Access is Denied when Running Service Pack 1

Unknown

When I goto run the Service Pack 1 Install on a Windows XP Home machine that I am working on I recieve the Error Access is Denied. I have checked all the microsoft articles about this and tried all their solutions. I do have administrative privledges in the account i am using. What is weird is the fact that when i run the service pack install through safe mode it will cancel itself, almost like something is watching for it and cancelling it. I was able to install all of the other critical updates on microsoft's windowsupdate. I ran Norton Antivirus 2004 and removed all the trojans/spyware/adaware that it found.

My friend who also messes with computers, ran accross this issue before, he said it was a virus that wouldn't let the telnet service quit--he ended up wiped the system clean.

I do believe it may be a virus becuase i removed 500 plus files from adaware and 300 plus files from spyware. Not to mention I manually removed 20 plus programs through registry entry and some fun research of each spyware/trojan. I ran as many spyware programs that were legit as I could find.

Unfortunately there is so much stuff on this comptuer that the guy doesn't have disks for I can't reinstall it or else he will complain. :banghead: I've put so much time into this computer and I dont want this issue to cause me to give up and reformat. Any suggestions would be greatly appriciated.


Here is the HiJackthis Log. Even though it says im running SP1, disregaurd it becuase it has never successfully installed it it only partially trys then says access is denied. I definately checked to make sure it wasn't installed already when i went to run the setup. Running in safe mode.

Logfile of HijackThis v1.97.7
Scan saved at 8:07:15 PM, on 6/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\PROGRA~1\NORTON~1\NORTON~1\navw32.exe


R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O2 - BHO: (no name) - {008FCBF3-0236-4A89-84CD-BA6A8EAD5907} - C:\WINDOWS\System32\fpc.dll (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {902D20F6-41CC-483C-BA78-55603B650B3D} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKLM\..\RunOnce: [Q828026] "C:\WINDOWS\INF\unregmp2.exe" /UpdateWMP
O4 - Global Startup: HPAiODevice(hp officejet 7100 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet 7100 series\Bin\hpogrp07.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - DefaultPrefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

If you need any more information let mek now and I will get it to you.

Thanks in advance,
-Jim

Kwitko

This looks like an unfinished install for Windows Media Player:
O4 - HKLM\..\RunOnce: [Q828026] "C:\WINDOWS\INF\unregmp2.exe" /UpdateWMP

What happens if you reboot and retry the SP1 install?

Dooka4u4

Mr. Kwitko wrote:

This looks like an unfinished install for Windows Media Player:
O4 - HKLM\..\RunOnce: [Q828026] "C:\WINDOWS\INF\unregmp2.exe" /UpdateWMP

What happens if you reboot and retry the SP1 install?

It Merely gives me the same error anytime (many restarts) I try and do it through normal mode under the user Owner. I can't log into the Administrator account in normal mode ... microsoft's website addressed that issue saying its designed that way. If i try and login in safe mode as administrator=it works but if i run the sp1 installer it just cancels it self no matter what.

I'll try running the windows media player installation and see what it will say. I just did a security update for Media Player from WindowsUpdate.com the previous to loading safe mode. I haven't booted to normal mode yet.

Kwitko

I found this:
http://www.mvps.org/marksxp/WindowsXP/SP1/common.php#access

Give it a shot and see what happens.

Dooka4u4

I just ran a noton antivirus in safemode and it came up withe one adware called alchem.exe (Adware.ClickAlchemy)... not sure it that would be a problem. I removed it anyways. I could have sworn i removed it earler though I am going to research it and find a manual removal solution.

Dooka4u4

I pulled this error from the svcpack logfile in C:\windows

InstallFromFunction call in inf sectin "BuildType.dirId" Failed.

I know the sp1 file is most likely valid becuase i did a sp1 express install from WindowsUpdate and then thought it might be the file so i downloaded the whole installer and tried it again.

Kwitko

Okay, give this a shot:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;329261

Dooka4u4

Ok. I tried doing the steps listed on that microsoft link. I got through the first regsvr32.exe licdll.dll.... succeeded. Then i went to do the other and it bombed...regsvr32.exe regwizc.dll. This is the error message it produced:

DllRegisterServer in regwizc.dll
Return code was 0x80040154

I did this attempt while running windows in normal mode... maybe a piece of spyware is attached to it...

Safe Mode: Returned the same error message.
Safe Mode:

Dooka4u4

I found this site pertaining to the regsvr32.exe problem... I'm trying it to see if the sfc command comes up with anything.

http://www.windowsbbs.com/showthread.php?t=30208&page=1