Unable to run any virus scans or browse with IE

[Merewen]

Hi.  Any help would be appreciated.  I'm using a 5 year old EMachines with Windows XP.  One morning I couldn't open IE and this was the message I got  "Windows cannot access the specific device, path or file. You may not have the appropriate permissions to access the item."  Then I started getting little bubbles saying my computer was infected and a desktop warning.  I tried to run McAfee and that was a no go.  I downloaded Spybot using Mozilla, but when I tried to install and use I got the same message that I got for IE.  I was able to download and scan once with Avira and AVG, but only once.  After the first scan they no longer worked.  I'm at my wits end and running out of options. Help??

[Karnac]

You'll have to go here....

http://www.computerhope.com/forum/index.php/topic,46313.0.html

If you've lost your connection, download the programs to a USB stick on a good PC and transfer them to your PC.
If you have difficulty, you may have to run them in safe mode, tap F8 at start, .
If you have difficulty, you may have to rename the programs when you save them.
If you get stuck on a step, proceed to the next .

Post the logs for step 3,4 and 6.

[Merewen]

Karnac, hi.  I did that already.  That's how I got Avira and AVG to run that once.  Did the same thing with IE, McAfee, Spybot Search and Destroy, Malware, and SuperAnti..... they two didn't work at all.  All of the on line scanners I've been directed to only work with IE so they're useless to me.

I just tried to reinstall SuperAnti again and this is the error I get "Error 1321.Windows Installer has insufficient privileges to modify this file: C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"  This is the type of mess I'm dealing with.

[Karnac]

Can you run HijackThis and create a log?
Then you may be able to run the HJT process tool and clear some problems which may enable the other programs to run.

[Merewen]

Ok, I downloaded HJT and clicked scan.  It did and I saw a log, but the box just went away before I could copy anything and when I clicked on the icon...  I got the you may not have appropriate permissions.... error.

[Karnac]

You'll have to wait for a specialist to guide you further......Did you try run the program in safe mode?

[Merewen]

Yeah I did try it in SafeMode and no luck.  How long do I have to wait for a Specialist?

[Karnac]

He's been on holidays.....I can't say when.

[Merewen]

I ran an Avira scan and I was unable to get a full report, but I did get this.....

The file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IJKUME6P\w[3].bin'
contained a virus or unwanted program 'TR/Dldr.DlfBfkg.XD' [trojan]
Action(s) taken:
An error has occurred and the file was not deleted. ErrorID: 26004.
The source file could not be found.
Attempting to perform action using the ARK library.
An ARK library instance is already running.
The file is scheduled for deleting after reboot.

The file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IJKUME6P\w[2].bin'
contained a virus or unwanted program 'TR/Dldr.DlfBfkg.XD' [trojan]
Action(s) taken:
An error has occurred and the file was not deleted. ErrorID: 26004.
The source file could not be found.
Attempting to perform action using the ARK library.
An exception has been identified!
The file is scheduled for deleting after reboot.


The file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\G8IJT34W\w[2].bin'
contained a virus or unwanted program 'TR/Dldr.DlfBfkg.XD' [trojan]
Action(s) taken:
An error has occurred and the file was not deleted. ErrorID: 26004.
The source file could not be found.
Attempting to perform action using the ARK library.
The rootkit search engine could not be found.
The file is scheduled for deleting after reboot.


The file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\ZIJBLDWX\w[1].bin'
contained a virus or unwanted program 'TR/Dldr.DlfBfkg.XD' [trojan]
Action(s) taken:
An error has occurred and the file was not deleted. ErrorID: 26004.
The source file could not be found.
Attempting to perform action using the ARK library.
An exception has been identified!
The file is scheduled for deleting after reboot.


The file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IJKUME6P\w[3].bin'
contained a virus or unwanted program 'TR/Dldr.DlfBfkg.XD' [trojan]
Action(s) taken:
An error has occurred and the file was not deleted. ErrorID: 26004.
The source file could not be found.
Attempting to perform action using the ARK library.
An ARK library instance is already running.
The file is scheduled for deleting after reboot.



The file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IJKUME6P\w[2].bin'
contained a virus or unwanted program 'TR/Dldr.DlfBfkg.XD' [trojan]
Action(s) taken:
An error has occurred and the file was not deleted. ErrorID: 26004.
The source file could not be found.
Attempting to perform action using the ARK library.
An exception has been identified!
The file is scheduled for deleting after reboot.


The file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\G8IJT34W\w[2].bin'
contained a virus or unwanted program 'TR/Dldr.DlfBfkg.XD' [trojan]
Action(s) taken:
An error has occurred and the file was not deleted. ErrorID: 26004.
The source file could not be found.
Attempting to perform action using the ARK library.
The rootkit search engine could not be found.
The file is scheduled for deleting after reboot.


The file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\G8IJT34W\w[2].bin'
contained a virus or unwanted program 'TR/Dldr.DlfBfkg.XD' [trojan]
Action(s) taken:
The file was moved to '4ab82684.qua'!




The file 'C:\WINDOWS\system32\sofatnet.exe'
contained a virus or unwanted program 'TR/sopidkc.96256.B' [trojan]
Action(s) taken:


The file 'C:\WINDOWS\system32\sofatnet.exe'
contained a virus or unwanted program 'TR/sopidkc.96256.B' [trojan]
Action(s) taken:


The file 'C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IJKUME6P\w1[1].bin'
contained a virus or unwanted program 'BDS/Refpron.P.25' [backdoor]
Action(s) taken:
The file was moved to '4adcf74e.qua'!


The file 'C:\lype.exe'
contained a virus or unwanted program 'TR/Hiloti.45568A.4' [trojan]
Action(s) taken:
The file was moved to '4af1f795.qua'!


The file 'C:\Documents and Settings\Administrator\Local Settings\Temp\msupd_2.exe'
contained a virus or unwanted program 'TR/Dldr.FraudLo.sxm' [trojan]
Action(s) taken:
The file was moved to '4af6f790.qua'!