LaLuz

Thank you Mr, C. Here are the logs: # AdwCleaner v2.101 - Logfile created 12/18/2012 at 08:57:54 # Updated 16/12/2012 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Mom - XXXXX # Boot Mode : Normal # Running from : C:\Documents and Settings\Mom\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Documents and Settings\Mom\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fgkbmedckhcibhkdhaokebnllokeokek File Deleted : C:\user.js Folder Deleted : C:\Documents and Settings\Mom\Local Settings\Application Data\Conduit Folder Deleted : C:\Program Files\Conduit ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\ConduitSearchScopes Key Deleted : HKCU\Software\Google\Chrome\Extensions\fgkbmedckhcibhkdhaokebnllokeokek Key Deleted : HKCU\Software\IB Updater Key Deleted : HKCU\Software\IM Key Deleted : HKCU\Software\ImInstaller Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKCU\Software\SmartBar Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3247201 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\fgkbmedckhcibhkdhaokebnllokeokek Key Deleted : HKLM\Software\IB Updater Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 [OK] Registry is clean. -\\ Google Chrome v23.0.1271.97 File : C:\Documents and Settings\Mom\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences Deleted [l.8] : homepage = "hxxp://search.conduit.com/?ctid=CT3247201&SearchSource=48", Deleted [l.12] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3247201&SearchSource=48"[...] Deleted [l.320] : homepage = "hxxp://search.conduit.com/?ctid=CT3247201&SearchSource=48", Deleted [l.534] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3247201&SearchSource=48" ] ************************* AdwCleaner[R2].txt - [2720 octets] - [18/12/2012 08:45:48] AdwCleaner[R3].txt - [2782 octets] - [18/12/2012 08:48:02] AdwCleaner[R4].txt - [2842 octets] - [18/12/2012 08:57:30] AdwCleaner[s2].txt - [2680 octets] - [18/12/2012 08:57:54] ########## EOF - C:\AdwCleaner[s2].txt - [2740 octets] ########## # AdwCleaner v2.101 - Logfile created 12/18/2012 at 08:57:54 # Updated 16/12/2012 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Mom - XXXXX # Boot Mode : Normal # Running from : C:\Documents and Settings\Mom\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Documents and Settings\Mom\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fgkbmedckhcibhkdhaokebnllokeokek File Deleted : C:\user.js Folder Deleted : C:\Documents and Settings\Mom\Local Settings\Application Data\Conduit Folder Deleted : C:\Program Files\Conduit ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\ConduitSearchScopes Key Deleted : HKCU\Software\Google\Chrome\Extensions\fgkbmedckhcibhkdhaokebnllokeokek Key Deleted : HKCU\Software\IB Updater Key Deleted : HKCU\Software\IM Key Deleted : HKCU\Software\ImInstaller Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKCU\Software\SmartBar Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3247201 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\fgkbmedckhcibhkdhaokebnllokeokek Key Deleted : HKLM\Software\IB Updater Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 [OK] Registry is clean. -\\ Google Chrome v23.0.1271.97 File : C:\Documents and Settings\Mom\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences Deleted [l.8] : homepage = "hxxp://search.conduit.com/?ctid=CT3247201&SearchSource=48", Deleted [l.12] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3247201&SearchSource=48"[...] Deleted [l.320] : homepage = "hxxp://search.conduit.com/?ctid=CT3247201&SearchSource=48", Deleted [l.534] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3247201&SearchSource=48" ] ************************* AdwCleaner[R2].txt - [2720 octets] - [18/12/2012 08:45:48] AdwCleaner[R3].txt - [2782 octets] - [18/12/2012 08:48:02] AdwCleaner[R4].txt - [2842 octets] - [18/12/2012 08:57:30] AdwCleaner[s2].txt - [2680 octets] - [18/12/2012 08:57:54] ########## EOF - C:\AdwCleaner[s2].txt - [2740 octets] ##########

OMG! please disregard my last post. You were just showing me how to disable the firewall. ok, I got the same error message when installing MB.

I'm not sure what happened here. The link that you game me took me to a page with instructions to disable the firewall, so I clicked on the tab to download and It downloaded a program call 'Free.Download Manager'. I got the same 0x80040154 on multiple screens. I also noticed that it changed my home page to 'search conduct.com.

