Locked out of most Control Panel Items

A friend of mine called me a few days ago to look at his computer. His desktop icons and taskbar were all missing. Upon hitting ctrl+alt+del and looking at his running process, I noticed that explorer.exe was missing. I then opened a command prompt, went to the windows directory and entered explorer.exe to get explorerer to run. I was greeted with a message saying "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item". I then entered a cacls command at the prompt (cacls explorer.exe /p david:f)and then was able get explorer running again. However, right clicking on the desktop makes the destop/taskbar disappear. Trying to open the control panel makes it disappear also. I then installed Spybot from a thumbdrive. Spybot installed but would not run past the initial loading in process. As soon as a scan started, it would crash to the desktop. I then installed Malwarebytes' Anti-Malware. It started to scan the first time but crashed to the desktop after a few seconds. Any further attempt to run it result in the "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item" message. Issuing a cacls command for the .exe of this program does not seem to help. My friends kids attempted to fix this also and I see combo fix on the desktop but I do not see an installation of it on the C: drive. I installed Hijackthis to get a log file. It starts the scan but crashes to the desktop after getting almost complete. After running it once, I cannot access it again without getting a "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item" message. Issuing a cacls command from a cmd prompt does allow me to use it again however. I installed gmer to get a log file to post. Again, much like Hijackthis, it starts the scan and runs for about ten minutes then crashes to the desktop. It will not run again without generating a "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item" message. Issuing a cacls command from a cmd prompt does allow it to run again but it still crashes to the desktop. Here is a list of process that are running on the machine at bootup: mscipevc.exe wmiapise.exe wdfmgr.exe svchost.exe (7 times) spoolsv.exe lsass.exe winlogon.exe csrss.exe TeaTimer.exe taskmgr.exe chcp.com explorer.exe System System Idle Process When I first got the computer to my house to attempt to fix it, I tried to boot into safe mode. Safe mode would not work. I had to modify the computers registry to get safe mode to work again. However, running any of the above programs in safe mode still produces the same results. If I boot off of a Windows XP cd and start the repair console, I have two options to work in: One is called MiniNT, the other is Windows XP Home. The computer runs Windows XP Home with SP2 installed. Computer details: Gateway 507 GR Pentium 4 w/ HT @ 3 Ghz 800 Mhz FS, 512 MB Ram I posted this information on the Spybot forums and was able to get Spybot, Combofix and Malwarebytes' to run and found several infections that were removed. All seemed normal until I went to the the control panel to uninstall Viewpoint. When I click on the Add/Remove Programs Icon, I get "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item". This message appears for most items in the control panel, including the User icon. Also, the computer has three accounts including the admin account. One account has a blank desktop and pressing ctrl-alt-del generates a message saying that the administrator has disallowed access to the task manager. I can not reenable explorer on this account. Will post a hijackthis log in a few minutes. Thanks for any help! I rebooted the computer to safe mode, selected the admin account to login with and still get this error message. Have searched the web for fixes to this but with no luck.

Moving to Infections Removal Come on back to Windows Forum if you have additional issues after completing work with your Infections Removal Team specialist.

Hello Doug, Cleaned this poster up over at Safer, he still has some windows issues and asked him to post here. As far as I can see his computer is clean. Thank Doug, Ken

Hello cmstueber,

Your friend is fortunate to have a friend like you to provide the assistance you already have given.
You are fortunate to have been assisted by one of the best - Ken545

I'll attempt to assist you from this point forward.
I will likely get additional assistance from other Tech with knowledge in this area, so please know that others may be posting instructions here into this Thread.

Let's have a look at Services:

Start - Run - (type)services.msc - enter

Hopefully the machine's services panel will display.

Now scroll to Remote Procedure Call (RPC)
In a fully functional machine, the Status settings would be "Started" and Service Type would be "Automatic"
You may or may not be able to Start and adjust the StartUp type to Started and Automatic.
If it's grayed out, we'll have to use Recovery Console to gain access.
But give it a shot.

Please report back with the information about Remote Procedure Call (RPC).

