O. T. Malwarebytes issue:

[Buffalo]

"Paul" wrote in message news:[email protected]...

AdwCleaner is a two stage program (like some others). You click
the Scan button, then review the things shown on the screen. That's
when you would effectively be warned you might be about to remove
something important. You only click "Clean", when you're
absolutely sure what needs cleaning.

Paul

What caught my eye was when he mentioned that his SpywareBlaster program was
not working properly.
When I ran AdwCleaner on my PC, that was one of the programs that it wanted
to 'modify' along with some other 'features' of different programs that I
wanted.
I didn't let it do any cleaning.
So, just playing the odds, with absolutely no proof, I think AdwCleaner
might have caused some problems, perhaps different than the MBAM one.
Perhaps he just clicked CLEAN.

 

[magineer02]

Hello Paul,

This is what I've done:

I've tried to do two system restores on the 8200
and neither worked.

I appreciate you trying to educate me and I followed
some of it but some is over my head. Also my memory
isn't what it use to be because of my medical condition.

I did download the Kaspersky ISO Image of the Kaspersky
Rescue Disk 10, I then downloaded the Utility for recording
Kaspersky Rescue Disk 10 to USB devices.

When I tried to install it to my thumb drive gave me this:

Thoughts/suggestions?
Robert

 

[magineer02]

I was under the impression that AdwCleaner
only went after malware. Not programs and
toolbars and perhaps thats also the cause
the dull blimp sound I hear every time I
connect to the internet?

Robert

 

[magineer02]

Hello Paul,

I was able to install malwarebytes with
your instructions.

I ran a full scan afterwards which showed
(24) object detected!!! I deleted them and
this is the report:

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 515878
Time elapsed: 39 minute(s), 23 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 6
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0 (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\contentScripts (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.

Files Detected: 18
C:\Users\Rpbert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1BYIY4T6\SpeedUpMyPC-standalone-setup[1].exe (PUP.Optional.SpeedUpMyPC) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\background.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\icon.png (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\icon128.png (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\icon16.png (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\icon48.png (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\manifest.json (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\options.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\popup.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\js\background.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\js\options.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\background.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\settings.json (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\background.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\iframeHost.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\iframeHost.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\popup.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\contentScripts\contentScript.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.

(end)

It seems that Google Chrome is the culprit
which may or may not have been downloaded
with 7-Zip which was the other culprit when
I selected the large green arrow instead of
the small blue print from bleepingcomputer
for downoading AdwCleaner. Should I just
uninstall it since I never use it?

I ran another malwarebytes scan and it came
up clean but I think I should still uninstall
Google Chrome unless it would affect other
programs.

Also when I disconnected Avast and tried to
reconnect it says its still disconnected
although the status shows everything is normal?
I think it refers to other devices but its
strange that before it showed connected.
I don't have any other devices.


Robert

 

[Paul]

Hello Paul,

This is what I've done:

I've tried to do two system restores on the 8200
and neither worked.

I appreciate you trying to educate me and I followed
some of it but some is over my head. Also my memory
isn't what it use to be because of my medical condition.

I did download the Kaspersky ISO Image of the Kaspersky
Rescue Disk 10, I then downloaded the Utility for recording
Kaspersky Rescue Disk 10 to USB devices.

When I tried to install it to my thumb drive gave me this:

Thoughts/suggestions?
Robert

When I download the .iso right now, I get:

kav_rescue_10.iso
397,082,624 bytes for "Size:"

The problem is, they might update the file each
day or once a week, so it is pretty hard to compare
the file I got, to the one you got. I give the information
there, so you can see whether you got a complete download
or not. If your file has fewer bytes, maybe the
download did not finish or something. I don't think
there is any easy indicator on the file, as to what
version it is.

I can't find any source code for rescue2usb. It apparently
uses grub4dos, as part of its solution. But I would need
to see the code for the rescue2usb part, to understand
what it is stumbling on. The 378K tool you download,
it comes with a couple of files of its own, which it
uses. As well as copying some portion of the .iso to the
USB stick. I can't tell what is broken in your case.

It might be easier to just burn a CD.

*******

To get your own checksum utility, Microsoft offers one.
It does MD5 or SHA1. There are third-party graphical
ones you can get, but I don't know which one of those
to trust.

http://www.microsoft.com/en-us/download/details.aspx?id=11533

This download file is a self-extracting archive. The
"fciv.exe" is inside. Just click it, to unpack the file.

