BleepingComputer.com: Taskbar gone, 372 Malwarebytes error, etc...Need help ASAP!

There seems to be whole lot of things wrong with my computer. Here they are:

1. First thing is that I no longer have a taskbar or start menu (though all my desktop icons are there).

2. Next is when I run Malwarebytes software I get the 372 error (vbalsgrid6.ocx error message)...I can't run it in Safe Mode as well. I tried running SuperAntiSpyware but nothing happnens there as well...it seems to startup initially, but then because it docks on the taskbar I can't activate it.

3. Also my search function is no longer working. "My Computer" icon is gone from my desktop (I have to open up the Trash folder to get into My Computer). When I try to download any other file (such as virus software, etc.) Firefox hangs and shows the "Not responding" so I have to shut it down.

By the way I run Windows XP Professional SP2. I think I might be infected with some trojan virus. I can't install HJThis since it tells me windows installer service could not be accessed.

Can someone help me out on how to go about fixing this issue? Thanks.

This post has been edited by Orange Blossom: 16 June 2010 - 07:09 PM
Reason for edit: Move to AII as no logs posted and prep. guide not followed. ~ OB

Hello and welcome.

Run-time error '372':Failed to load control 'vbalGrid' from vbalsgrid6.ocx. Your version of vbalsgrid6.ocx may be outdated. Make sure you are using the version of the control that was provided with your application.

Download MSFT Visual Basic from here
http://www.microsoft.com/downloads/details...;displaylang=en

Instructions

Before starting the download, create a download directory on your computer. If your internet connection is less than 300K, it is recommended that you run the multi-part download by following the "More Information" link at the upper right, then clicking "Download Now."

Click "Download" to begin downloading the single download. When prompted by the download software, choose the option "Save this program to disk" and click OK. Then select the directory you created on your computer.

Run the file from the download directory. When prompted, select the same directory you created on your computer. You will be expanding the contents of the EXE into this directory.

Run SetupSP6.exe from the download directory. When you accept the terms of the electronic End User License Agreement (EULA) the setup software will replace the appropriate files in your Visual Basic 6.0 installation.

If good run MBAM and post back the log..
We can fix the other iisue also..
SFC

Please run System File Checker sfc /scannow... For more information on this tool see How To Use Sfc.exe

To Repair System Files

NOTE for Vista users..The command needs to be run from an elevated Command Prompt.
Click Start, type cmd into the Start/Search box,
right-click cmd.exe in the list above and select 'Run as Administrator'


You will need your operating system CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the XP CD when asked.


We also want to run these.. You may need to run these to even get the others to work if they didn't.


Next run ATF and SAS: If you cannot access Safe Mode,run in normal ,but let me know.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware

, Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you

should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now.

Hi,

I have exactly the same problem. I have hunted around the registry, as some atricles have suggested, looking for debugger entries for explorer.exe - to no avail. I downloaded the VB6 stuff, tried the v6setup but I got a message saying the installation was not successful. I ran SAS in safe mode and it found a problem in the registry with HKLM\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon. Quarantined that and rebooted. However the problem still remains.

I'm on XP, SP3. It all started when Malwarebytes reported some malware in the system information area. I removed that and rebooted and have had the problems with vbalsgrid6.ocx, no task bar, etc. ever since. It took out all my system restore information so I can't restore to a previous state.

Any ideas?

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/27/2011 at 03:02 PM

Application Version : 4.50.1002

Core Rules Database Version : 6683
Trace Rules Database Version: 4495

Scan type : Complete Scan
Total Scan Time : 01:43:05

Memory items scanned : 206
Memory threats detected : 0
Registry items scanned : 5433
Registry threats detected : 1
File items scanned : 42276
File threats detected : 0

Malware.Trace
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON#SHELL

Thanks, Brad

This post has been edited by edelman_b: 27 March 2011 - 03:02 AM

Hi edelman. We should see if we can run DRWeb. This can be long.

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet.
alternate download link
Note: The file will be randomly named (i.e. 5mkuvc4z.exe).