Windows Firewall

I'm sorry, I forgot to answer the second question. I don't have the Pro version of Malawarebytes yet. I'm waiting to get my PC clean because I don't want to enter any of my personal information.

I downloaded Java 7 update 9 but it failed the test, so then I uploaded Java 6 update 38 as per your instructions.

MrC, I've started a new topic at the General Malwarebyte Anti-Malware forum, but they send me back to this forum. Please tell me how to proceed. Thank you.

As I mentioned before, I have an open ticket at the Malware Removal (HijackThisLogs) and I was sent here to deal with the Malwarebytes Anti-Malware downloading issue.

Im getting the following error when downloading MBam: "CoCreateInstance failed; code 0x80040154 - Class not registered". This error comes up like on 5 different screens and the only option that works is to continue. The program will download, but the tools folder is empty. I have a ticket open with the hjt forum, and I was referred to this forum for help with this issue. Here are the logs: DDS (Ver_2012-11-07.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 Run by Mom at 17:25:46 on 2012-12-16 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.959.514 [GMT -8:00] . AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . ============== Running Processes ================ . C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\netdde.exe C:\Program Files\EPSON\ESM2\eEBSVC.exe C:\WINDOWS\system32\FsUsbExService.Exe C:\Program Files\Java\jre7\bin\jqs.exe c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\AVAST Software\Avast\avastUI.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\svchost.exe -k DcomLaunch C:\WINDOWS\system32\svchost.exe -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\System32\svchost.exe -k HTTPFilter . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = iexplore BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned> BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned> BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.7529.1424\swg.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [nwiz] nwiz.exe /install mRun: [RTHDCPL] RTHDCPL.EXE mRun: [skyTel] SkyTel.EXE mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:323 uPolicies-Explorer: NoDriveAutoRun = dword:67108863 uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDrives = dword:0 mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - c:\program files\paltalk messenger\Paltalk.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1349584314234 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1353303973093 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: NameServer = 192.168.2.1 TCP: Interfaces\{B98034A1-5DAE-483B-BF90-424FFBCCF7F9} : DHCPNameServer = 192.168.2.1 SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll LSA: Authentication Packages = msv1_0 nwprovau . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 193552] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-12-13 738504] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-12-13 361032] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-12-13 21256] R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-12-13 44808] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2011-12-24 54760] R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2012-11-8 238952] R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2012-11-8 36608] S1 SBRE;SBRE;\??\c:\windows\system32\drivers\sbredrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872] S3 USB_RNDIS_51;USB Remote NDIS Y Network Device Driver;c:\windows\system32\drivers\usb8023.sys [2006-2-28 12800] . =============== Created Last 30 ================ . 2012-12-15 03:07:23 290304 ----a-w- C:\subinacl.exe 2012-12-15 03:03:57 -------- d-----w- C:\RegBackup 2012-12-15 02:47:13 -------- d-----w- C:\Tweaking.com_Windows_Repair_Logs 2012-12-14 19:05:27 -------- d-----w- c:\program files\Tweaking.com 2012-12-13 15:26:08 143872 ----a-w- c:\windows\system32\javacpl.cpl 2012-12-13 15:26:01 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2012-12-13 13:25:55 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2012-12-13 13:25:34 41224 ----a-w- c:\windows\avastSS.scr 2012-12-13 13:25:18 -------- d-----w- c:\program files\AVAST Software 2012-12-13 13:25:18 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software 2012-12-13 01:53:14 6812136 ------w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8b9e1413-1c55-4c20-b06f-490101927819}\mpengine.dll 2012-12-12 17:50:02 -------- d-----w- c:\documents and settings\mom\local settings\application data\Sun 2012-12-12 17:39:55 821736 ----a-w- c:\windows\system32\npDeployJava1.dll 2012-12-10 04:10:38 -------- d-----w- c:\program files\Microsoft ATS 2012-12-09 03:57:01 -------- d-----w- c:\documents and settings\mom\application data\ElevatedDiagnostics 2012-12-04 09:01:44 -------- d-----w- c:\windows\system32\wbem\repository\FS 2012-12-04 09:01:44 -------- d-----w- c:\windows\system32\wbem\Repository 2012-12-03 20:27:16 -------- d-----w- c:\documents and settings\mom\application data\PerformerSoft 2012-11-30 08:33:04 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys 2012-11-30 08:25:12 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys 2012-11-22 02:25:40 -------- d-sha-r- C:\cmdcons 2012-11-20 00:36:44 -------- d-----w- c:\documents and settings\mom\local settings\application data\PCHealth 2012-11-19 01:02:33 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll 2012-11-18 08:27:26 -------- d-----w- c:\windows\PIF 2012-11-18 08:27:26 -------- d-----w- C:\Inetpub . ==================== Find3M ==================== . 