Access denied message.

Hi Howard

Be prepared for



How much does clicking OK really bug you?

Couple of initial questions:

What operating system?

What else is running at the time (ie Nero or Roxio) - simple answer could be that the drive is locked by another programme.

How many "users"

Have you recently re-installed the OS / installed a new motherboard / card controller / DVD CD Floppy drive ?

Ok - that's slightly more than a "couple" but...

Steve

Clicking OK is not a problem I just thought it might be the symptom of something worse.

OS is XP.
Error message appears by just inserting a disc with nothing else running.
No new "bits" installed.
PC is run under my user account.

quote:

Originally posted by BigH47:
Clicking OK is not a problem I just thought it might be the symptom of something worse.

OS is XP.
Error message appears by just inserting a disc with nothing else running.
No new "bits" installed.
PC is run under my user account.

Hi Howard

You are right to be concerned as it could be something worse. Let's get the bad bits out of the way first!

It could be a dumb virus that is trying to infect media by writing to it.

When did it start doing this? I presume the computer has been working for n months/years without a problem?

Does you have active up-to-date virus protection?

Are the Microsoft updates up-to-date?

Do you have anti-spyware software?

Have you actively scanned for viruses and spyware?

Also...If you turn off auto run do you still get the same message? [click my computer, right click on the drive - autoplay tab}

Steve

To be honest I can't remember when this started which is why I can't link it to a download or programme.
Changing to auto run or self select makes no difference.

I run AVG virus guard (autoupdates).
Zone alarm firewall
Norton Spyware scan as part of BT/Yahoo(autoupdates).
Spyware Guard and Spyware Blaster (manual update).
I also use PC Pitstop Optimise on a regular basis.
MS update autoruns as well.

The trouble I find with other virus scans is each company finds a different worm or trojan to entice you buy their product. Programmes I use have been recommended by persons I know/respect.

BTW PC runs pretty slow too.


MEDION INTEL P4 2400 512MB XP home SP3 build 2600. DVD/ROM,DVD-RW, 80gigHD(3 drives) 150gig additional HD.

Howard

quote:

Originally posted by BigH47:

The trouble I find with other virus scans is each company finds a different worm or trojan to entice you buy their product. Programmes I use have been recommended by persons I know/respect.

Agree entirely but...

quote:

BTW PC runs pretty slow too.

Ohh! Time to scratch head and consult with a friend. PC might run slow because it is bunged up with this or because of something else.

quote:

MEDION INTEL P4 2400 512MB XP home SP3 build 2600. DVD/ROM,DVD-RW, 80gigHD(3 drives) 150gig additional HD.

Howard[/QUOTE]

Jezz Howard how many HD's does one person need (I can't talk I have a Terabyte over 4 drives ) I guess these drives have a lot on them? Doesn't explain the initial problem but might suggest a reason for a slow running PC.

Do one test for me if you would - see if you can access the drive via a new explorer session with the error message still up.

I'll be back as Arnie said. Told you it would be like The Spanish Inquisition! It's always the little issues that take some tracking down!

Steve

No it's only 2 HDs the original system configured drive is 80 gig partitioned into 3 drives C: main(boot)37GB D: Backup 37GB and E:Recover 4GB. The other HD 150GB is an add on for pictures videos etc to try and keep the main drive less cluttered.

H

I can open the drive and double click to play the tracks whilst the error message is up. Is that what you meant?

I've not forgotten you Howard. I waiting for another Steve to get back to me on a few things that might prove relevant.

So you can access the disk even while the error message is on the screen? Interesting.

I guess you have done all the virus / spyware scans? While we are thinking it might pay to download Windows Defender and give it a run go here and Ad-Aware here. They might just pick up something that your other software is missing.

It might be interesting to see what exactly is loading itself up as Windows boots and also what programmes are running when the problem occurs but I'll see if SteveB has other thoughts before we delve into that area!

Steve

OK Steve I appreciate your help. I do have and run Ad-Aware I just forgot to list it.I'll have a look at Windows Defender over the W/E.

Howard

Hi Howard,
OK let's get this one sorted. I am going to ask you to download a couple of programmes and install them. You should of course convince yourself that these programmes will not do any harm but they will prove useful for a short while after when you can get rid of them.

What we are looking at is two (possibly) un-related issues.

DVD/CD access denied
Slow machine

To know exactly what is going on with the DVD/CD you will need to go here http://www.snapfiles.com/get/filemon.html and download FileMon. This is a small application that monitors what is actually going on on PC's in real time. At first glance it is a bit hairy but do not worry. Once installed run it - and be amazed at what your PC is doing while you are having a scratch - leave it open and running and stuff a CD/DVD in the drive. You should see on FileMon exactly what happens at the point the error message comes up. That's the bit of info we need. Then click OK on the error message and see what happens there. You can save the filemon log - click on File - Save As and give it a hopefully useful name. We might need it again. What this should do is show us what programme is buggering about with the drive.