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:

• Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version
  
• Read the anti-virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
  
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
  
• If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
  
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)

• After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
  
• In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
  
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
  
• Please be patient as this scan could take a long time to complete.
  
• When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
  
• Click Select All, then choose Cure > Move incurable.
  
• In the top menu, click file and choose save report list.
  
• Save the DrWeb.csv report to your desktop.
  
• Exit Dr.Web Cureit when done.
  
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

Thanks for your response boopme.

Ran DrWeb as instructed. Express scan found nothing. Complete scan turned up one item. csv file below. Rebooted, no improvement, still same situation.

POSTOOBE.NEC;C:\DRIVERS;VBS.Generic.278;Deleted.;

The log file wass massive, tail end below.

=============================================================================
Total session statistics
=============================================================================
Scanned: 125491
Infected: 1
Modifications: 0
Suspicious: 0
Adware: 0
Dialers: 0
Jokes: 0
Riskware: 0
Hacktools: 0
Cured: 0
Deleted: 1
Renamed: 0
Moved: 0
Ignored: 0
Scan speed: 188 Kb/s
Scan time: 4:15:29
=============================================================================

Brad

Running SFC did not fix the Taskbar?

Your version of vbalsgrid6.ocx may be outdated. Make sure you are using the version of the control that was provided with your application.

Download MSFT Visual Basic from here
http://www.microsoft.com/downloads/details.aspx?familyid=9EF9BF70-DFE1-42A1-A4C8-39718C7E381D&displaylang=en

Instructions


Before starting the download, create a download directory on your computer. If your internet connection is less than 300K, it is recommended that you run the multi-part download by following the "More Information" link at the upper right, then clicking "Download Now."

Click "Download" to begin downloading the single download. When prompted by the download software, choose the option "Save this program to disk" and click OK. Then select the directory you created on your computer.

Run the file from the download directory. When prompted, select the same directory you created on your computer. You will be expanding the contents of the EXE into this directory.

Run SetupSP6.exe from the download directory. When you accept the terms of the electronic End User License Agreement (EULA) the setup software will replace the appropriate files in your Visual Basic 6.0 installation.

Try MBAM again,

Hi boopme,

I haven't tried running SFC since, will try tonight my time. Trouble is I don't have an operating system CD, just XP install in the I386 folder.
I have the Visual Basic 6.0 installation downloaded, will try that again and then MBAM.

Thanks for your help, Brad

Hi Brad; this is another option.

Try the fix at Kelly's Korner.

Restore Desktop Icons and Taskbar - #195 on the right.

Right click on it and save the .vbs file to your desktop. Then, double click on the file icon (on your desktop) to run the script. You may need to reboot your computer for the changes to take affect.

First you MUST BACK UP the registry. This step involves making changes in the registry. Always back up your registry before making any changes.

Go to Start » Run and type: regedit
Click OK.
On the left side, click to highlight My Computer at the top.
Go up to File » Export
Make sure in that window there is a tick next to "All" under Export Branch.
Leave the "Save As Type" as "Registration Files".
Under "Filename" put RegBackup.
Choose to save it to C:\
Click save and then go to File » Exit.

Or you can download and use ERUNT which is an excellent free tool that allows you to to take a snapshot (backup) of your registry before making changes and restore it when needed.

Hi boopme,

No progress.

Ran SFC - it didn't find any files that needed fixing.
Ran SetupSP6.exe and got:

Visual Studio 6.0 Service Pack Setup was not completed successfully.

Ran MBAM - same 372 error about vbalsgrid.ocx.

Backed up the registry and ran the script from Kelly's Korner. There was no output, not sure it even ran. I rebooted and no change.

Brad

Sorry we lost internet yesterday.
We need a deeper look. Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.

Ran DeFogger, it didn't seem to detect any CD emulation.
Ran DDS.
Ran GMER. The initial scan didn't find anything but I ran the full scan anyway.
Created a new malware removal request, title Taskbar gone, 372 Malwarebytes error, etc. and included logs from DDS and GMER.
Hopefully the logs will show something.

This will work.
Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRL Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.