Windows-KB841290-x86-ENU.exe

You have to know how to execute commands in Command Prompt
to use it. I put both my kav_rescue_10 file and the fciv
file in the same folder, and then ran the command prompt
via that folder. Some MSDOS experience would provide you
with ideas on how to run stuff.

fciv -sha1 kav_rescue_10.iso

a6dad6954bea6b55aa1ec79656855de93df1e657 kav_rescue_10.iso

Now, if you got the same value as me, that would tend to
suggest your download was not corrupted. And burning the
CD would then be OK. The file size check is a start, but
a matching SHA1 is a pretty good indication they're the same
file.

*******

Your HP computers could have come with CD/DVD burning software.
So that would be one way to do it. I've used this one
on occasion.

Imgburn.

http://en.wikipedia.org/wiki/Imgburn

"Versions 2.5.1.0 on included optional Ask.com adware in
the installer, which was replaced in version 2.5.8.0 with
OpenCandy adware."

So the best option, would be to find a copy of 2.5.0.0,
and also to know it hasn't been modified. It turns out,
by some strange coincidence, that's the version I have here

Using archive.org, I can find the checksum for the file
when it was released.

https://web.archive.org/web/20090815083118/http://www.imgburn.com/index.php?act=download

ImgBurn v2.5.0.0 (2,119 KB)
Released: Sunday 26th July 2009

CRC32: 39CD6FC6
MD5: F3791CFACDAC03B9E676E44AA2630243
SHA-1: E07BCC23B495D0A966BAE359EA9E0E3A11888454

Then I go to oldversion.com and see what versions they've got.
I scroll down to the area with the versions all listed. Notice,
while you're here, how the file size balloons for the versions
with the adware inside them (2.5.1.0 or later).

http://www.oldversion.com/windows/imgburn/

ImgBurn 2.5.0.0 Jul 26, 2009 2.07 MB

On this pages, it's the "Download Now" button, not that
green "Download" button on the left And the legend
under the "Download Now", that says Free from Spyware,
Adware, and viruses, is obviously a falsehood, as you have
no problem downloading the boobytrapped 2.5.1.0 or later.

http://www.oldversion.com/windows/download/imgburn-2-5-0-0

The downloaded file is

2.5.0.0_SetupImgBurn_2.5.0.0.exe
2,169,915 bytes

When I run "fciv -sha1 2.5.0.0_SetupImgBurn_2.5.0.0.exe", I get

e07bcc23b495d0a966bae359ea9e0e3a11888454

which is the same as above (just uses lower case letters),
and proves my fresh download is the same file as left the
author's site in July 2009. I still don't know it's free
of PUPs, but at least nobody has added any additional PUPs to it.

Once installed, that tool has a screen that looks like this.

http://upload.wikimedia.org/wikipedia/en/0/0a/ImgBurn_screenshot.png

The "Write image file to disc" in the upper left, is the
button you want. I hope the tool will give you enough
prompting to get the job done.

Your first job after installation, is to visit Tools:Options
and click the "Sounds" tab. Turn *Off* the "Play Success Sounds"
and "Play Error Sounds". These sounds will scare you right
out of your chair, they are so loud.

In the Events tab, set "Check For Program Update" to "Never".
That's to avoid getting tricked into updating to the latest
version (with adware in it). Now, you're ready to burn your
CD. Good luck. I don't think I've ever bothered to adjust
the other settings.

So if the kav_rescue_10.iso file looks reasonable, you
could try burning a CD with it.

Paul

 

[Paul]

Hello Paul,

I was able to install malwarebytes with
your instructions.

I ran a full scan afterwards which showed
(24) object detected!!! I deleted them and
this is the report:

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 515878
Time elapsed: 39 minute(s), 23 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 6
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0 (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\contentScripts (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.

Files Detected: 18
C:\Users\Rpbert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1BYIY4T6\SpeedUpMyPC-standalone-setup[1].exe (PUP.Optional.SpeedUpMyPC) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\background.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\icon.png (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\icon128.png (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\icon16.png (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\icon48.png (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\manifest.json (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\options.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\popup.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\js\background.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\js\options.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\background.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\settings.json (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\background.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\iframeHost.html (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\iframeHost.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\popup.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.
C:\Users\Rpbert\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon\1.0.0_0\mam\scripts\contentScripts\contentScript.js (PUP.Optional.ValueApps) -> Quarantined and deleted successfully.

(end)

It seems that Google Chrome is the culprit
which may or may not have been downloaded
with 7-Zip which was the other culprit when
I selected the large green arrow instead of
the small blue print from bleepingcomputer
for downoading AdwCleaner. Should I just
uninstall it since I never use it?

I ran another malwarebytes scan and it came
up clean but I think I should still uninstall
Google Chrome unless it would affect other
programs.

