[SweetTech]

While I'm looking over your logs please download the program below to see if it allows you to uninstall Adobe Reader.

RevoUninstaller
Download and install Revo Uninstaller

• Double click the Revo Uninstaller icon on your desktop to start the program
• Scroll through the listed programs and Right Click on the program you wish to uninstall
• From the pop out menu choose Uninstall
• Click Yes to the confirmation dialogue
• In the next window select the Advanced mode
• Click Next to start uninstalling the program
• Answer Yes to confirm the uninstall
• When the program has completed the four steps, click Next to allow the program to search for leftovers
• Once complete, click Next, then Finish
• Repeat the above steps for any other programs you wish to remove.

[Advertisements]

Success! Adobe 2.0 has been uninstalled. I have also decided to go with Foxit Reader for now and not use Adobe at all.

[Braind]

Success! Adobe 2.0 has been uninstalled. I have also decided to go with Foxit Reader for now and not use Adobe at all.

[SweetTech]

OTL Fix

We need to run an OTL Fix

• Please reopen on your desktop.
• Copy and Paste the following code into the textbox. Do not include the word "Code"
  
  

  :Services
  :OTL
  O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
  O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
  O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
  O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
  O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
  O7 - HKU\S-1-5-21-1413038736-614172877-2008263415-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O7 - HKU\S-1-5-21-1413038736-614172877-2008263415-500\Software\Policies\Microsoft\Internet Explorer\Recovery present
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Reg Error: Key error.)
  :Commands
  [emptytemp]
  [EMPTYFLASH]
  [start explorer]
  [Reboot]

• Push
• OTL may ask to reboot the machine. Please do so if asked.
• Click .
• A report will open. Copy and Paste that report in your next reply.

NEXT:



Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

• Open Malwarebytes' Anti-Malware
  
• Select the Update tab
  
• Click Check for Updates
  
• After the update have been completed, Select the Scanner tab.
  
• Select Perform quick scan, then click on Scan
  
• Leave the default options as it is and click on Start Scan
  
• When done, you will be prompted. Click OK, then click on Show Results
  
• Checked (ticked) all items and click on Remove Selected
  
• After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


NEXT:



Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The log that was produced after running the OTL fix.
3. The log that was produced after running the MalwareBytes' Anti-Malware scan.
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

[Braind]

1.) No questions at this time.

2.) OTL Fix Log

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery\ not found.
Registry delete failed. HKEY_USERS\S-1-5-21-1413038736-614172877-2008263415-500\Software\Policies\Microsoft\Internet Explorer\Control Panel\ scheduled to be deleted on reboot.
Registry key HKEY_USERS\S-1-5-21-1413038736-614172877-2008263415-500\Software\Policies\Microsoft\Internet Explorer\Recovery\ deleted successfully.
Starting removal of ActiveX control {D27CDB6E-AE6D-11CF-96B8-444553540000}
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\swflash.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 9752342 bytes
->Temporary Internet Files folder emptied: 11222730 bytes
->Java cache emptied: 117 bytes
->FireFox cache emptied: 45248148 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 4997 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 98516 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 456011 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 64.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.1.0 log created on 04072010_145240

Files\Folders moved on Reboot...
C:\Documents and Settings\Administrator\Local Settings\Temp\OLKRPCLOG_04_07_2010_14_43_19_1.etl moved successfully.
File\Folder C:\WINDOWS\temp\usgthrsvc\Perflib_Perfdata_ce4.dat not found!

Registry entries deleted on Reboot...
Registry key HKEY_USERS\S-1-5-21-1413038736-614172877-2008263415-500\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.


3.) Malwarebytes Log

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3967

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/7/2010 3:53:54 PM
mbam-log-2010-04-07 (15-53-54).txt

Scan type: Quick scan
Objects scanned: 106850
Time elapsed: 13 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


4.) Outlook 2003 seems to be working better; it has NOT closed by itself yet today. I was still getting about 50 emails daily directly in to my Deleted folder up until yesterday. So far, that has not happened yet today. There are no other changes to my PC.

[SweetTech]

Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall



NEXT:



OTL Clean-Up
Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.



NEXT:



All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  Strong passwords: How to create and use them then consider a password keeper, to keep all your passwords safe.
  
• Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an addon available for both Firefox and IE
• Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here
  
  • If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
    
    • NoScript - for blocking ads and other potential website attacks
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
• In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
  Think Prevention.
  PC Safety and Security--What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

[Braind]

Unfortunately my problem is NOT resolved. I am still having the exact same problem that we started with; the application error message I get every time I reboot. This also affects some programs, such as OTL when I open them.
Also, I still get 50 or more empty emails that go into my deleted file in Outlook 2003 for my hotmail email account.
I do use Foxfire and I couldn't agree with you more about that browser! it is much better than IE.Thanks for the other tips, I will use them as well.
Since I still have the issue we started with, it seems to me that it is not caused by malware, but rather the Reimage so called repair did something unpredictable, what do you think?

[Braind]

I forgot to mention that this problem I am having with my PC also prevents Spywareguard from opening. Spywareguard shows up in ALL PROGRAMS from the start button, but it won't open when I click on it.

[SweetTech]

Hello,

Please boot into Safe Mode and go ahead and uninstall SpywareGuard and Online Armor.

