Emergency Help - can't work until safe. Virus/Malware issues

[kstmommy]

I'm not exactly sure HOW, but I can't help thinking this has something to do with my monitor acting all crazy. This didn't happen until my monitor went completely out. This is a monitor that I hadn't used in a while. Would it be crazy to try and hook up my laptop as the display screen, temporarily? Just to see?

That display thing pops up and disappears randomly like 20 times a minute, in no set pattern.

[Maurice Naggar]

NO, I don't think you can hook up the laptop.

You have to square away any monitor hardware issue. Do you have another working monitor?

You need to remove the suspicious monitor & put in a good one; insuring that your cabling is done correctly and snuggly.

The taskbar can be put back in view. That should not be a show-stopper.

But was is really of concern now, is the seeming instability of this monitor.

[kstmommy]

I do have another monitor, but it's the one I'm currently on and the one I'm working on daily. HUGE PITA to move it to the other room and back etc. I'll do it though to see if it helps. I'm going to have to take a little reprieve though first. I have to get up early, work, run the cat to the vet, back home to work more, and when I'm done, I'll check it.

Thanks for everything again, I can't say it enough. I'll check back tomorrow, probably early afternoon and let you know what happened.

[Maurice Naggar]

Allright. I'll wait till I hear back from you.

[Maurice Naggar]

I have a tip for you to get {hopefully} the taskbar to show again, courtesy of Kelly Theriot

When you have time, and when the computer is available + if Windows is able to be used:

Download and save this script file from Miss Kelly http://www.kellys-ko...ktop_fixall.vbs

One this is saved to the problem pc, then double-click the vbs file to start the fix.

[kstmommy]

Hi Maurice.. sorry for yesterday. Rough day. We're all squared away with the monitor...

I ran that script above, but nothing happened. Booted into Safe Mode, ran it again, and nothing happened.

In Safe Mode, task bar suddenly appeared. I got excited and booted back into normal mode, no task bar.

[Maurice Naggar]

The vbs fix should have cured the taskbar issue. Be that as it may, let's disregard that.

re-focusing once more on the "policy restriction" problem, Download and save the attached KSTM4.zip

Next, unzip the contents of it.

You will see a Kstm4.reg file

Placing that reg file on the Desktop of the problem system, or even perhaps to a unique folder.

Then do a Right-click on kstm4.reg and select Merge and allow to merge into the registry.

Then Logoff and restart Windows.

The bogus policy restriction should be gone. Kaput gone.

Let me know once you have completed these steps. After which, I think I can follow up with a script to remove the remains of MSE.

Also, I want to advise & warn you about Iolo System Mechanic.

It is known to have some "cleanup" functions that will cause your system harm, and lose functions of Windows Installer service, and cascade into issues of failing Windows Updates.

If you did not buy System Mechanic, or even if it came free from your computer maker, uninstall System Mechanic by using Control Panel >> Add-or-Remove Programs.

Out of curiosity, was the old monitor & this monitor of a different size or different make ?

Were they each of 14-inch screen size ?

But once we get this policy thing & I am sure that no malware is left, I will likely close this and have you do research and help at other venue.

But I would again take this opportunity to restate that you need to get the PRO license for MBAM to better secure this system !! Beef up your backup and security practices is a must seeing as how you deal with financial apps.

< end of rant. Now please do the reg fix>

[kstmommy]

Did the reg thing, rebooted. MBAM still won't open. I'm still getting the software rest policy...

Windows is definitely not acting right. I can't drag and drop files. I can't uninstall anything (I tried unistalling Iolo) ...

I think we may have inadvertently changed something or deleted something. It's just not acting like normal.

How would you feel about reverting to a few steps ago, via system restore, and see if we can't find a good spot where I had a taskbar and windows ran normally?

Btw, both monitors are Dell, both the same size 20"

[kstmommy]

Morning. Ok on step 1, under Program Files properties, the read only box isn't technically checkmarked, but it seems to be selected with a green square in the selection. If I de-select it, and hit apply, I get the warning message attached... I cancelled out and did not make any changes until you advise..

Also, as you can see by the image, I have no "security" tab to check.