2012-12-13 15:25:46 746984 -c--a-w- c:\windows\system32\deployJava1.dll 2012-12-12 18:28:13 73656 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-12-12 18:28:13 697272 -c--a-w- c:\windows\system32\FlashPlayerApp.exe 2012-11-15 17:49:22 57600 ----a-w- c:\windows\system32\drivers\redbook.sys 2012-11-13 01:25:12 1866368 ----a-w- c:\windows\system32\win32k.sys 2012-11-06 00:41:17 290560 ----a-w- c:\windows\system32\atmfd.dll 2012-11-02 02:02:42 375296 ----a-w- c:\windows\system32\dpnet.dll 2012-11-01 12:17:54 916992 ----a-w- c:\windows\system32\wininet.dll 2012-11-01 12:17:54 43520 ----a-w- c:\windows\system32\licmgr10.dll 2012-11-01 12:17:54 1469440 ----a-w- c:\windows\system32\inetcpl.cpl 2012-11-01 00:35:34 385024 ----a-w- c:\windows\system32\html.iec 2012-10-02 18:04:21 58368 ----a-w- c:\windows\system32\synceng.dll . ============= FINISH: 17:26:28.39 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-07.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 6/10/2007 11:56:43 AM System Uptime: 12/16/2012 4:20:31 PM (1 hours ago) . Motherboard: Gigabyte Technology Co., Ltd. | | M61VME-S2 Processor: AMD Athlon 64 X2 Dual Core Processor 4200+ | Socket M2 | 2209/200mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 279 GiB total, 268.055 GiB free. E: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E965-E325-11CE-BFC1-08002BE10318} Description: CD-ROM Drive Device ID: IDE\CDROMPIONEER_DVD-RW__DVR-111D________________1.23____\46_044483550333233375732204C202020202020 Manufacturer: (Standard CD-ROM drives) Name: PIONEER DVD-RW DVR-111D PNP Device ID: IDE\CDROMPIONEER_DVD-RW__DVR-111D________________1.23____\46_044483550333233375732204C202020202020 Service: cdrom . Class GUID: Description: Device ID: ROOT\LEGACY_SASKUTIL\0000 Manufacturer: Name: PNP Device ID: ROOT\LEGACY_SASKUTIL\0000 Service: . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: WAN Miniport (IPX) Device ID: ROOT\MS_NDISWANIPX\0001 Manufacturer: Microsoft Name: WAN Miniport (IPX) #2 PNP Device ID: ROOT\MS_NDISWANIPX\0001 Service: NdisWan . ==== System Restore Points =================== . RP1: 12/16/2012 11:20:20 AM - System Checkpoint . ==== Installed Programs ====================== . Adobe Flash Player 11 ActiveX Adobe Reader XI avast! Free Antivirus Control Center for KODAK Webcams EPSON Status Monitor 2 Google Chrome Google Toolbar for Internet Explorer Google Update Helper High Definition Audio Driver Package - KB888111 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB2443685) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB2633952) Hotfix for Windows XP (KB2756822) Hotfix for Windows XP (KB2779562) Hotfix for Windows XP (KB942288-v3) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB954708) Hotfix for Windows XP (KB961118) HP Deskjet 1000 J110 series Basic Device Software HP Deskjet 1000 J110 series Help HP Deskjet 1000 J110 series Product Improvement Study Internet Explorer (Enable DEP) Itibiti RTC Java 7 Update 9 Java Auto Updater Java 6 Update 38 Junk Mail filter update Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Antimalware Microsoft Application Error Reporting Microsoft Automated Troubleshooting Services Shim Microsoft Choice Guard Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Sync Framework Runtime Native v1.0 (x86) Microsoft Sync Framework Services Native v1.0 (x86) Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft VC9 runtime libraries Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 MSVCRT MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) NVIDIA Drivers OpenOffice.org 3.3 Realtek High Definition Audio Driver Samsung New PC Studio SAMSUNG USB Driver for Mobile Phones Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft Windows (KB2564958) Security Update for Windows Internet Explorer 7 (KB2530548) Security Update for Windows Internet Explorer 7 (KB2544521) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2744842) Security Update for Windows Internet Explorer 8 (KB2761465) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2121546) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2476687) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2510581) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2536276) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2555917) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2567053) Security Update for Windows XP (KB2567680) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2585542) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2619339) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB2653956) Security Update for Windows XP (KB2655992) Security Update for Windows XP (KB2659262) Security Update for Windows XP (KB2676562) Security Update for Windows XP (KB2686509) Security Update for Windows XP (KB2691442) Security Update for Windows XP (KB2698365) Security