEx
At Address: 805D117A
Jump To: B450AA76
Module Name: C:\WINDOWS\System32\Drivers\aswSP.SYS

Hooked Function: ZwClose
At Address: 805BC556
Jump To: B450796C
Module Name: C:\WINDOWS\System32\Drivers\aswSP.SYS

Hooked Function: PsCreateSystemThread
At Address: 805D117A
Jump To: B450AA76
Module Name: C:\WINDOWS\System32\Drivers\aswSP.SYS

Hooked Function: ObMakeTemporaryObject
At Address: 805BC556
Jump To: B450796C
Module Name: C:\WINDOWS\System32\Drivers\aswSP.SYS

Hooked Function: ObInsertObject
At Address: 805C2FDA
Jump To: B450942C
Module Name: C:\WINDOWS\System32\Drivers\aswSP.SYS

Hooked Function: ObCloseHandle
At Address: 805BC556
Jump To: B450796C
Module Name: C:\WINDOWS\System32\Drivers\aswSP.SYS

******************************************************************************************
******************************************************************************************
Hidden files/folders:
Object: C:\Qoobox\BackEnv\AppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cache.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cookies.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Desktop.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Favorites.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\History.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Music.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\NetHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Personal.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Pictures.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Programs.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Recent.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SendTo.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SetPath.bat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartUp.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SysPath.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Templates.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\VikPev00
Status: Access denied

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

Hi Superdave,
Eset scan ran, I also clicked the archive option to scan as well....The scan came up clean.

I attempted to relocated a skype folder in a folder on the desktop and it still won't let me.

Thanks for putting in all this work...I sure we can resolve this issue. Again I have not yet fully downloaded the 'unlocker' and run it. Does the unlocker unlock any locked file, folder, and let me rename them and allow me to delete them or do I have to pick and run the unlocker. The link you provided about 'unlocker' would not open.

brick

Thanks for putting in all this work...I sure we can resolve this issue. Again I have not yet fully downloaded the 'unlocker' and run it. Does the unlocker unlock any locked file, folder, and let me rename them and allow me to delete them or do I have to pick and run the unlocker. The link you provided about 'unlocker' would not open.

Sorry about that link. After UnLocker is installed you just need to right-click on the file or folder and click on Unlocker. Right-click again and select delete.

Superdave, do you think I should try the unlocker? I was also wondering, given the fact that every virus scan we have ran thus far has turned up nothing, that could this be the start of a hard drive failure rather than a virus?
Finally, if I download the unlocker and it doesn't work, what direction do you think I should go?

thanks again!

brick

You mentioned that you tried this but did you do it this way?

1. Turn off Simple File Sharing:
1. Click Start, and then click My Computer.
2. On the Tools menu, click Folder Options, and then click the View tab.
3. Under Advanced Settings, click to clear the Use simple file sharing (Recommended) check box, and then click OK.
2. Right-click the folder that you want to take ownership of, and then click Properties.
3. Click the Security tab, and then click OK on the Security message, if one appears.
4. Click Advanced, and then click the Owner tab.
5. In the Name list, click your user name, Administrator if you are logged in as Administrator, or click the Administrators group.

If you want to take ownership of the contents of that folder, click to select the Replace owner on subcontainers and objects check box.
6. Click OK.

When I get to the security tab I have three items listed...
1. brick's bazinga( HOME 1Do150E67D\Admininstrators)
2. System with nothing else next to it
3. Administrators( HOME 1DO150E67D\Admininstrators)

When I click the advanced tab...under permission is the same three but under the Owner tab on the 1 and 2 are listed...no system.

all three above are listed with Full control

the "inherit from parents entries is check marked.

Effective permissions tab has nothing on the group or user name

still won't let me delete, move or rename.

brick

something which maybe interesting. I went into effective permissions and typed in administrator and it came up with full access to all items listed. I did the same with system, full access....then with Brick's bazinga...it said there was no domain of that name. Which is my account. I actually only have two accounts listed: Brick's bazinga and guest. For some reason I no longer have the Administrators account listed at start up. I tried to make a new account as Administrators and it said one was already made up but I don't see it anywhere, except when in safe mode then the two are listed, brick's and admin. Did I some how delete the administrators account and thus affected the security? How do I find the administrators account that is supposedly still in existence but not at start up. (except in safe mode)

thank you

brick

BUMP

brick

I'm sorry but I can't help very much with those accounts. We should do some cleanup and you could perhaps start a new thread in the software forum to solve that issue.

Download this program and run it Uninstall ComboFix .It will remove ComboFix for you

To turn off Windows XP System Restore:

NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.

1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:

1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply, and then click OK.
****************************************************
Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
***********************************************
Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.

Ok, thanks Superdave! I have come to the conclusion, based on our work here that it might be a software issue or perhaps a hard drive failure situation. i have already looked into the possibility of having to replace the hard drive. I did finish the download of the 'unlocker' and it seems to work, unlocking my files, renaming them etc. I still have this message when I go to download anything it says it fails, but i double click and it works.
thank you for all your attention...

brick

If you want to check your harddrive, here's a good one to use. Just download the one for your make of harddrive, burn it to a Cd with an ISO burner and boot your computer with it.

Run hard drive diagnostics: tacktech.com
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: imgburn to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.
For Toshiba hard drives, see here:

Note : If you do not know how to set your computer to boot from CD follow the steps [url=http://www.hiren.info/pages/bios-boot-cdrom]here[/url

Thanks Superdave! I will grab my son to help me with that....

do you think I should try to post this and what we have done on the software forum? or hardware one? Do you think someone there might have a solution or at least a direction?

Also, I forgot to mention...I did finally download and run the 'unlocker'. It does indeed unlock the file/folders and lets me rename a folder, sometimes I have to wait to I reboot the system. So it did the job. but frustrating to have my computer not do what it use to do...LOL!

brick

do you think I should try to post this and what we have done on the software forum? or hardware one? Do you think someone there might have a solution or at least a direction?

Also, I forgot to mention...I did finally download and run the 'unlocker'. It does indeed unlock the file/folders and lets me rename a folder, sometimes I have to wait to I reboot the system. So it did the job. but frustrating to have my computer not do what it use to do...LOL!

Once you run the harddrive diagnostic you will know whether or not the drive is good. As for the other; malware sometimes does so much damage that it's easier to re-install the OS than to try and fix it especially from such a long distance.