^^^ This seemed like it might be the last point of normalcy

[Maurice Naggar]

No, I do not think any of what we did is causing any of those issues.

Do you have Spybot S & D installed? If yes, then STOP and let me know right away. !!!

Restart the system into SAFE mode. Find the Kstm4.reg that you saved before.

Then do a Right-click on kstm4.reg and select Merge and allow to merge into the registry.

• Double-click SystemLook.exe to start it.
  
• Copy the content of the following codebox into the main textfield (6 lines):
  

  :Regfind
  {6680132f-759a-4e64-979a-462d4d0a4d19}
  :reg 
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  :filefind
  policy
  

  
  

• Click the Look button to start the scan.
  
• Have infinite patience while it is scanning.
  
• When finished, a NOTEPAD window will open with the results of the scan. Please Copy & Paste this log in your next reply.
  
• Press EXIT button when all done.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

[kstmommy]

No on the Spybot S&D...

SystemLook 30.07.11 by jpshortstuff

Log created at 15:37 on 06/04/2013 by Mom

Administrator - Elevation successful

========== Regfind ==========

Searching for "{6680132f-759a-4e64-979a-462d4d0a4d19}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{6680132F-759A-4E64-979A-462D4D0A4D19}]

========== reg ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers]

"ExecutableTypes"="ADE ADP BAS BAT CHM CMD COM CPL CRT EXE HLP HTA INF INS ISP LNK MDB MDE MSC MSI MSP MST OCX PCD PIF REG SCR SHS URL VB WSC"

"TransparentEnabled"= 0x0000000001 (1)

"DefaultLevel"= 0x0000040000 (262144)

"AuthenticodeEnabled"= 0x0000000000 (0)

"PolicyScope"= 0x0000000000 (0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0]

========== filefind ==========

Searching for "policy"

No files found.

-= EOF =-

[Maurice Naggar]

OK, That helps indeed to see that the policy restriction is still around. (

Download and save the attached KSTM5.zip .....this is a different one from the prior one

Next, unzip the contents of it.

You will see a Kstm5.reg file

Placing that reg file on the Desktop of the problem system, or even perhaps to a unique folder.

Then do a Right-click on kstm5.reg and select Merge and allow to merge into the registry.

Then Logoff and restart Windows.

The bogus policy restriction should be gone. Knock wood.

Let me know once you have completed these steps.

[kstmommy]

I think we got it that time... BUT

upon opening MBAM I got this message..

Run-time error 372...

Failed to load control vbalgrid6.ocx. Your version of vbalgrid6.ocx may be outdated. Make sure you are using the version of the control that was provided with your application.

[Maurice Naggar]

Download and save the attached KSTM6.zip .....this is a different one from all others

Next, unzip the contents of it.

You will see a Kstm6.reg file

Placing that reg file on the Desktop of the problem system, or even perhaps to a unique folder.

Then do a Right-click on kstm5.reg and select Merge and allow to merge into the registry.

Then Logoff and restart Windows.

Now then, go to Control Panel >> Add-or-Remove Programs look for MalwareBytes MBAM

and then select it & then Uninstall it

Close Control Panel

Let me know once you have completed these steps.

Edited May 4, 2013 by Maurice Naggar
added Kstm6.zip

[kstmommy]

Did the reg part and rebooted. No monitor again. I think it's the cord. It HAS to be. One quick question so we can proceed.

My video card has a HDMI slot and I have a new HD livingroom tv. Will it do any harm to my tv, if I hook that up as a monitor for the time being?

[Maurice Naggar]

I dunno about the latter. I suspect at best it will only {maybe} treat the tv as a secondary monitor.

Let me express my mild frustration at having run into so many hardware issues with the monitor, etc. It keeps happening so many times. (

I must depend upon you to get & have a stable hardware setup, otherwise I will call a halt to trying to fix software settings.

1) the restriction policy rogue now should be all gone.

2) If you uninstalled MBAM, then we could be in a position to properly install it.

Recheck your power source. Recheck your cable from the monitor to the video card & insure it is seated properly.

Power cables also properly in-place.

Can you really check those connections?

I would repeat that not having a good proper monitor, keyboard, etc will hurt you & your Windows setup.

To get back the Taskbar into view.

