[Closed] Vbalsgrid errors trying to run MBAM taskbar gone

Hi there, having trouble with the PC… Taskbar and start menu have disappeared various issues with cutting and pasting etc. I have had the same issue once before and running malwarebytes' mbam fixed it. So I tried it again and now get vbalsgrid errors which stop it running. Any help would be greatly appreciated. The following are my hjt log and combofix log:-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:10:10 PM, on 4/20/2009
Platform: Windows XP SP3, v.5657 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\BOINC\boinctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\BOINC\boinc.exe
C:\Documents and Settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\astropulse_5.03_windows_intelx86.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\setiathome_6.08_windows_intelx86__cuda.exe
C:\Documents and Settings\Guru\Desktop\utorrent.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [boincmgr] "C:\Program Files\BOINC\boincmgr.exe" /a /s
O4 - HKLM\..\Run: [boinctray] "C:\Program Files\BOINC\boinctray.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1390067357-2049760794-682003330-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-21-1390067357-2049760794-682003330-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User '?')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - S-1-5-21-1390067357-2049760794-682003330-1003 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User '?')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing)
O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (file missing)
O23 - Service: Google Update Service (gupdate1c9a471a42bfa18) (gupdate1c9a471a42bfa18) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 5066 bytes


ComboFix 09-04-19.05 - Guru 04/19/2009 23:31.2 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2009-03-19 to 2009-04-19 )))))))))))))))))))))))))))))))
.

2009-04-18 00:31 . 2004-02-10 16:32 491520 —-a-w c:\windows\system32\vbalSGrid6.ocx
2009-04-16 23:40 . 2009-04-16 23:40 ——– d-sh–r c:\windows\system32\svchost
2009-04-15 23:39 . 2009-04-19 14:45 ——– d—–w c:\documents and settings\All Users\Application Data\BOINC
2009-04-14 09:56 . 2009-04-14 09:56 3532 —-a-w C:\drmHeader.bin
2009-03-30 05:33 . 2009-03-30 05:33 828160 —-a-w c:\windows\boinc.scr
2009-03-23 08:20 . 2009-03-23 08:20 ——– d—–w c:\documents and settings\Guru\Application Data\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-19 15:28 . 2009-01-10 04:13 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-18 00:09 . 2008-11-02 00:50 ——– d—–w c:\documents and settings\Guru\Application Data\uTorrent
2009-04-15 23:40 . 2009-04-15 23:39 ——– d—–w c:\program files\BOINC
2009-04-14 12:04 . 2009-03-14 06:53 ——– d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-04-13 01:00 . 2009-04-13 01:00 ——– d—–w c:\program files\Intelore
2009-04-06 07:32 . 2009-01-10 04:13 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 07:32 . 2009-01-10 04:13 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-03-22 23:27 . 2009-03-22 23:27 ——– d—–w c:\program files\DivX
2009-03-14 06:55 . 2009-03-14 06:53 ——– d—–w c:\program files\Google
2009-03-01 08:48 . 2009-03-01 08:48 ——– d—–w c:\program files\Common Files\NSV
2009-02-21 09:04 . 2008-11-01 03:15 ——– d–h–w c:\program files\InstallShield Installation Information
2009-02-13 08:05 . 2009-02-13 08:05 410984 —-a-w c:\windows\system32\deploytk.dll
2009-01-25 05:15 . 2009-01-25 05:15 0 —-a-w C:\NdoorsLog.txt
2008-12-14 14:56 . 2008-11-01 03:12 18968 —-a-w c:\documents and settings\Guru\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-11-04 05:45 . 2008-11-04 05:45 127 —-a-w c:\documents and settings\Guru\Local Settings\Application Data\fusioncache.dat
2008-12-26 03:00 . 2008-11-01 03:09 16384 –sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
2008-12-26 03:00 . 2008-11-01 03:09 32768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2008-12-26 03:00 . 2008-12-26 03:00 32768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008122620081227\index.dat
2008-12-26 03:00 . 2008-11-01 03:09 32768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.

——- Sigcheck ——-

[-] 2007-11-30 23:26 14336 0C82B0AE50BB2BC8A96A753F4EDC495F c:\windows\system32\svchost.exe

[-] 2007-11-30 23:26 578560 6C74C62ECDC3981A7F1F8F1656B27871 c:\windows\system32\user32.dll

[-] 2007-11-30 23:26 82432 36F8F7A2EF12ED817FC16C3248E39092 c:\windows\system32\ws2_32.dll

[-] 2008-10-16 20:38 826368 6741EAF7B7F110E803A6E38F6E5FA6B0 c:\windows\SoftwareDistribution\Download\1aada90d3aca2362b0231ac90aa9a9fd\SP2GDR\wininet.dll
[-] 2008-10-16 20:24 827904 0D5B75171FF51775B630A431B6C667E8 c:\windows\SoftwareDistribution\Download\1aada90d3aca2362b0231ac90aa9a9fd\SP2QFE\wininet.dll
[-] 2007-12-29 14:04 818688 A4A0FC92358F39538A6494C42EF99FE9 c:\windows\system32\wininet.dll