If Remote Procedure Call (RPC) is Started and Automatic, then scroll up to:
Cryptographic Services

Cryptographic Services should be Status - "Started" and Startup Type - Manual
If not, double-click on Cryptographic Services to Start and adjust the Startup Type
Please report back with information about Cryptographic Services

This may take several rounds of correspondence. Please be patient.

Ken545 rocked! He replied quickly and the information was more then expected and it worked! I was able to get services.msc to display. Remote Procedure Call was started and it is set to automatic for startup. There was nothing called Cryptographic Services. There is something called CryptSvc which was started and is set to automatic startup. I did not change it in case Cryptographic Services is not the same as CryptSvc. Thanks for all the help!

Hello cmstueber,

CryptSvc is the same as Cryptographic Services.

Finding that both these services have status of "Started", is the correct status, but stops me in my tracks for a moment as I had hoped for an easy fix of just starting a stopped service. Foolish me for hoping.

Let's have a look at the rest of your Services

Please consider running this simple utility that will help you get control of programs and processes that you wish to have running active, or not.

CodeStuff-Starters
http://www.snapfiles.com/get/Starter.html

Download and install, agreeing to the licensing terms and allow to install with all of the default settings as preselected in the installation wizard.

When you finally allow CodeStuff-Starters to run
It will preselect StartUps Tab - – (Change the tab selection to Services)

• Click on File
• Select - save as Plain Text (name the report file - Services Sept14.txt)

In your next reply, post the file as an attached file (use browse and upload buttons – at the bottom-right corner of your topic posting window where you are typing your next reply)

Please do not make any changes with Code-Stuff Starters, until after you post the requested information above and receive recommendations from a helper here.

Best Regards

Installed and ran Starter. Here is the file: 📎Services_Sept14.txt Thanks!

Sorry cmstueber,

Could you please repeat CodeStuff Starters - Services(tab) - Select All Services
and post it as .html file

Also please let me know if you have the XP installation CD for this machine.
And if not do you have "any" XP Home install CD.

We may need to expand and export the i386 folder, for our next step.

I looked at that text file and thought, man, glad I don't have to try and read that mess! Here is the html: 📎Services_Sept14.html I do not have the original XP Home Disc that came with the machine. My friend and I did search for it when I picked up the machine, but we could not find it. I do not have any XP home discs. I do have an XP Pro disc.

cmstueber, Doug has had computer problems himself due to power outages and will back shortly

The stinks. No worries. Hope he gets it fixed soon and then we can proceed. I've been trying to find an XP home install disc since that may help. But all my friends (except one apparently) only have XP Pro or Vista.

Hi, while waiting for Doug to get his hardware back online, I took a look at your services list. The only thing I noticed that was wrong was all the Avast services were stopped.

avast! Antivirus avast! Antivirus Stopped Disabled Own Process (Interactive) "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
avast! iAVS4 Control Service aswUpdSv Stopped Disabled Own Process (Interactive) "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
avast! Mail Scanner avast! Mail Scanner Stopped Disabled Own Process (Interactive) "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
avast! Web Scanner avast! Web Scanner Stopped Disabled Own Process (Interactive)

If you still want to use Avast, try setting them to Enabled and Automatic then reboot and see what happens.

Have you tried running Gmer and MBAM from Safe Mode?

Since you seem to be getting a lot of Access Denied problems, download and run Dial-A-Fix. Click the double Green check mark button at the bottom then click on Go. Let it complete and then try some things and see if there is any improvement.

Sorry for the delay getting back on this. I installed and ran Dial-A-Fix. All the options work fine except the following (I ran each box one at a time to be able to find issues): Adjust date and time: Generates the following error: "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item" Control Panel Applets: Generates the following error: "Access violation at address 77C0155D in module version.dll. Read of address 00000004" I can run GMER and MBAM now. Would you like a GMER log posted? Thanks again for all the help.

It's fixed! I opened the tools area of Dial-A-Fix and ran the Reset permissions tool. Everything works great now. I can not thank you guys enough.