1. Press CRTL+ESC.

2. If the Start menu appears, right-click the Start menu, and then click Properties.

3. Click the Taskbar tab, clear the Auto-hide the taskbar check box, and then click OK.

[kstmommy]

The monitor stuff didn't start until right in the middle of all of this. I certainly didn't expect it to happen and tried to remedy it by using another one. My mistake was using the same cord. I am very well aware how to check connections. Anyway, I hooked up the pc to a tv for now, so we're in business...

Still no taskbar with CTRL+ESC....

Sucessfully uninstalled MBAM

[Maurice Naggar]

Whatever was done by any earlier fixes, has nothing to do with a disappearing Taskbar. Please understand that.

You started to have "monitor" issues after you moved the computer.

Download & SAVE the latest version of Malwarebytes' Anti-Malware from >> here <<

Run the mbam-setup.

When it is all done, MBAM should start.

But seeing as how you currently do not have internet connection, skip any Update part, as one needs connection to the internet for that.

Start your MBAM MalwareBytes' Anti-Malware.

Click the Settings Tab and then the General Settings sub-tab. Make sure all option lines have a checkmark.

Then click the Scanner settings sub-tab in second row of tabs. Make sure all option lines have a checkmark.

When done, click the Scanner tab.

Do a Quick Scan.

When the scan is complete, click OK, then Show Results to view the results.

Make sure that everything is checked, and click Remove Selected.

When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

When all done, Copy & paste the MBAM scan log into a new reply.

[kstmommy]

Installed new MBAM, however, I'm getting the same Run-time error as before: 372

[Maurice Naggar]

You have the mbam-clean exe tool from before.

Run it.

Then, Logoff and reboot.

Download and save this mbam zip file http://forums.malwarebytes.org/index.php?app=core&module=attach&section=attach&attach_id=95830

Extract the contents and place those onto the desktop of the pc, or if needed, in a unique folder on the computer.

Double click the exe file to install mbam, again, as a new install. Then do a quick scan.

IF there is an error or exception that shows up, I need the complete verbatim message contents.

And please, if you take a screenshot, save it as a GIF file not a PNG file.

I really need for you to do the following, too, but this is for the registry related to the desktop/taskbar.

• Double-click SystemLook.exe to start it.
  
• Copy the content of the following codebox into the main textfield (6 lines):
  

  :reg 
  HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
  

  
  

• Click the Look button to start the scan.
  
• Have infinite patience while it is scanning.
  
• When finished, a NOTEPAD window will open with the results of the scan. Please Copy & Paste this log in your next reply.
  
• Press EXIT button when all done.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

[kstmommy]

Installed MBAM again and when it tried to launch, I got this message..

Run-time error 372...

Failed to load control vbalgrid6.ocx. Your version of vbalgrid6.ocx may be outdated. Make sure you are using the version of the control that was provided with your application.

SystemLook 30.07.11 by jpshortstuff

Log created at 19:52 on 06/04/2013 by Mom

Administrator - Elevation successful

========== reg ==========

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop]

"FFlags"= 0x0000000224 (548)

"Mode"= 0x0000000001 (1)

"ScrollPos800x600(1).x"= 0x0000000000 (0)

"ScrollPos800x600(1).y"= 0x0000000000 (0)

"Sort"= 0x0000000000 (0)

"SortDir"= 0x0000000001 (1)

"Col"= 0x0000000003 (3)

"ColInfo"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 0f 00 04 00 20 00 10 00 00 00 28 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 b4 00 60 00 78 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (REG_BINARY)

"ScrollPos1024x768(1).x"= 0x0000000000 (0)

"ScrollPos1024x768(1).y"= 0x0000000000 (0)

"ScrollPos1680x1050(1).x"= 0x0000000000 (0)

"ScrollPos1680x1050(1).y"= 0x0000000000 (0)

"ScrollPos1280x768(1).x"= 0x0000000000 (0)

"ScrollPos1280x768(1).y"= 0x0000000000 (0)