You could also look at the error log reports that XP helpfully keeps. To do this you will need to go to control panel - admin tools - event viewer. Have a look in System, see if you have any warnings. Then stuff a DVD in - see what error is logged.

Finally the slow machine and (possibly) disk access issue. I would like you to install the horribly named "Hijackthis" from here http://www.spywareinfo.com/~merijn/programs.php (pick a download site once you have read what the prog does). I do not think you have the kind of problems hijackthis deals with but it does have a mighty useful logfile in it. Download the prog and unzip it to a new folder. Run the programme and run a scan - should take about 30 seconds - ignore the scan completely! What we are after is the log file - this shows what progs/services are running and should again give more of an idea of what is going on in your PC. The log file contains no personnal info but please check it yourself.

OK once all that is done we should have two log files and details on the event viewer. I'm going to need that information. I suggest that you e-mail them to me rather than post the lot here. I'll put the e-mail address into my profile for you. Can you flag that you have sent the e-mail here and use the subject "Access Denied Message" otherwise you might be spammed away!

Steve

Howard
After you have done all of the above you might want to do this. It might just throw something up.
Steve

I bet any money that indeed it will throw something up, and then you call the help desk and then you purchase the software.

Jesus.

quote:

Access is denied

Ask Steve Toy

I can't even see the "scan now" button to check.

quote:

Originally posted by BigH47:
I can't even see the "scan now" button to check.

? on what?

quote:

Originally posted by garyi:
I bet any money that indeed it will throw something up, and then you call the help desk and then you purchase the software.

Jesus.

It might indeed - but you don't buy it - you go back to AVG and have a "word". Ignorance is bliss though

STEVE
I could not see the scan now button on the symantec W/S using Mozilla but it worked on IE.After it scanned for about 2 hours I ended it with 1 file C:\WINDOWS\system32\fk.dll infected with SpyDestroy.
I am out tonight our 25th Wedding Anniversary.I will try a Norton scan again soon.
Did you get my E-mail OK?

Regards

Howard

quote:

Originally posted by BigH47:
STEVE
I could not see the scan now button on the symantec W/S using Mozilla but it worked on IE.After it scanned for about 2 hours I ended it with 1 file C:\WINDOWS\system32\fk.dll infected with SpyDestroy.
I am out tonight our 25th Wedding Anniversary.I will try a Norton scan again soon.
Did you get my E-mail OK?

Regards

Howard

Hi Howard - no e-mail yet. I'll post again tomorrow am if I've not got it. It took Diccus about 5 goes to spell my name right so you might want to check the spelling !

Out of interest have you got AlertSpy on your system (go to add/remove progs and see)?

" fk.dll

Component Name: fk.dll

Description of fk.dll
This is a component of AlertSpy. AlertSpy is a rogue anti-spyware application that has a low detection rate, and has a high false positive rate that may goad the user into purchasing the application. It comes from the makers of Adware Deluxe and Adware Safety, other rogue security applications.

Recommendation for fk.dll
It is recommended that your remove this software from your computer to secure your system from suspected applications that might threaten system security."

Don't do anything just yet - we can do everything via e-mail.
Regards
Steve

quote:

Originally posted by BigH47:
STEVE
I could not see the scan now button on the symantec W/S using Mozilla but it worked on IE.After it scanned for about 2 hours I ended it with 1 file C:\WINDOWS\system32\fk.dll infected with SpyDestroy.
I am out tonight our 25th Wedding Anniversary.I will try a Norton scan again soon.
Did you get my E-mail OK?

Regards

Howard

25th! Congratulations - we are only at 22 and counting (I was snatched from the cradle ) .

I've had a quick look into fk.dll - no need to run Norton again, I think it might have picked the thing up that is slowing your PC down - which is a start! Just want to check you loaded hijackthis from the link above not by typing "hijack-this.net " which is actually a hijacked site itself:

"the domain Hijack-this.net has been registered by XoftSpy — a misleading capitalization and exploitation, by a company with a questionable history, of the good name of Merijn Bellekom’s respected product. This last week some things got better about the situation, while other things got worse!

First, Paretologic (the owner of XoftSpy) took corrective action last week. The Hijack-this.net page no longer refers to XoftSpy.

Second, the hijacking reportedly was by one of XoftSpy’s sales affiliates, not XoftSpy itself. The company has terminated that affiliate and the initial expectation was that the site would be taken down altogether. According to standard Internet whois information, the domain name Hijack-this.net is owned by an unnamed party with address PO Box 927010, San Diego, CA 92192-7010, and phone number (858) 731-1701. (Paretologic — XoftSpy — is located in Victoria, BC.) Dial that number and you get the offices of the domain registrar, so the owner’s identity is masked from the public.

