177 replies to this topic

[oldman960]

Hi lthsinc,

Windows should have created the restore point before attempting the install.

"Runtime Error!
Program: C:\P...

I was hoping you could have found the Event log related to this error. It may have been helpful knowing which program errorred out.

You can zip the log and attach it.

[lthsinc]

There wasn't a restore point, because I don't think it got that far. The program took a few minutes extracting all the files, but before beginning the install, gave that Setup error message, "The file or directory is corrupted and unreadable.", and then, "Installation did not complete.". And when previously trying to install from the auto updates in Windows, it would just say that the update could not be installed. If there is any other place I can look to send you info, just let me know. I've attached the zipped log from MSInstaller, but there was not error log or info regarding the Microsoft Visual C ++ Runtime Library error message. It keeps coming up randomly, seems as though usually when opening almost anything, but even just by itself.

Attached Files

•  MSInstaller_log.ZIP   111.69KB   167 downloads

[oldman960]

Hi lthsinc, Let me go through this thread and see if we may have missed anything. Thanks for your patience.

[lthsinc]

No worries, thanks for your help.

[oldman960]

Hi lthsinc,

Thanks for the detailed explaination of how the SP3 attempt went. Perhaps the download was actually corrupted. Is it possible to download the SP on a different computer that uses a different antivirus program and sve it to a CD? Not saying McAfee is a problem, just trying to determine why you would recieve a corrrupted message.

That log was from a failed install of an update for .NET Framework 1.1 not from the attempt to install SP3.

Have you tried to restore to the Restore Point you made just prior to the attempt to install SP3 or have the last set of problems cleared up?

[lthsinc]

Actually, it's gotten significantly worse. I did restore to the point I'd created prior to trying to install SP3, but still the same. It's working so slowly that I just turned it off last night, it was too frustrating to try. It's forever between clicks on anything, in any program. Will try to restore to the point before making all the last changes, ie-Java, etc., as everything was working well then. Will get back to you soon.

[oldman960]

Hi lthsinc,

Sounds like something may have gotten in.

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
  
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

The DDS.txt will open and the Attach.txt will be minimized.
---------------------------------------------------

Please include the contents of the following in your next reply:

DDS.txtand Attach.txt

[lthsinc]

I'll try your instructions, but I'm not sure anything got in as it was all fine until that last clean up stuff. I did restore to prior to that, and it's better, albeit frustratingly slow between commands, programs, etc., I can at least work on it, but I do still get those error messages for Microsoft Visual C ++ Runtime Library, although not as often. And in addition to the ongoing McAfee and Malwarebytes protection, I did a full Malwarebytes scan, and nothing. I realize that you can still be infected even when everything comes up clean, but these new problems, including the MS error messages, all began the instant I followed those last clean up instructions. Hopefully the new tool will help.

[lthsinc]

Ok, so I ran the DDS tool, and tried to post what it said, but I guess it was too long and wouldn't work here, so I saved what came up, and attached it here. I couldn't find any script blocking protection to disable, and this notepad was all that came up when I double-clicked, didn't get the option for Optional Scan, or anything else. (I tried it twice to be sure.) Please let me know what to do next. Thanks. Actually, I just tired zipping and sending, but it still won't accept. The .txt file is 607kb, and for some reason, didn't reduce when zipped, even when I increased the compression. How do you want me to send it to you?

[oldman960]

Hi lthsinc,

The tools clean up we did shouldn't have caused any problems. The cleanup button in OTL simply removes OTL and a few other tools if present. The rest was updating java and some IE settings.


See if you can upload it to rapidshare

http://www.rapidshare.com/

Post the link in this topic once you have uploaded it.

Have a look for a file on your desktop named Attach.txt. Send it also.

Thanks

[lthsinc]

Here's the download link: http://rapidshare.co...ds_scan_log.ZIP
but there was no Attach.txt file on the desktop. Thanks, talk w/you soon.

[oldman960]

Hi lthsinc, I got the file but it looks like you zipped DDS.scr (the actual program) which is 610kb. The file I recieved is in the form of program code. I just tried it. DDS.txt opened once the scan was complete. The Attach.txt was also produced but was behind the DDS.txt. Please note that the notepad produced must be saved before closing it or it will disappear from your computer. Please try again.

[lthsinc]

Ok, I've tried a couple more times, but whenever I double-click the dds.scr, all I get is the notepad I sent you, apparently with program code on it. I've left that open overnight, but nothing else ever came up. I'd even re-downloaded it, but get the same thing.