"ItemPos1280x768(1)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 15 00 00 00 54 00 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d ab 00 00 00 54 00 00 00 14 00 1f 80 9d 49 5c c5 18 35 a1 44 99 8e 79 6a c5 fc 98 9d ab 00 00 00 92 02 00 00 48 00 3a 00 6f 02 00 00 ba 36 b0 86 20 00 41 4f 4c 39 30 7e 31 2e 4c 4e 4b 00 2e 00 03 00 04 00 ef be 8d 36 54 bf ea 36 07 ac 14 00 00 00 41 00 4f 00 4c 00 20 00 39 00 2e 00 30 00 2e 00 6c 00 6e 00 6b 00 00 00 1a 00 15 00 00 00 f8 00 00 00 5a 00 3a 00 62 07 00 00 8b 36 7c 63 20 00 42 55 52 4e 43 44 7e 31 2e 4c 4e 4b 00 00 3e 00 03 00 04 00 ef be 8b 36 7d 63 ea 36 07 ac 14 00 00 00 42 00 75 00 72 00 6e 00 20 00 43 00 44 00 73 00 20 00 26 00 20 00 44 00 56 00 44 00 73 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 f6 00 00 00 9c 01 00 00 70 00 3a 00 9c 02 00 00 a3 36 06 55 20 00 43 4f 46 46 45 45 7e 31 2e 4c 4e 4b 00 00 54 00 03 00 04 00 ef be a3 36 06 55 ea 36 07 ac 14 00 00 00 43 00 6f 00 66 00 66 (REG_BINARY)

"ItemPos1024x768(1)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 4e 00 00 00 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 17 00 00 00 02 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 4f 01 00 00 7e 01 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d 4f 01 00 00 4e 00 00 00 58 00 3a 00 c1 06 00 00 7c 3a 45 bc 20 00 41 44 4f 42 45 52 7e 31 2e 4c 4e 4b 00 00 3c 00 03 00 04 00 ef be 35 3a cf 46 86 42 8d a4 14 00 00 00 41 00 64 00 6f 00 62 00 65 00 20 00 52 00 65 00 61 00 64 00 65 00 72 00 20 00 38 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 17 00 00 00 e6 00 00 00 5a 00 3a 00 f4 02 00 00 79 3e 6a 56 20 00 41 4f 4c 44 45 53 7e 32 2e 4c 4e 4b 00 00 3e 00 03 00 04 00 ef be 8d 36 54 bf 86 42 8d a4 14 00 00 00 41 00 4f 00 4c 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 20 00 39 00 2e 00 36 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 9d 01 00 00 4e 00 00 00 66 00 3a 00 99 06 00 00 7c 42 3b 55 20 00 41 56 41 53 54 21 7e 31 2e 4c 4e 4b 00 00 4a 00 03 00 04 00 ef be 7c 42 3b (REG_BINARY)

"ScrollPos1280x1024(1).x"= 0x0000000000 (0)

"ScrollPos1280x1024(1).y"= 0x0000000000 (0)

"ScrollPos1440x900(1).x"= 0x0000000000 (0)

"ScrollPos1440x900(1).y"= 0x0000000000 (0)

"ScrollPos1440x900(2).x"= 0x0000000000 (0)

"ScrollPos1440x900(2).y"= 0x0000000000 (0)

"ScrollPos1680x1050(2).x"= 0x0000000000 (0)

"ScrollPos1680x1050(2).y"= 0x0000000000 (0)

"ScrollPos800x600(2).x"= 0x0000000000 (0)

"ScrollPos800x600(2).y"= 0x0000000000 (0)

"ItemPos800x600(2)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 00 00 02 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 16 00 00 00 9e 00 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d 16 00 00 00 ec 00 00 00 14 00 1f 80 75 0d 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 16 00 00 00 3a 01 00 00 14 00 1f 80 9d 49 5c c5 18 35 a1 44 99 8e 79 6a c5 fc 98 9d 16 00 00 00 88 01 00 00 56 00 3a 00 fe 06 00 00 15 37 14 60 20 00 41 44 2d 41 57 41 7e 31 2e 4c 4e 4b 00 00 3a 00 03 00 04 00 ef be 15 37 14 60 3a 3b fd 2c 14 00 00 00 41 00 64 00 2d 00 41 00 77 00 61 00 72 00 65 00 20 00 32 00 30 00 30 00 37 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 16 00 00 00 d6 01 00 00 58 00 3a 00 c1 06 00 00 7c 3a 45 bc 20 00 41 44 4f 42 45 52 7e 31 2e 4c 4e 4b 00 00 3c 00 03 00 04 00 ef be 35 3a cf 46 3a 3b 00 2d 14 00 00 00 41 00 64 00 6f 00 62 00 65 00 20 00 52 00 65 00 61 00 64 00 65 00 72 00 20 00 38 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 16 00 00 00 24 02 00 00 56 00 3a 00 fe 06 00 00 15 37 14 60 20 00 41 (REG_BINARY)