Update for Windows XP (KB2705219) Security Update for Windows XP (KB2707511) Security Update for Windows XP (KB2712808) Security Update for Windows XP (KB2719985) Security Update for Windows XP (KB2723135) Security Update for Windows XP (KB2724197) Security Update for Windows XP (KB2727528) Security Update for Windows XP (KB2731847) Security Update for Windows XP (KB2753842) Security Update for Windows XP (KB2758857) Security Update for Windows XP (KB2761226) Security Update for Windows XP (KB2770660) Security Update for Windows XP (KB2779030) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982665) Segoe UI Tweaking.com - Windows Repair (All in One) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2541763) Update for Windows XP (KB2607712) Update for Windows XP (KB2616676) Update for Windows XP (KB2641690) Update for Windows XP (KB2661254-v2) Update for Windows XP (KB2718704) Update for Windows XP (KB2736233) Update for Windows XP (KB2749655) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB961503) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) WebFldrs XP Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Installer Clean Up Windows Internet Explorer 7 Windows Internet Explorer 8 Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Family Safety Windows Live Mail Windows Live Messenger Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Upload Tool Windows Live Writer Windows Media Format 11 runtime Windows Media Player 11 Windows PowerShell 1.0 Windows XP Service Pack 3 . ==== Event Viewer Messages From Past Week ======== . 12/9/2012 9:31:38 PM, error: System Error [1003] - Error code 00000019, parameter1 00000020, parameter2 84c162c8, parameter3 84c166e0, parameter4 1a830001. 12/9/2012 8:00:49 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2729450). 12/16/2012 12:02:35 AM, error: System Error [1003] - Error code 00000019, parameter1 00000020, parameter2 842e6000, parameter3 842e6418, parameter4 1a830000. 12/15/2012 11:24:46 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000243' while processing the file '09696709.sys' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 12/14/2012 7:40:52 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 12/14/2012 7:40:46 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AmdK8 aswSnx aswSP aswTdi Fips MpFilter SBRE 12/14/2012 5:24:40 PM, error: System Error [1003] - Error code 00000019, parameter1 00000020, parameter2 84e87830, parameter3 84e87c48, parameter4 1a830001. 12/14/2012 1:15:57 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000243' while processing the file '40975672.sys' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 12/13/2012 6:51:51 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000243' while processing the file '90022556.sys' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 12/13/2012 6:07:03 AM, error: System Error [1003] - Error code 00000019, parameter1 00000020, parameter2 84505760, parameter3 84505b78, parameter4 1a830001. 12/13/2012 5:15:51 AM, error: Service Control Manager [7000] - The Microsoft Antimalware Service service failed to start due to the following error: The system cannot find the path specified. 12/12/2012 9:43:46 AM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s). 12/12/2012 9:18:57 AM, error: System Error [1003] - Error code 00000019, parameter1 00000020, parameter2 84aa4608, parameter3 84aa4a20, parameter4 1a830001. 12/12/2012 6:15:37 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SBRE 12/12/2012 6:15:25 PM, error: Microsoft Antimalware [1119] - 12/12/2012 6:12:42 PM, error: Service Control Manager [7024] - The Routing and Remote Access service terminated with service-specific error 3604 (0xE14). 12/12/2012 4:26:25 PM, error: System Error [1003] - Error code 00000019, parameter1 00000020, parameter2 84a7aa20, parameter3 84a7ae38, parameter4 1a830001. 12/12/2012 4:00:33 PM, error: Service Control Manager [7034] - The EpsonBidirectionalService service terminated unexpectedly. It has done this 1 time(s). 12/12/2012 12:42:04 PM, error: System Error [1003] - Error code 00000019, parameter1 00000020, parameter2 85f426e0, parameter3 85f42af8, parameter4 1a830001. 12/12/2012 12:41:46 PM, error: System Error [1003] - Error code 00000019, parameter1 00000020, parameter2 84b9b608, parameter3 84b9ba20, parameter4 1a830001. 12/12/2012 12:00:32 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000243' while processing the file '93037758.sys' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 12/12/2012 11:25:22 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 12/12/2012 11:23:16 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} 12/12/2012 11:18:55 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 12/12/2012 11:07:42 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000243' while processing the file '22140061.sys' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume. 12/12/2012 11:05:08 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 Fips MpFilter SBRE 12/11/2012 12:26:37 PM, error: Dhcp [1002] - The IP address lease 192.168.2.3 for the Network Card with network address 001A4D64E23B has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). . ==== End Of File ===========================