[oldman960]

Hi lthsinc, Try renaming DDS.scr to DDS.com and see if it will produce the logs. Thanks

[lthsinc]

Yep, that did the trick. The icon changed, and then opened as a program. Below is the text log: DDS (Ver_10-12-12.02) - NTFSx86 Run by TEST at 6:55:59.34 on Thu 12/23/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22 ============== Running Processes =============== ============== Pseudo HJT Report =============== uStart Page = hxxp://www.aol.com uSearch Page = hxxp://www.google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uSearch Bar = hxxp://www.google.com/ie mSearch Bar = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3071214 uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/keyword/%s mSearchAssistant = hxxp://www.google.com/ie uURLSearchHooks: AOL Toolbar Search Class: {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - c:\program files\aol toolbar\aoltb.dll uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll mURLSearchHooks: AOL Toolbar Search Class: {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - c:\program files\aol toolbar\aoltb.dll BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll BHO: AOL Toolbar Loader: {3ef64538-8b54-4573-b48f-4d34b0238ab2} - c:\program files\aol toolbar\aoltb.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20101005205813.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: AOL Toolbar: {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - c:\program files\aol toolbar\aoltb.dll EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll uRun: [AOL Fast Start] "c:\program files\aol 9.5\AOL.EXE" -b mRun: [StartupBlaster] "c:\program files\xencare software\startup blaster\StartupBlaster.exe" mRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: mcafee.com DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=67633 DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/OAS/ActiveX/MSDcode.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab DPF: {6604D1ED-8FFC-4909-A247-C2664A867B29} - hxxp://www.callertunes.com/greeting/CBRT.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229971661671 DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} - hxxps://accounting.quickbooks.com/c2/v20.127/qboax10.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} - hxxp://10.0.0.156/NetCamPlayerWeb11gv2.cab DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://rimsupport.webex.com/client/T23L/support/ieatgpc.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Notify: AtiExtEvent - Ati2evxx.dll AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll Hosts: 127.0.0.1 www.spywareinfo.com Hosts: 192.168.0.103 HP00187162F0E7 ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\test\applic~1\mozilla\firefox\profiles\ygxugibl.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aolTB50CL-chromesbox-en-us FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&invocationType=tb50-ff-aolTB50CL-ab-en-us&query= FF - component: c:\documents and settings\test\application data\mozilla\firefox\profiles\ygxugibl.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\test\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: FireFTP: {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - %profile%\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\mcafee\SiteAdvisor ---- FIREFOX POLICIES ---- FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: browser.chrome.favicons - false FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.turbo.enabled - true FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.urlbar.autofill - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.notify.backoffcount - 5 FF - user.js: content.notify.interval - 750000 FF - user.js: content.notify.ontimer - true FF - user.js: content.switch.threshold - 750000 FF - user.js: google.toolbar.linkdoctor.enabled - false FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: network.http.pipelining - true FF - user.js: network.http.pipelining.firstrequest - true FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.proxy.pipelining - true FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: nglayout.initialpaint.delay - 0 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false ============= SERVICES / DRIVERS =============== =============== File Associations =============== JSEFile=NOTEPAD.EXE %1 regfile=NOTEPAD.EXE %1 scrfile=NOTEPAD.EXE %1 VBEFile=NOTEPAD.EXE %1 VBSFile=NOTEPAD.EXE %1 =============== Created Last 30 ================ 2010-12-22 15:22:33 -------- d-----w- c:\program files\common files\ODBC 2010-12-22 05:16:55 33588 ----a-r- c:\windows\system32\drivers\wanatw4.sys 2010-12-22 02:27:57 -------- d-----w- c:\program files\AOL Toolbar 2010-12-21 23:47:48 -------- dc----w- c:\docume~1\alluse~1\applic~1\AOL Toolbar 2010-12-21 23:42:24 -------- d-----w- c:\program files\common files\aolshare 2010-12-21 23:42:24 -------- d-----w- c:\program files\AOL 9.5 2010-12-16 16:02:40 -------- dc----w- C:\_OTL 2010-12-14 19:53:01 -------- d-----w- c:\program files\SpywareBlaster 2010-12-10 00:48:34 -------- d-----w- c:\docume~1\test\locals~1\applic~1\VS Revo Group 2010-12-10 00:20:55 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys 2010-12-10 00:20:53 -------- d-----w- c:\program files\VS Revo Group 2010-11-30 19:55:41 -------- d-----w- c:\program files\common files\Software Update Utility 2010-11-25 04:37:22 -------- d-----w- c:\program files\ESET ==================== Find3M ==================== 2010-12-22 05:35:18 44544 ----a-w- c:\windows\system32\agremove.exe 2010-12-16 14:50:56 256 -c--a-w- c:\windows\system32\pool.bin 2010-12-02 23:21:04 87688 ----a-w- c:\windows\system32\IncContxMenu.dll 2010-12-02 23:20:18 11776 ----a-w- c:\windows\system32\smrgdf.exe 2010-12-02 23:20:10 29696 ----a-w- c:\windows\system32\iolobtdfg.exe 2010-12-02 23:18:28 2234040 ----a-w- c:\windows\system32\Incinerator.dll 2003-08-27 21:19:18 36963 -c--a-r- c:\program files\common files\SM1updtr.dll ============= FINISH: 7:00:50.95 =============== ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ And I've attached the Attach.txt file. Also, I believe I've resolved the Runtime error messages, they seem to have been associated with AOL. Interestingly I'd previously told Conspire that much of what he'd instructed me to do, while helping the computer, seemed to really mess with AOL, which had always worked just fine, never a problem. However, after following the instructions a couple of times, I'd have to reinstall, and still have issues, but eventually it would work again. This time it caused some issue that really messed with it, and I'd found an article in Microsoft explaining how to fix it, which I did, and now that problem has been resolved, no more error messages, at least so far. But let me know if anything shows up in this scan, and what to do. Thanks, talk w/you soon.

Attached Files

•  DDS_log.ZIP   3.81KB   185 downloads