Also when I disconnected Avast and tried to
reconnect it says its still disconnected
although the status shows everything is normal?
I think it refers to other devices but its
strange that before it showed connected.
I don't have any other devices.


Robert

Removing Google Chrome would be a start. It may not
actually "cure" anything, but maybe another scan
will tell you if it's still there.

I hope you haven't actually run "SpeedUpMyPC-standalone-setup.exe".
This is the kind of program that comes from a green
Download button Your PC is fast enough as it is.

A Google search shows lcnnhcneegeeojhgpfijnlnocjdmlaon
is associated with "Conduit". That's a bad one.
And for some reason, the log above calls it PUP.Optional.ValueApps,
so I don't know what to make of that (why it has two names).

*******

The comment at the top of this thread says:

http://www.cybertechhelp.com/forums/showthread.php?t=223492

"After running Malwarebytes and Adwcleaner I still can't
completely remove PUP.Optional.ValueApps.A."

The date of that posting is Jan.3/2014, rather recent, so
yours could be a similar situation. Now, if you scroll to
the bottom of that page, they use something called JRT.
You click the blue "Download Now @ Author's site" button.
*Not* that green button with the words "Sponsored Advertisement"
under it.

http://www.bleepingcomputer.com/download/junkware-removal-tool/

The web page will change and the URL will be this value.

http://www.bleepingcomputer.com/download/junkware-removal-tool/dl/131/

and a dialog box with "JRT.exe" will be offered to "Save File".

When I look inside that with 7ZIP, it's a bunch of scripts,
but I don't see anything specific for Conduit or the
ValueApps thing. Perhaps a more thorough search in each file
there, would indicate what it can detect. In any case, I
don't know if JRT actually did anything, or it was just
used in this case to scan and check whether it was
still there or not.

Try deleting your copy of Google Chrome from
Control Panel : Programs and Features, rescan and
see if you're clean or not. Reboot at least once,
and retest. Maybe that's all it will take. I hope
so.

Paul

 

[Buffalo]

"Buffalo" wrote in message news:[email protected]...

wrote in message

If AdwCleaner has a recover feature, I suggest you use it.
You can always try the Free version of SAS (SuperAntiBlaster).

Should have read SuperAntiSpyware and not SuperAntiBlaster.
[snip]

 

[magineer02]

Hello Paul,

I tried to install malwarebytes on the 8200
following your instructions as I did on the
8500. However it didn't work for the 8200.

It gave me a pop-up with this:

Setup:

CoCreateInstance failed; code 0x80040154
class not registered. and has an OK button.


I click OK and on the Setup/install Window
I see it changing 'creating shortcuts'.

then vbAccelerator SGrid II Control
run time error '0'

then Malwarebytes Anti-Malware
Run-time errror '440'
Automation error

Robert

 

[Paul]

Hello Paul,

I tried to install malwarebytes on the 8200
following your instructions as I did on the
8500. However it didn't work for the 8200.

It gave me a pop-up with this:

Setup:

CoCreateInstance failed; code 0x80040154
class not registered. and has an OK button.


I click OK and on the Setup/install Window
I see it changing 'creating shortcuts'.

then vbAccelerator SGrid II Control
run time error '0'

then Malwarebytes Anti-Malware
Run-time errror '440'
Automation error

Robert

I wasn't able to find any information for
vbAccelerator, so don't know what "440" means.
The MBAM-clean is the only option at this point,
and if it doesn't work, I don't have any other
tricks up my sleeve.

Paul

 

[Buffalo]

wrote in message

Hello Paul,

I tried to install malwarebytes on the 8200
following your instructions as I did on the
8500. However it didn't work for the 8200.

It gave me a pop-up with this:

Setup:

CoCreateInstance failed; code 0x80040154
class not registered. and has an OK button.


I click OK and on the Setup/install Window
I see it changing 'creating shortcuts'.

then vbAccelerator SGrid II Control
run time error '0'

then Malwarebytes Anti-Malware
Run-time errror '440'
Automation error

Rober

Try using SAS, as I suggested in an earlier post.
It is easy, free and quick to try, It also uninstalls pretty cleanly (esp if
you stop it from running when you do the uninstall).

 

[dora.smith.e]

I have a Dell Dimension 8200(Seagate

Barracuda 7200 HD 160Gb) with XP, SP3,

with Spywareblaster, Avast, Malwarebytes

and Windows firewall.





I tried to run malwarebytes but I received

run errors. So I uninstalled it and reinstalled

it from:



www.malwarebytes.org



but still get the same errors.



