Techie 77

Folks, thanks for thinking of it. But frankly, having to upgrade C++ seems to me a complexity well beyond what can be suggested to an end-user. I give-up doing this, because I am not sure that a too-recent version of C++ will not make some of my older programs unable to run anymore. To be positive however, I would like to point-out how I apparently got rid anyway of the problem for which I initially wanted to install Malwarebytes. Initial problem: When on the Web and clicking on certain links, I never arrived to the expected site. But instead, on some Google-looking page saying "Not found", or on eMule, to name a few. That happened either with Firefox or with IE6. None of my installed security programs detected any malware, so I wanted to give Malwarebytes a try. While I could not get Malwarebytes to run, following in the meantime the advice on a forum I downloaded and executed Norton's FixLinkopt.exe, that runs in Safe mode. Then I downloaded and executed Fixewareout.exe, that pauses the start of WinXP, and displayed the following report: ________________________________________________________________________________ ________________ Username "utilisateur" - 30/05/2008 12:35:39 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check HKLM\SOFTWARE\~\Winlogon\ "System"="kddnd.exe" HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{4E048DA4-DB37-43C2-AF3D-FD7F3FC3267C} "DhcpNameServer"="85.255.114.28,85.255.112.73" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{5901B75D-A37C-4543-AAB7-AD83B3F04B82} "DhcpNameServer"="85.255.114.28,85.255.112.73" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{8D0B94E0-4CE2-447E-BB27-D7D79B530AEB} "DhcpNameServer"="85.255.114.28,85.255.112.73" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{9413C384-D0C0-46C0-9B0E-C4C2ABE3974F} "DhcpNameServer"="85.255.114.28,85.255.112.73" <Value cleared. HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{C6A599F7-9226-4E91-8D0D-26EC016BFB30} "DhcpNameServer"="85.255.114.28,85.255.112.73" <Value cleared. Resolution cache DNS emptied. System was rebooted successfully. ~~~~~ Postrun check HKLM\SOFTWARE\~\Winlogon\ "system"="" .... .... ~~~~~ Misc files. .... ~~~~~ Checking for older varients. .... ~~~~~ Current runs (hklm hkcu "run" Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "Persistence"="C:\\WINDOWS\\system32\\igfxpers.exe" "RTHDCPL"="RTHDCPL.EXE" "Alcmtr"="ALCMTR.EXE" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "RemoteControl"="\"C:\\Program Files\\Home Cinema\\PowerDVD\\PDVDServ.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "vptray"="C:\\Program Files\\NavNT\\vptray.exe" "Logitech Utility"="Logi_MwX.Exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "TkBellExe"="\"C:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe\" -osboot" "BDAgent"="\"C:\\Program Files\\Softwin\\BitDefender10\\bdagent.exe\"" "PCMService"="\"C:\\Program Files\\Home Cinema\\PowerCinema\\PCMService.exe\"" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" .... Hosts file was reset, If you use a custom hosts file please replace it... ~~~~~ End report ~~~~~ ________________________________________________________________________________ ________________ When Fixewareout started, Norton Antivirus immediately waked-up signaling kddnd.exe as a trojan and removed it. Once both FixLinkopt and Fixewareout were executed, apparently I got rid of the unwanted redirections. For what you see in this report, should Malwarebyte have noticed and fixed the problem? Hope this helps. I shall check from time to time for the release of Malwarebytes 1.15. Thanks again, Phil

Thanks for the advices but... all failed, still "Error 372". What I did: - download .Net V2, - uninstall .Net V1.1 and all its components (French language pack, Hotspot...), - uninstall MWB, - power off/power on, - install .Net V2 (successful), - in the DOS window I entered 'regsvr32 comctl32.ocx', got message "DllRegisterServer in comctl32.ocx successful", - install MWB, - try run MWB, get message "Error 372". Oh, last thing: I installed MWB on an other machine with WinXPPro, worked right away. But on my WinXP SP2 Family edition Version 2002, zilch. Phil

Dear Advanced, sorry for delays answering, I don't connect everyday. Bingo, I have .Net V1.1 installed. Thank you! How do I upgrade? I am always shy to connect to the M$ site. Which brings a side question: Would I have get the automatic .Net upgrade to V2, should I have accepted M$ automatic Windows updates? Thus, I never do any update to my XP. Since you are into computer security, I can tell you that I am paranoid with any kind of automatic software updates. As far as M$ is concerned, I am almost persuaded that M$'s upgrades are never ever "free". That they pick-up all kinds of information about my computer and its contents, and they link that to my PC's serial#, my IP address, to say the least. That they certainly "blacklist" me as I have lots of free softwares on my machine. And God knows what they can do with all that. Phil

Hello Advanced, I did as you suggest but still have the same error 372. Michel

Advanced, thank you! I do so and post result. GT500, I am not sure I exactly see your point. If it is related to the mention to Malwarebytes in Micro Hebdo, here is the translation of what they say, does that answer your question? Q: CrypXed3 makes a mess. I have it on my machine and cannot get rid of it! Avast don't detect it, and neither AdAware nor Spybot. It's via securiser.com that it was detected. And I have lots of pop-up windows displayed! A: I believe it's the spyware CryptExeD3. To get rid of it, use Malwarebytes' anti-malware, download it at http://malwarebytes.gt500.org/mbam-setup.exe. Install this protection. This software is in French. On the home window click Execute a complete exam, and then Search. Suppress the objects found, and restart the PC.

Dear all, On yesterday's issue of Micro Hebdo (French magazine) they advise to install Malwarebyte. The installation itself is OK. But when I want to run it, I get the message: "Run-time error '372': Failed to load control 'ImageList' from COMCTL32.OCX. Your version of COMCTL32.OCX may be outdated. Make sure you are using the version of the control that was provided with your application". I have XP SP2 on a Medion laptop. Installation file just says mbam-setup.exe, no version#. I can't check the version in About, as I can't even load the program. Any idea? Thank you, Michel