"ScrollPos1360x1024(2).x"= 0x0000000000 (0)

"ScrollPos1360x1024(2).y"= 0x0000000000 (0)

"ItemPos1360x1024(2)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 15 00 00 00 4e 00 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d 15 00 00 00 9a 00 00 00 14 00 1f 80 9d 49 5c c5 18 35 a1 44 99 8e 79 6a c5 fc 98 9d 15 00 00 00 e6 00 00 00 64 00 3a 00 01 07 00 00 8b 36 1c 63 20 00 44 45 4c 4c 44 4f 7e 31 2e 4c 4e 4b 00 00 48 00 03 00 04 00 ef be 8b 36 1c 63 a7 3e 3b 52 14 00 00 00 44 00 65 00 6c 00 6c 00 20 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 43 00 65 00 6e 00 74 00 65 00 72 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 15 00 00 00 32 01 00 00 5a 00 3a 00 42 06 00 00 8e 36 04 0d 20 00 4d 4f 5a 49 4c 4c 7e 31 2e 4c 4e 4b 00 00 3e 00 03 00 04 00 ef be 8e 36 04 0d a7 3e e8 51 14 00 00 00 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 20 00 46 00 69 00 72 00 65 00 66 00 6f 00 78 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 15 00 00 00 7e 01 00 00 46 00 3a 00 c4 06 00 00 92 36 c8 98 20 00 57 69 6e 5a 69 70 2e 6c 6e 6b 00 00 2c (REG_BINARY)

"ScrollPos1280x960(2).x"= 0x0000000000 (0)

"ScrollPos1280x960(2).y"= 0x0000000000 (0)

"ItemPos1280x960(2)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 15 00 00 00 4f 00 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d 15 00 00 00 9c 00 00 00 14 00 1f 80 9d 49 5c c5 18 35 a1 44 99 8e 79 6a c5 fc 98 9d 15 00 00 00 e9 00 00 00 64 00 3a 00 01 07 00 00 8b 36 1c 63 20 00 44 45 4c 4c 44 4f 7e 31 2e 4c 4e 4b 00 00 48 00 03 00 04 00 ef be 8b 36 1c 63 84 3e e8 63 14 00 00 00 44 00 65 00 6c 00 6c 00 20 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 43 00 65 00 6e 00 74 00 65 00 72 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 15 00 00 00 36 01 00 00 5a 00 3a 00 42 06 00 00 8e 36 04 0d 20 00 4d 4f 5a 49 4c 4c 7e 31 2e 4c 4e 4b 00 00 3e 00 03 00 04 00 ef be 8e 36 04 0d 84 3e 22 64 14 00 00 00 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 20 00 46 00 69 00 72 00 65 00 66 00 6f 00 78 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 15 00 00 00 83 01 00 00 46 00 3a 00 c4 06 00 00 92 36 c8 98 20 00 57 69 6e 5a 69 70 2e 6c 6e 6b 00 00 2c (REG_BINARY)

"ScrollPos1600x1200(2).x"= 0x0000000000 (0)

"ScrollPos1600x1200(2).y"= 0x0000000000 (0)

