Jump to content

MBAM Runtime error 372 - help please


Recommended Posts

As far as I can trace, one of the kids clicked on a free internet 'scan my PC now' button and whammo the laptop is (I assume) infected. We are running XP Pro SP3. Symptoms are;

- now takes about 40 mins to boot and 5 mins to respond to any mouse / key click.

- eventually can see desktop but no taskbar

- tried to run MBAM off the desktop and I get the message " Runtime error '372'. Failed to load control 'vbalGrid' from vbalsgrid6.ocx. Your version of vbalsgrid6.ocx may be outdated. Make sure you are using the version of the control that was provided with your application".

- Internet will not start

- I downloaded HijackThis onto a clean PC and took it to the infected laptop on a memory stick. I manage to run it via TaskMgr and it showed a screen report for a few secs. Then taskmgr said 'Program not responding' and it disappeared. I can't find a logfile anywhere so I assume it didn't finish running?

- I have tried copying and pasting HiJackThis from my memory stick to C drive but I can't paste it?

I have read many posts on a similar subject and McAfee seems to have caused some probs with a bad update file? For info, our laptop doesn't run McAfee. I think I have also noticed mentions of a missing 'svchost.exe' file - I've looked in c:/windows/system32 and the file appears to be there and unchanged since 2006.

I hope this is enough info for someone to help. Many thanks

Steve Jones

Link to post
Share on other sites

  • Replies 103
  • Created
  • Last Reply

Top Posters In This Topic

Thanks again - will try this in morning (working tonight). As a matter of interest, when the laptop boots it shows a warning screen about not starting successfully (suspected hardware change and other bits mentioned) and it offers to start in safe mode, last known good config, normal startup. I tried all the options but I don't think I allowed enough time for the super slow running so not much appeared to happen. But I do recall that in Safe Mode I got a 'blank' screen with safe mode written in each corner - I thought Safe Mode gave you a screen similar to normal startup but with basic graphics?

I do know that Cntrl / Alt / Delete works to access TaskMgr so I can try your other suggestion.

Cheers

Steve Jones

Link to post
Share on other sites

Please do the following:

  • Please open Malwarebytes' Anti-Malware and click on the Settings tab
  • Click on the Scanner Settings tab
  • Uncheck Enable advanced heuristics engine. (Heurisitcs.Shuriken)
  • Try another scan and see if the issue is now corrected or not

Let me know how it goes.

Link to post
Share on other sites

No sorry - tried that. HiJackThis seemed to start and produced a listing on screen but this disappeared after about 5 seconds - couldn't find a logfile anywhere so I assumed it hadn't completed it's job? I've been reading other posts at length and when I get back to the laptop I was thinking of trying re-naming MBAM and/or HiJackThis as winlogon.exe? I believe this is a filename that malware might allow to run? Is it worth a try?

Link to post
Share on other sites

No sorry - tried that. HiJackThis seemed to start and produced a listing on screen but this disappeared after about 5 seconds - couldn't find a logfile anywhere so I assumed it hadn't completed it's job? I've been reading other posts at length and when I get back to the laptop I was thinking of trying re-naming MBAM and/or HiJackThis as winlogon.exe? I believe this is a filename that malware might allow to run? Is it worth a try?
Sure :D
Link to post
Share on other sites

OK I have now renamed MBAM, HiJackTHis, Combofix and OTL to winlogon.exe, and tried to run them from a memory stick. Nothing works - HiJackThis ran for a couple of seconds longer than before but then stopped. Iam planning to try to locate email addresses by using TaskMgr - can you suggest what prog I need to try to run so Outlook Express will start, and where I will find it? If I can get these important details off the PC I am planning a re-install of Windows. Unless you can thing of anything else to try?

I am really frustrated that it has come to this. This site has always impressed me with it's malware beating tactics and I don't recall seeing you guys beaten before - have I been infected by a new more powerful virus?

Thanks for all your efforts!

Steve Jones

Link to post
Share on other sites

Download OTL to your desktop.

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Custom Scan box paste this in:
    netsvcs
    drivers32 /all
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
    %systemroot%\system32\*.wt
    %systemroot%\system32\*.ruy
    %systemroot%\Fonts\*.com
    %systemroot%\system32\spool\prtprocs\w32x86\*.tmp
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\system32\user32.dll /md5
    %systemroot%\system32\ws2_32.dll /md5
    %systemroot%\system32\ws2help.dll /md5
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and include them in your next post.

Please include the following in your next post using Copy/Paste

  • OTL and Extras logs

Link to post
Share on other sites

1. Click Start, and then click Control Panel.

2. Double-click Display, click the Desktop tab, and then click Customize Desktop.

3. Select Restore Defaults

Also Right Click on the Desktop and select Properties > Arrange Icons By = Make sure there's only a Check mark or Tick by: Align To Grid and Show desktop Icons

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.