Third, despite this small victory, the main problem continues. In fact, it got worse. The owners of Hijack-this.net just switched to advertising an even worse product! XoftSpy has redeemed itself in recent months, in the respected judgment of Eric L. Howes — and their handling of this present issue suggests that maybe they really have turned over a new leaf and need to be given a second chance. But Hijack-this.net now is pushing AlertSpy (sigh!) which you can find actively listed on Eric’s Rogue/Suspect Anti-Spyware Products & Web Sites list. Nor is this the first time AlertSpy has co-opted a respected legitimate name in the anti-parasite wars, since they have also pushed their wares on domains named spy-bot.com, spy-bot.net, spy-bot.org, and spybotsd.com, leveraging the good name of the respected SpyBot Search & Destroy product.

What foul behavior do we hold against AlertSpy? As document by Eric L. Howes, AlertSpy produces false positive results used to goad worried computer users to buy it unnecessarily. Also, it uses an inadequate reference database, so it just isn’t any good — reinforcing the sense that the best products in this area are the free ones. AlertSpy also markets itself under the names AdwareDeluxe, AdwarePatrol, AdwareRemover, AdwareSafety, AdwareTools, Doctor Adware, Doctor Adware Pro, PestBot, PestProtector, SpyDestroy Pro, SpywareRemoval, and SpywareRemover. Avoid these! Avoid them all!"

Ho hum!
Steve

Hi Howard
Got the e-mail! Enjoy tonight.
Steve

Steve I already had HJT from a previous helper so I think the link is OK.

quote:

Originally posted by BigH47:
Steve I already had HJT from a previous helper so I think the link is OK.

Well we got the right logfile so everything kust be OK!
Steve

@ SteveGa,

There seems to be lots of various adaware programs you've typed into one of your replies. Now my question is...

I've got on my machine Ad-Aware SE Personal by Lavasoft.

Is this software safe?

Thanks,

Beano

quote:

Originally posted by Beano:
@ SteveGa,

There seems to be lots of various adaware programs you've typed into one of your replies. Now my question is...

I've got on my machine Ad-Aware SE Personal by Lavasoft.

Is this software safe?

Thanks,

Beano

Yep - good piece of software. The problem is that basically a lot of people cottoned onto the fact that you can con most of the people most of the time with computers. A bit of media hysteria and you might just have a business. Then you need software that scares people - so design one that gives lots of false positives, now all you need to do is get people worried enough to download your software:

WARNING - you might have spyware on your computer - click here to check

usually will do the trick. People download the software (or it pretends to do an online scan) it gives false positives and then tells you to buy the software to fix the problems. You buy the software, it fixes the "problem". Most often these are malware but just occasionally they will put something nasty on your system. And then the fun starts.

There are several sites that list known malware such as this http://spywarewarrior.com/rogue_anti-spyware.htm, but I would always suggest that anyone who gets a pop-up like the one above just clicks on the X (not cancel or OK) and ignores it. If you are really worried a good anti-virus software, windows defender and ad-aware will find most of the problems. Make sure you have a very good firewall - Howard has Zone Alarm which is free and excellent - and make sure you read what it tells you if a warning pops-up. If in doubt click no (don't click always take this action) and see - if your e-mails don't go you probably chose the wrong option so next time try yes. It's all easy if you take care.

End of lecture. Ad-aware is a fine upstanding piece of software (and note it is free!).

Steve

I really don't think that all unusual computer beahviour is up to the spyware or something like this. At your place I will turn off auto start for your optical device and leave it like that couple of days/restarts and after that start it again.

Regarding spyware and other things, the best software is the one which you can put under your PC balls, which means that you need to start pc in safe mode to prevent all that spyware/malware things to start up and occupied the locations for what they are made.

Here is the little program which I was found to work really perfect and was totally remove all that anoying bubble comercials from tray menu and popups even when the popup blocker is turned on. My little son plays online games and someone kid just don't know that is not everything good to click and as a product we have had a christmass tree rather than a desktop, if you know what I mean.

Here it is http://siri.geekstogo.com/SmitfraudFix.php

Oz

quote:

Originally posted by Ozren Herold:
I really don't think that all unusual computer beahviour is up to the spyware or something like this. At your place I will turn off auto start for your optical device and leave it like that couple of days/restarts and after that start it again.

Regarding spyware and other things, the best software is the one which you can put under your PC balls, which means that you need to start pc in safe mode to prevent all that spyware/malware things to start up and occupied the locations for what they are made.

Here is the little program which I was found to work really perfect and was totally remove all that anoying bubble comercials from tray menu and popups even when the popup blocker is turned on. My little son plays online games and someone kid just don't know that is not everything good to click and as a product we have had a christmass tree rather than a desktop, if you know what I mean.

Here it is http://siri.geekstogo.com/SmitfraudFix.php

Oz

Good call re safe mode Oz. That was the next step but I now think the behaviour is due to an incomplete uninstall.
Steve