"ItemPos1600x1200(2)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 00 00 02 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 16 00 00 00 50 00 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d 16 00 00 00 9e 00 00 00 14 00 1f 80 9d 49 5c c5 18 35 a1 44 99 8e 79 6a c5 fc 98 9d 16 00 00 00 ec 00 00 00 64 00 3a 00 01 07 00 00 8b 36 1c 63 20 00 44 45 4c 4c 44 4f 7e 31 2e 4c 4e 4b 00 00 48 00 03 00 04 00 ef be 8b 36 1c 63 b6 3e 79 31 14 00 00 00 44 00 65 00 6c 00 6c 00 20 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 43 00 65 00 6e 00 74 00 65 00 72 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 16 00 00 00 3a 01 00 00 5a 00 3a 00 42 06 00 00 8e 36 04 0d 20 00 4d 4f 5a 49 4c 4c 7e 31 2e 4c 4e 4b 00 00 3e 00 03 00 04 00 ef be 8e 36 04 0d b6 3e 44 73 14 00 00 00 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 20 00 46 00 69 00 72 00 65 00 66 00 6f 00 78 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 16 00 00 00 88 01 00 00 46 00 3a 00 c4 06 00 00 92 36 c8 98 20 00 57 69 6e 5a 69 70 2e 6c 6e 6b 00 00 2c (REG_BINARY)

"ScrollPos1280x768(2).x"= 0x0000000000 (0)

"ScrollPos1280x768(2).y"= 0x0000000000 (0)

"ItemPos1280x768(2)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 15 00 00 00 54 00 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d 15 00 00 00 a6 00 00 00 14 00 1f 80 9d 49 5c c5 18 35 a1 44 99 8e 79 6a c5 fc 98 9d 15 00 00 00 f8 00 00 00 64 00 3a 00 01 07 00 00 8b 36 1c 63 20 00 44 45 4c 4c 44 4f 7e 31 2e 4c 4e 4b 00 00 48 00 03 00 04 00 ef be 8b 36 1c 63 b2 3e 15 08 14 00 00 00 44 00 65 00 6c 00 6c 00 20 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 43 00 65 00 6e 00 74 00 65 00 72 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 15 00 00 00 4a 01 00 00 5a 00 3a 00 42 06 00 00 8e 36 04 0d 20 00 4d 4f 5a 49 4c 4c 7e 31 2e 4c 4e 4b 00 00 3e 00 03 00 04 00 ef be 8e 36 04 0d b2 3e 75 5e 14 00 00 00 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 20 00 46 00 69 00 72 00 65 00 66 00 6f 00 78 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 15 00 00 00 9c 01 00 00 46 00 3a 00 c4 06 00 00 92 36 c8 98 20 00 57 69 6e 5a 69 70 2e 6c 6e 6b 00 00 2c (REG_BINARY)

"ScrollPos1360x768(2).x"= 0x0000000000 (0)

"ScrollPos1360x768(2).y"= 0x0000000000 (0)

"ItemPos1360x768(2)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 15 00 00 00 54 00 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d 15 00 00 00 a6 00 00 00 14 00 1f 80 9d 49 5c c5 18 35 a1 44 99 8e 79 6a c5 fc 98 9d 15 00 00 00 f8 00 00 00 56 00 3a 00 fe 06 00 00 15 37 14 60 20 00 41 44 2d 41 57 41 7e 31 2e 4c 4e 4b 00 00 3a 00 03 00 04 00 ef be 15 37 14 60 d3 3e 45 a1 14 00 00 00 41 00 64 00 2d 00 41 00 77 00 61 00 72 00 65 00 20 00 32 00 30 00 30 00 37 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 15 00 00 00 4a 01 00 00 58 00 3a 00 c1 06 00 00 7c 3a 45 bc 20 00 41 44 4f 42 45 52 7e 31 2e 4c 4e 4b 00 00 3c 00 03 00 04 00 ef be 35 3a cf 46 d3 3e 4f 54 14 00 00 00 41 00 64 00 6f 00 62 00 65 00 20 00 52 00 65 00 61 00 64 00 65 00 72 00 20 00 38 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 15 00 00 00 9c 01 00 00 56 00 3a 00 fe 06 00 00 15 37 14 60 20 00 41 44 2d 57 41 54 7e 31 2e 4c 4e 4b 00 00 3a 00 03 00 04 00 ef be 15 37 14 60 d3 3e 45 (REG_BINARY)

