[Liv Scott]

Okay so Internet Explorer still won't download, so I'll run ComboFix with that code again tomorrow (that's what you mean by exporting the HKEY, yes?)

[Advertisements]

No don't run Combofix again.

Open the Registry Editor by clicking the Start button Picture of the Start button, typing regedit into the search box, and then pressing Enter.‌ Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

Locate and click the key or subkey that you want to back up. Click on HKEY_LOCAL_MACHINE\SOFTWARE
right click and then click Export.

In the Save in box, select the location where you want to save the backup copy to (your desktop), and then type a name for the backup file in the File name box. Let's call it softreg

Click Save.

This should create a file fullreg.reg on your desktop. Right click on it and select Add To fullreg.rar. Then attach softreg.rar to an email.

[RKinner]

No don't run Combofix again.

Open the Registry Editor by clicking the Start button Picture of the Start button, typing regedit into the search box, and then pressing Enter.‌ Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

Locate and click the key or subkey that you want to back up. Click on HKEY_LOCAL_MACHINE\SOFTWARE
right click and then click Export.

In the Save in box, select the location where you want to save the backup copy to (your desktop), and then type a name for the backup file in the File name box. Let's call it softreg

Click Save.

This should create a file fullreg.reg on your desktop. Right click on it and select Add To fullreg.rar. Then attach softreg.rar to an email.

[Liv Scott]

Oh okay! I'm a bit confused though-when I clicked add to fullreg.rar, it created fullreg.rar, I had to do another compression of softreg.reg to get softreg.rar, which one should I send you?

[RKinner]

softreg.rar

[RKinner]

Haven't forgotten you. I found something strange in your log but since I don't have a 64 bit system I have had to ask one my G2G colleagues to check it for me. Waiting to hear from him.

[RKinner]

Get RegSeeker

http://www.hoverdesk.net/

The downloads are at the bottom. I would use the bottom one where it says RegSeeker Portable 2.4 (.zip No installation. Just unzip in any folder)

http://www.hoverdesk...egSeeker24p.zip

(as we do not want the Baylon toolbar and there is no need to really install the program)

Download and Save to your desktop then right click on the downloaded zip file and Extract All. Extract. This will create a folder Regseeker24p. Inside it will be another Regseeker24p folder and in that will be the regseeker.exe which you need to right click on and Run As Administrator. Select Find in Registry.

Copy (Highlight and Ctrl + c) the following:

56FFCC30-D398-11D0-B2AE-00A0C908FA49

Move to the regseeker Search For: box and
Paste (Ctrl + v)

(You can just type 56FFCC30-D398-11D0-B2AE-00A0C908FA49
in the Search For: box if you are very careful to make sure you have it right.)

Then click on Search! to the right of the box. It will take a few minutes to finish. When it finishes select All of the results by holding down the Ctrl Key and left clicking on each item. Then hit Action at the bottom and select Export Selected Items. A window will come up which will let you change the name of the export. Change it to junk and hit OK. Then close regseeker and look in the same folder where regseeker.exe lives. There should be a folder called Backup. You should find junk.reg in the Backup folder. Right click on it and Edit then copy and paste the text into a reply.

[Liv Scott]

No worries! I figured you were busy! And oh wow, thank you so much!!

[Liv Scott]

This is why I shouldn't do things when I'm tired-I accidentally merged the file instead of copying it! Did I screw things up? Here's the reg file!

REGEDIT4
[HKEY_CLASSES_ROOT\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}]
[HKEY_CLASSES_ROOT\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}]
[HKEY_CLASSES_ROOT\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}]
"409"="MS Office Antivirus"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum]
"Implementing"=hex:1C,00,00,00,01,00,00,00,DD,07,02,00,00,00,18,00,07,00,34,00,06,00,44,03,01,00,\
00,00,9C,3D,37,04,D8,5E,F2,44,BA,00,78,95,D6,A5,A2,DA
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum]
"Implementing"=hex:1C,00,00,00,01,00,00,00,DC,07,0C,00,05,00,1C,00,05,00,24,00,29,00,B1,02,01,00,\
00,00,1E,76,81,27,E0,28,09,41,99,FE,B9,D1,27,C5,7A,FE
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF"=hex:01,00,00,00,00,00,00,00,00,E1,66,F6,F6,05,CB,01
"{04373D9C-5ED8-44F2-BA00-7895D6A5A2DA} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF"=hex:01,00,00,00,00,00,00,00,EB,54,DC,C3,B2,12,CB,01

[RKinner]

No, that didn't hurt anything since the Merge just replaced the keys with what is already there.

I think this may be the key to fixing this. Attached is a file lixfix.reg. Download and Save it then right click on it and Merge it.

Reboot and try your download. If it screws up things you can go back to the way things were by merging junk.reg.

[Liv Scott]

Okay so I downloaded lixfix.reg, merged, and rebooted, but I still got the same error message. So I merged junk.reg and rebooted again after that

[RKinner]

Since it didn't break anything: Go back and merge lixfit.reg again. Then run Regseeker and have it look for 56FFCC30-D398-11D0-B2AE-00A0C908FA49 again. Does it find it anywhere?

Also have it look for AVG. Does it find anything?

[Liv Scott]

Alright here's the second search, I labeled it junk2. I also did the AVG search, but the file is huge, should I still copy/paste it? It looks like AVG10 is definitely still there somehow

REGEDIT4
[HKEY_CLASSES_ROOT\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}]
[HKEY_CLASSES_ROOT\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum]
"Implementing"=hex:1C,00,00,00,01,00,00,00,DD,07,02,00,00,00,18,00,07,00,34,00,06,00,44,03,01,00,\
00,00,9C,3D,37,04,D8,5E,F2,44,BA,00,78,95,D6,A5,A2,DA

Edited by Liv Scott, 02 March 2013 - 01:13 PM.

[RKinner]

Perhaps it would be better to attach the avg file.

If the forum doesn't like the .reg just change it to .txt

Can you run Regseeker again and have it look for {56FFCC30-D398-11D0-B2AE-00A0C908FA49} again? This time right click on each of these and Delete:

[HKEY_CLASSES_ROOT\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49}]

[HKEY_CLASSES_ROOT\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}]

Also have it look for: {2781761E-28E0-4109-99FE-B9D127C57AFE} and attach the results.

[Liv Scott]

Here are the AVG file and the other one for {2781761E-28E0-4109-99FE-B9D127C57AFE}! It wouldn't let me attach it as a reg file so I converted it to rar.

Attached Files

•  AVG search 3-2-13.rar   128.98KB   166 downloads
•  2781761E-28E0-4109-99FE-B9D127C57AFE search on 3-05-13-12.23.47 PM.rar   565bytes   172 downloads

[RKinner]

A lot of what the AVG search found was from something else or doesn't really matter but I did find several entries that we can get rid of. Download the attached lixfix2.reg and save it then right click and Merge it.

Then reboot and try another download.