I run mbam-clean.exe and then proceded to download Malwarebytes, but I got the same 'coinstance error 0x80040154'.

What are the procedures for XP to dowload ziprunas? Vista and Windows 7 users: 1. These tools MUST be run from the executable. (.exe) every time you run them 2. With Admin Rights (Right click, choose "Run as Administrator")

I'm so sorry Mr. C, I guess I'm so overwhelmed with all these issues that I'm not making any sense. I was just trying to explain to you all the issues that I'm still having with the computer to see if they are all related and asking for your guidance. I was finally I able to download Java 6 update 38, but Java 7 is still not working.

Mr. C, Please excuse my ignorance, but i have not been able to download Java version 6 update 38. I've been trying to follow the instructions from the link that you have provided and I'm getting nowhere I also wanted you to know that I was trying to install a fresh copy of Malwarebytes Anti-Malware and I'm getting the following error on about 5 different screens: "CoCreateInstance failed; code 0x80040154 Class not resgistered". I think that might have something to do with the tools folder being empty on my first installation. My computer is still acting up, so I run ComboFix once again on safemode and got the same results Should I open a new ticket?

Yes, I dowloaded and run JavaMSIFix.

I deleted trojan.Alureon.E using Avast and a program call aswMBR. It was installed on a separate partition, so the program made the necesary adjustments to be able to delete that partition. I ran that program like three times, got rid of Microsoft Security Essentials, and installed Avast instead. Here is the log: aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2012-12-13 04:30:56 ----------------------------- 04:30:56.187 OS Version: Windows 5.1.2600 Service Pack 3 04:30:56.187 Number of processors: 2 586 0x4B02 04:30:56.187 ComputerName: XXXXXXX UserName: Mom 04:30:57.125 Initialize success 04:34:20.093 AVAST engine defs: 12121300 04:34:54.625 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 04:34:54.625 Disk 0 Vendor: ST3300620A 3.AAE Size: 286167MB BusType: 3 04:34:54.640 Disk 0 MBR read successfully 04:34:54.640 Disk 0 MBR scan 04:34:54.671 Disk 0 Windows XP default MBR code 04:34:54.671 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 286157 MB offset 63 04:34:54.703 Disk 0 Partition 2 00 0E FAT16 LBA NTFS 7 MB offset 586051200 04:34:54.703 Disk 0 Partition 2 **INFECTED** MBR:Alureon-K [Rtk] 04:34:54.703 Disk 0 MBR [sST] **ROOTKIT** 04:34:54.703 Disk 0 trace - called modules: 04:34:54.703 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 04:34:54.703 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8602eab8] 04:34:54.703 3 CLASSPNP.SYS[f74c7fd7] -> nt!IofCallDriver -> \Device\00000066[0x85f949e8] 04:34:54.703 5 ACPI.sys[f7330620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x85fae940] 04:34:55.140 AVAST engine scan C:\WINDOWS 04:35:06.703 AVAST engine scan C:\WINDOWS\system32 04:37:36.859 AVAST engine scan C:\WINDOWS\system32\drivers 04:37:53.531 AVAST engine scan C:\Documents and Settings\Mom 04:39:48.734 AVAST engine scan C:\Documents and Settings\All Users 04:40:07.343 Verifying 04:40:17.343 Disk 0 Windows 501 MBR fixed successfully 04:40:21.062 Scan finished successfully 04:40:50.484 Disk 0 MBR read successfully 04:40:50.484 Verifying disinfection 04:41:07.046 Disinfection error 04:41:14.968 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Mom\Desktop\MBR.dat" 