[-] 2007-12-29 14:05 361344 25FA97DFFD06153B735BFB7AD359BC65 c:\windows\system32\drivers\tcpip.sys

[-] 2007-11-30 23:26 507904 45FFE966290B9C4BA659325561DE4830 c:\windows\system32\winlogon.exe

[-] 2007-11-30 17:18 182656 D1B364F049EB84A883C8A45D3B92FF3B c:\windows\system32\drivers\ndis.sys

[-] 2007-11-30 16:44 36608 EF9BB587E33C2C245B5B83E882501FF6 c:\windows\system32\drivers\ip6fw.sys

[-] 2008-08-14 06:39 2066048 A25E9B86EFFB2AF33BF51E676B68BFB0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[-] 2007-12-29 14:43 2227072 7CD93F0F8149EFE5AED4A8C0195004DB c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[-] 2008-08-14 09:33 2066048 4AC58F03EB94A72809949D757FC39D80 c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2008-08-14 09:33 2066048 4AC58F03EB94A72809949D757FC39D80 c:\windows\system32\ntkrnlpa.exe

[-] 2008-08-14 07:11 2189184 31914172342BFF330063F343AC6958FE c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[-] 2007-12-29 14:00 2350208 17A60CD35FBE6DD5BEAAF93BED6138B8 c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[-] 2008-08-14 10:11 2189184 EEAF32F8E15A24F62BECB1BD403BB5C5 c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2008-08-14 10:11 2189184 EEAF32F8E15A24F62BECB1BD403BB5C5 c:\windows\system32\ntoskrnl.exe

[-] 2007-11-30 23:26 1033728 E0EE428F4777A3CD8760BAD61F87ABED c:\windows\explorer.exe

[-] 2007-11-30 23:26 108544 76727219614A50B2DB29BD0CDA4260D5 c:\windows\system32\services.exe

[-] 2007-11-30 23:26 13312 4DD0637AE896EB8E00DF331D1CCCFC5C c:\windows\system32\lsass.exe

[-] 2007-11-30 23:26 15360 E6735D6E15457E06FEDE517051AF0D70 c:\windows\system32\ctfmon.exe

[-] 2007-11-30 23:26 57856 0DD64932B9A6394B53222B7FD294D12A c:\windows\system32\spoolsv.exe

[-] 2007-11-30 23:26 26112 813B2E9C4CAEA05FBA51A442FAB7A95D c:\windows\system32\userinit.exe

[-] 2007-11-30 23:26 295424 03178DA1A2B7C9B918E5062B2080D732 c:\windows\system32\termsrv.dll

[-] 2007-11-30 23:25 989696 64B3A42738CE5BFB1A4B96971521329A c:\windows\system32\kernel32.dll

[-] 2007-11-30 23:25 17408 CDD4433EDE84A9266363507111095B4E c:\windows\system32\powrprof.dll

[-] 2007-11-30 23:25 110080 934986D43BF2B0734E6BC33130CB163D c:\windows\system32\imm32.dll

[-] 2007-12-29 14:43 1613824 6EB0FCD71AAB8E5378321475AE8DB732 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2007-11-30 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2007-11-30 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-13 148888]
"boincmgr"="c:\program files\BOINC\boincmgr.exe" [2009-03-30 4178688]
"boinctray"="c:\program files\BOINC\boinctray.exe" [2009-03-30 58112]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-11-15 77824]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2007-12-29 123904]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Guru\\Desktop\\utorrent.exe"=

R2 gupdate1c9a471a42bfa18;Google Update Service (gupdate1c9a471a42bfa18);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-14 133104]
S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-02-20 33800]
S2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320]


— Other Services/Drivers In Memory —

*Deregistered* - AFD
*Deregistered* - Arp1394
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - Dnscache
*Deregistered* - eamon
*Deregistered* - easdrv
*Deregistered* - ekrn
*Deregistered* - epfwtdir
*Deregistered* - Fastfat
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - KSecDD
*Deregistered* - LanmanServer
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PptpMiniport
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - seclogon
*Deregistered* - sr
*Deregistered* - Srv
*Deregistered* - swenum
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - Themes
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
.
Contents of the 'Scheduled Tasks' folder

2009-04-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-14 13:38]

2009-04-16 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-14 06:53]
.
.
——- Supplementary Scan ——-
.
FF - ProfilePath - c:\documents and settings\Guru\Application Data\Mozilla\Firefox\Profiles\nknx870v.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-19 23:32
Windows 5.1.2600 Service Pack 3, v.5657 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-19 23:33
ComboFix-quarantined-files.txt 2009-04-19 15:33
ComboFix2.txt 2009-04-19 15:11

Pre-Run: 73,124,216,832 bytes free
Post-Run: 73,116,123,136 bytes free

201 — E O F — 2008-12-25 18:00