"ItemPos1680x1050(2)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 24 02 00 00 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 16 00 00 00 02 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 16 00 00 00 50 00 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d 16 00 00 00 9e 00 00 00 58 00 3a 00 c1 06 00 00 7c 3a 45 bc 20 00 41 44 4f 42 45 52 7e 31 2e 4c 4e 4b 00 00 3c 00 03 00 04 00 ef be 35 3a cf 46 7e 42 a5 00 14 00 00 00 41 00 64 00 6f 00 62 00 65 00 20 00 52 00 65 00 61 00 64 00 65 00 72 00 20 00 38 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 16 00 00 00 ec 00 00 00 5a 00 3a 00 f4 02 00 00 79 3e 6a 56 20 00 41 4f 4c 44 45 53 7e 32 2e 4c 4e 4b 00 00 3e 00 03 00 04 00 ef be 8d 36 54 bf 7e 42 92 04 14 00 00 00 41 00 4f 00 4c 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 20 00 39 00 2e 00 36 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 46 01 00 00 02 00 00 00 66 00 3a 00 99 06 00 00 7c 42 3b 55 20 00 41 56 41 53 54 21 7e 31 2e 4c 4e 4b 00 00 4a 00 03 00 04 00 ef be 7c 42 3b (REG_BINARY)

"ItemPos1680x1050(1)"=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 00 00 00 02 00 00 00 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 16 00 00 00 4d 00 00 00 14 00 1f 60 40 f0 5f 64 81 50 1b 10 9f 08 00 aa 00 2f 95 4e 16 00 00 00 98 00 00 00 14 00 1f 68 80 53 1c 87 a0 42 69 10 a2 ea 08 00 2b 30 30 9d 16 00 00 00 e3 00 00 00 58 00 3a 00 c1 06 00 00 7c 3a 45 bc 20 00 41 44 4f 42 45 52 7e 31 2e 4c 4e 4b 00 00 3c 00 03 00 04 00 ef be 35 3a cf 46 86 42 8d a4 14 00 00 00 41 00 64 00 6f 00 62 00 65 00 20 00 52 00 65 00 61 00 64 00 65 00 72 00 20 00 38 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 16 00 00 00 2e 01 00 00 5a 00 3a 00 f4 02 00 00 79 3e 6a 56 20 00 41 4f 4c 44 45 53 7e 32 2e 4c 4e 4b 00 00 3e 00 03 00 04 00 ef be 8d 36 54 bf 86 42 8d a4 14 00 00 00 41 00 4f 00 4c 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 20 00 39 00 2e 00 36 00 2e 00 6c 00 6e 00 6b 00 00 00 1c 00 16 00 00 00 79 01 00 00 66 00 3a 00 99 06 00 00 7c 42 3b 55 20 00 41 56 41 53 54 21 7e 31 2e 4c 4e 4b 00 00 4a 00 03 00 04 00 ef be 7c 42 3b (REG_BINARY)

"ScrollPos1600x900(1).x"= 0x0000000000 (0)

"ScrollPos1600x900(1).y"= 0x0000000000 (0)

-= EOF =-

[Maurice Naggar]

On the MBAM issue, do this:

try installing the latest VB6 runtime files from Microsoft and install them to see if that fixes it.

You will find them here http://www.microsoft.com/downloads/details.aspx?FamilyId=25437D98-51D0-41C1-BB14-64662F5F62FE&displaylang=en

Then when installed, give 1 more try to MBAM setup {just run the setup exe for mbam }.

[kstmommy]

Installed files, still got same error...

Ran MBAM cleaner - reinstalled from setup.exe - same error

[Maurice Naggar]

Instead of simply stating "same error" ....I'd appreciate having the verbatim error message each time - every time.

Do you mean you got the 372 run time ???

Can you start your Avast and run a scan? if so, what is the result?

[Maurice Naggar]

Part 2. In addition to the post just above.

Please do the following and let me know what the result is:

• Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):
  

  
  regsvr32 "%programfiles%\Malwarebytes' Anti-Malware\mbamext.dll"
  regsvr32 "%programfiles%\Malwarebytes' Anti-Malware\ssubtmr6.dll"
  regsvr32 "%programfiles%\Malwarebytes' Anti-Malware\vbalsgrid6.ocx"
  

  
  

• Once you've done that click on File and select Save As...
  
• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file MBAM Fix.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it on XP.
  
• Click OK to each of the 3 dialog boxes that should show a success message for each file registered.