I also noticed that the underlined single click

icon's no longer function when I click them. I

have to right click them to open them whereas

before I just single clicked them.





Thoughts/Suggestions,

Robert

Sometimes it helps to download and install the variant install files for infected systems. Some viruses use registry entries to block installation of antivirus programs.

I once had a rootkit or something, and I couldn't install malwarebyte until I reinstalled Windows on a new hard drive.

 

[magineer02]

Isn't SuperAntiSpware the same as Spywareblaster?

Robert

 

[magineer02]

Your suggestion to reinstall Windows 7 Pro
on the 8500 and Windows XP on the 8500?


Dell only gave me (2) disks for Wondows 7 Pro:

Drivers and Utilities and Drivers and Documentation.
I have all the original disks for the 8200 but I had
to download and install onver 300 files to bring it
up to service pack 3. I don;t ever want to do that
again.

Robert

 

[Ken Blake, MVP]

Isn't SuperAntiSpware the same as Spywareblaster?

No. They are two very different programs.

 

[magineer02]

Hello Paul,

No, I haven't run 'SpeedUpMyPC', although I
have seen it pop up before, probably when I
when I initially tried to download AdwCleaner
and clicked the big green arrow instead of the small
blue print. You would think they would fix this so
that the download from bleepingcomputer is the
biggest thing you see, not the smallest.

I'll wager allot of people make the same mistake as
I did.

I saw the Junkware Removal Tool link for download
to remove Pup.Optional.ValueApps.

I ran the Junkware Removal Tool on the 8200 which
came up clean but it still will not install malwarebytes
however it did let me install AdwCleaner and I scanned
the computer and it found nothing.

I've run malwarebytes and Adware scans and the 8500
and it's clean.

Thoughts/suggestions?
Robert

 

[magineer02]

Hello Ken,

I remember you well, as you've
helped me in the past.

Should I load this as well then? I had
heard that having too many antivirus,
anti-malware programs etc would cause
conflicts.

Robert

 

[Buffalo]

wrote in message

Hello Ken,

I remember you well, as you've
helped me in the past.

Should I load this as well then? I had
heard that having too many antivirus,
anti-malware programs etc would cause
conflicts.

Robert

SAS (SuperAntiSpyware) and SpyWareBlaster are two entirely different
programs. I don't believe SypwareBlaster will interfere with any anti-virus
or anti-malware program. I use SpywareBlaster on both of my computers (XP
and Wn7 64bit). I use the pd version of SAS (running in real time) on my XP
laptop and the pd version of MBAM (running in real time) on my Win7 64bit
Desktop.
The free SAS and the free MBAM products are on-demand only type programs so
they will not interfere with each other as long as you only manually run one
at a time, which you should do.
Sounds like you are making headway.

 

[Nil]

Isn't SuperAntiSpware the same as Spywareblaster?

They have two different names because they are two different programs.

 

[Ken Blake, MVP]

Hello Ken,

I remember you well, as you've
helped me in the past.

Should I load this as well then? I had
heard that having too many antivirus,
anti-malware programs etc would cause
conflicts.

You should never have more than one anti-virus program running, but
anti-spyware programs are mostly a different story.

Regarding SAS and Spyware Blaster, first of all Spyware Blaster
doesn't run in the background the way other programs do. What it does
(quoted from their web site) is

"Multi-Angle Protection
Prevent the installation of ActiveX-based spyware and other
potentially unwanted programs.
Block spying / tracking via cookies.
Restrict the actions of potentially unwanted or dangerous web sites."


SAS is OK, but not as good as MalwareBytes AntiMalware. If it were me,
I would drop SAS and use Spyware Blaster and MalwareBytes AntiMalware.

 

[Paul]

Hello Paul,

No, I haven't run 'SpeedUpMyPC', although I
have seen it pop up before, probably when I
when I initially tried to download AdwCleaner
and clicked the big green arrow instead of the small
blue print. You would think they would fix this so
that the download from bleepingcomputer is the
biggest thing you see, not the smallest.

I'll wager allot of people make the same mistake as
I did.

I saw the Junkware Removal Tool link for download
to remove Pup.Optional.ValueApps.

I ran the Junkware Removal Tool on the 8200 which
came up clean but it still will not install malwarebytes
however it did let me install AdwCleaner and I scanned
the computer and it found nothing.

I've run malwarebytes and Adware scans and the 8500
and it's clean.

Thoughts/suggestions?
Robert

OK, when you attempt to install MBAM, does it fail
the same way as the other computer. Is it still
a vbAccelerator error, when MBAM actually starts to run ?

Otherwise, it sounds like things are a little better
now where you are.

Paul