04:41:14.968 The log file has been saved successfully to "C:\Documents and Settings\Mom\Desktop\aswMBR.txt" aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2012-12-13 04:51:44 ----------------------------- 04:51:44.828 OS Version: Windows 5.1.2600 Service Pack 3 04:51:44.828 Number of processors: 2 586 0x4B02 04:51:44.828 ComputerName: XXXXXXX UserName: Mom 04:51:45.375 Initialize success 04:52:03.640 AVAST engine defs: 12121300 04:52:36.421 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 04:52:36.421 Disk 0 Vendor: ST3300620A 3.AAE Size: 286167MB BusType: 3 04:52:36.437 Disk 0 MBR read successfully 04:52:36.437 Disk 0 MBR scan 04:52:36.484 Disk 0 Windows XP default MBR code 04:52:36.484 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 286157 MB offset 63 04:52:36.500 Disk 0 Partition 2 00 0E FAT16 LBA NTFS 7 MB offset 586051200 04:52:36.500 Disk 0 Partition 2 **INFECTED** MBR:Alureon-K [Rtk] 04:52:36.500 Disk 0 MBR [sST] **ROOTKIT** 04:52:36.500 Disk 0 trace - called modules: 04:52:36.515 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 04:52:36.515 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86074ab8] 04:52:36.515 3 CLASSPNP.SYS[f74c7fd7] -> nt!IofCallDriver -> \Device\00000066[0x8607a9e8] 04:52:36.515 5 ACPI.sys[f735e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x85fb2d98] 04:52:36.953 AVAST engine scan C:\WINDOWS 04:52:50.703 AVAST engine scan C:\WINDOWS\system32 04:55:22.890 AVAST engine scan C:\WINDOWS\system32\drivers 04:55:38.921 AVAST engine scan C:\Documents and Settings\Mom 04:57:25.859 AVAST engine scan C:\Documents and Settings\All Users 04:57:50.484 Scan finished successfully 05:05:22.515 Disk 0 MBR read successfully 05:05:22.515 Verifying disinfection 05:05:38.718 Disinfection error 05:05:46.312 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Mom\Desktop\MBR.dat" 05:05:46.312 The log file has been saved successfully to "C:\Documents and Settings\Mom\Desktop\aswMBR.txt" aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2012-12-13 05:06:57 ----------------------------- 05:06:57.343 OS Version: Windows 5.1.2600 Service Pack 3 05:06:57.343 Number of processors: 2 586 0x4B02 05:06:57.343 ComputerName: XXXXXX UserName: Mom 05:06:57.937 Initialize success 05:07:09.484 AVAST engine defs: 12121300 05:07:52.625 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 05:07:52.640 Disk 0 Vendor: ST3300620A 3.AAE Size: 286167MB BusType: 3 05:07:52.656 Disk 0 MBR read successfully 05:07:52.656 Disk 0 MBR scan 05:07:52.687 Disk 0 Windows XP default MBR code 05:07:52.687 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 286157 MB offset 63 05:07:52.703 Disk 0 scanning sectors +586051200 05:07:52.796 Disk 0 scanning C:\WINDOWS\system32\drivers 05:08:00.703 Service scanning 05:08:11.937 Modules scanning 05:08:19.406 Disk 0 trace - called modules: 05:08:19.437 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 05:08:19.437 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86074ab8] 05:08:19.437 3 CLASSPNP.SYS[f74c7fd7] -> nt!IofCallDriver -> \Device\00000066[0x8607a9e8] 05:08:19.437 5 ACPI.sys[f735e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x85fb2d98] 05:08:20.109 AVAST engine scan C:\WINDOWS 05:08:35.593 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Mom\Desktop\MBR.dat" 05:08:35.593 The log file has been saved successfully to "C:\Documents and Settings\Mom\Desktop\aswMBR.txt" P.S. I still was not able to download Java after following your instructions