Error: Access is Denied (5) (HELP!)

[polonus]

Hi Viewpoint,

Crawler manual removal:
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\CustomizeSearch=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar=[site address]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SearchAssistant=[site address]
HKEY_CLASSES_ROOT\CMail.CMailClass
HKEY_CLASSES_ROOT\ctbcommon.Buttons
HKEY_CLASSES_ROOT\ctbr.R404Pro
HKEY_CLASSES_ROOT\CToolbar.TB4Client
HKEY_CLASSES_ROOT\CToolbar.TB4Script
HKEY_CLASSES_ROOT\CToolbar.TB4Server
HKEY_CLASSES_ROOT\Weather4.WeatherObj
HKEY_CLASSES_ROOT\CLSID\{183643C8-EE67-4574-9A38-927852E34163}
HKEY_CLASSES_ROOT\CLSID\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
HKEY_CLASSES_ROOT\CLSID\{1DDA201E-5B42-4352-933E-21A92B297E3B}
HKEY_CLASSES_ROOT\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
HKEY_CLASSES_ROOT\CLSID\{4D25FB7A-8902-4291-960E-9ADA051CFBBF}
HKEY_CLASSES_ROOT\CLSID\{54ECA872-DB2A-4C6B-BBB2-F3777C6786CC}
HKEY_CLASSES_ROOT\CLSID\{786C6F15-0D85-46FB-9A31-0AA0E93C88FF}
HKEY_CLASSES_ROOT\CLSID\{8736C681-37A0-40C6-A0F0-4C083409151C}
HKEY_CLASSES_ROOT\CLSID\{B1CF6225-211E-4B4C-B466-5F224E348FF3}
HKEY_CLASSES_ROOT\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}
HKEY_CLASSES_ROOT\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}
HKEY_CLASSES_ROOT\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}
HKEY_CLASSES_ROOT\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}
HKEY_CLASSES_ROOT\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}
HKEY_CLASSES_ROOT\TypeLib\{0085379D-A745-47E0-8642-82A922D9F12D}
HKEY_CLASSES_ROOT\TypeLib\{2BA9A794-DC89-456F-90F4-A29D3E608216}
HKEY_CLASSES_ROOT\TypeLib\{506F578A-91E1-46CE-830F-E2F4268E9966}
HKEY_CLASSES_ROOT\TypeLib\{E79BB61D-7F1A-41DF-8AD0-402795E3B566}
HKEY_CLASSES_ROOT\PROTOCOLS\Handler\tbr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar={4B3803EA-5230-4DC3-A7FC-33638F3D3542}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\""={4B3803EA-5230-4DC3-A7FC-33638F3D3542}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks={CFBFAE00-17A6-11D0-99CB-00C04FD64497}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Crawler Search
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
HKEY_LOCAL_MACHINE\SOFTWARE\CToolbar
HKEY_CURRENT_USER\Software\CToolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CToolbar_UNINSTALL

Delete directories:
C:\Program Files\Crawler


polonus

[Viewpoint]

No they are the result of avast detecting them and McAfee not detecting anything.

No, as your detections don't have the same malware name JS:Prontexi.

Avast! Virus Labs have named this attack vector JS:Prontexi. It is a JavaScript code which acts as a channel for malware attacks on vulnerable software such as Adobe and a range of zero-day exploits.

That article is reporting that on-line ads are now being exploited to try an infect your system. As I said the internet is now the most common means to attack your system. The fact is that both the Web Shield and the Network Shield go a very long way to prevent infection getting on to your system from this attack method. The other link on that page goes to the avast blog which gives a more technical report from one of the avast Virus Labs guys.

Alright thanks for all the info.   

The thing is...  How do I remove them 
@Polonus Thanks, I already got it it out 


Regards,
Viewpoint

[DavidR]

If you are talking about the .htm files in the temp internet files folder, then there are some tools to kill files that are somewhat more stubborn, again I don't know if these tools work on 64bit OSes, a problem you are no doubt still finding out with 64bit OSes.

- MoveOnBoot http://www.download.com/EMCO-MoveOnBoot/3000-2094_4-10397293.html
- Unlocker http://ccollomb.free.fr/unlocker/ is also good as it also has a few additional features to not only delete the files but stop any process that is stopping you from deleting a file.

There may well be other tools for deletion of locked file, you could try your friend and mine google to see if it brings any others.

[Pondus]

There may well be other tools for deletion of locked file, you could try your friend and mine google to see if it brings any others.

Malwarebytes > More tools > FileASSASSIN

[Viewpoint]

There may well be other tools for deletion of locked file, you could try your friend and mine google to see if it brings any others.

Malwarebytes > More tools > FileASSASSIN

That would do just the trick, but problem is... When I search them they technically don't exist.  They are no where when I search or manually look for them. 

[DavidR]

Well I did ask for which ones you were talking about before and implied if you were talking about the .htp ones (but you didn't respond to that), so I will ask directly which ones are you talking about that can't be found ?

- Ensure that you have hidden files and folders enabled and disable hide system files in Windows Explorer, Tools, Folder Options, Hidden files and folders, uncheck Hide extensions for known file types, etc. see image.

Note: this might be different in your OS and version og windows explorer, but I'm sure you should be able to fine the relevant area.