Then restart your computer back into Normal Mode and perform the following scan.

SFC ScanNow

Go to the Run box on the Start Menu and type in:

sfc /scannow

Make sure to include the space between the first "c" and the "/".

This will run the System File checker and it will scan for corrupt or missing files. It may prompt you to insert the CD if it needs to obtain files.

Please post back when it has finished letting me know what it has reported.

More info on this process can be found here.


Let me know how things are working after performing the following.

[Braind]

I did the SFC ScanNow and it froze my PC 14 minutes after it started. However, the exe message was gone after I rebooted. So, I reactivated some programs like Spyware Blaster and SpywareGuard and rebooted again.
The exe error message and all its problems returned!
So I uninstalled (used RevoUninstaller) Spyware Blaster and SpywareGuard, rebooted, did another SFC ScanNow, which froze my PC again after 14 minutes. I rebooted again and the exe message is gone. However, I now get a new error message:
Webpage error
Do you want to debug this page?
Line 108
Error: 'A21' is undefined

I get that same message three more time repeating the same information, EXCEPT the line number changes to 2576, then 2584, then 2591.

I tried to debug, which takes me to a script debug page. This debug fails because I get an error message saying that 'A21' is undefined.

SpywareGuard was on my PC when I used Reimage and I speculate that Reimage corrupted SpywareGuard and other Windows files to cause these problems. My PC freezes when I tried to enable all the protections on Spyware Blaster, so I uninstalled that program as well as SpywareGuard.

What do you think?

Edited by Braind, 09 April 2010 - 02:29 AM.

[Braind]

Latest update: The script errors no longer appear the last two times I rebooted. However, I now get a different error message that says:
TWC Desktop Error:
Unable to initialize "page"

There is an "ok" button to hit which I do, twice, and then it disappears.

Outlook 2003 still gets empty emails that go directly to my deleted file.

[SweetTech]

TWC Desktop Error:
Unable to initialize "page"

The error mentioned above seems to be caused by: The Weather Channel Desktop 6

This error message can most likely be fixed by uninstalling the program and then reinstalling it.

If it's not a program you use then you may want to consider uninstalling it and not reinstalling it.

I do agree with you on the fact that it's possible that reimage corrupted some of your programs and files.

[Braind]

Okay, I am no longer getting any error messages when I reboot.
However, I still have these problems:

1.) SFC ScanNow freezes my PC after 14 minutes of scanning and thus is unable to find and/or fix files and other problems.
2.) I can not use SpywareGuard after installing it without this recreating the exe problem that started this posting topic.
3.) I can not use Spyware Blaster after installing it without this recreating the exe problem that started this posting topic.
4.) Outlook 2003 still gets over 50 empty emails (there is virtually no information in these emails) per day, sometimes as many as 200 emails, that go directly into my deleted folder.

What can be done to correct these issues?

[SweetTech]

1. I'm still looking into this issue a little further.

2.+3. Could you please take a screenshot of the error message you are receiving with SpywareGuard?

Please take a screenshot of that window.

• You can do this by pressing the PrintScreen key.
• Then go to Start > All Programs > Accessories > Paint
• In Paint, go up to Edit > Paste
• Then Go up to File > Save As. Click the drop-down box to change the "Save As Type" to "JPEG", name it what you want, and save it where you want.
• Then click Reply in this topic.
  [*Scroll down to Attachments.
• Click the Browse button.
• Locate the file you just saved, click on it, then click Open.
• Click Upload and submit the reply.

4. I don't know what is going on with your Outlook 2003. I'm not very familiar with the program as I have only used it a few times which was a couple of years ago.

[Braind]

SpywareGuard, once I install it, and then reboot, this brings back the exe error I get that started this topic of all the posts we have done. Spyware actually shows it is running, but I can not open it. Thus, there is no error message to do a screen shot of.

Here is a recap of what started this topic:

Explorer.Exe Application Error
The instruction at "0x7342611a" referenced memory at "0x7342611a".
The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

-----

At this point, I can see all the desk top icons and the task bar. But, once I click on "OK", all the icons on the desk top screen and the task bar itself disappear for like 30 seconds. This comes back, except the (SpywareGuard)SG icon on the task bar does NOT reappear. My Process Manager indicates SG is actually running, but I am unable to open SpywareGuard.

On the other hand, when I click on "CANCEL", it would soon show the "DrWatson Postmortem Debugger" sign which basically asks to send the information to Microsoft because they couldn't really debug. There is also "debug" button on it. If I click on it, the cursor will freeze for more than 10-15 minutes (after that, I gave up and restarted the computer via Windows Task Manager). If I click on "don't send the report", then the same with above -- all the icons on the desk top screen and the task bar itself disappear for a while and then they reappear.

Did you want me to reinstall SpywareGuard and start the above all over again, then take a scree shot of that?
I can do that, but then I will need to uninstall SpywareGuard, do another SFC ScanNow (which freeezes after 14 minutes), and then reboot again.

Spyware Blaster will reactivate the previously described exe problem when I try to enable the middle option (of the three available). I belive this is the one for disks or files....I can't remember for sure because it is not installed on my PC any more. The fix for the exe problem would be the same as described for the SpywareGuard problem.

Please let me know how you would like for me to proceed.

[SweetTech]

Do you have your windows xp disc?