54 replies to this topic

[AdvancedSetup]

NOTE: This is a BETA test Fix written by AdvancedSetup. Please provide feedback.

If you have ever recieved either of these eror messages and Malwarebytes has not installed or you had to press the Ignore button to continue then you may want to consider running this routine to possibly correct it.

[indent]Run-time error '372' vbalsgrid6.ocx
C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
Unable to register the DLL/OCX: RegSvr32 failed with exit code 0x5[/indent]
After being able to duplicate this issue of vbalsgrid6, mbamext.dll, and SSubTimer6 failure to register OCX I've written a small procedure that is designed to correct possible Registry permission errors that prevent Malwarebytes from installing. You should ONLY follow this procedure if you're encountering this OCX or DLL REGSVR32 error.

STEP 1
[indent]

• Download and install SubInACL
  
• By default it installs to: C:\Program Files\Windows Resource Kits\Tools
  
• Either download this batch file to your desktop, or copy and paste the code below into a new NOTEPAD file and save it as updateMBperms.bat to your desktop
  
• AFTER you have installed SubInACL then double click on either the downloaded batch file or the one you created to update the Registry permissions.
  
• Note! Users on Vista will need to right click on the batch file and select Run as Administrator

[/indent]
[indent]

@ECHO OFF
::Written to update registry permissions for Malwarebytes installation issues.
cd /d "%programfiles%\Windows Resource Kits\Tools"
subinacl /subkeyreg HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt /grant=administrators=f /grant=system=f /grant=restricted=r /grant=%USERNAME%=f /setowner=administrators
subinacl /subkeyreg HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1 /grant=administrators=f /grant=system=f /grant=restricted=r /grant=%USERNAME%=f /setowner=administrators
subinacl /subkeyreg HKEY_CLASSES_ROOT\SSubTimer6.CTimer /grant=administrators=f /grant=system=f /grant=restricted=r /grant=%USERNAME%=f /setowner=administrators
subinacl /subkeyreg HKEY_CLASSES_ROOT\SSubTimer6.GSubclass /grant=administrators=f /grant=system=f /grant=restricted=r /grant=%USERNAME%=f /setowner=administrators
subinacl /subkeyreg HKEY_CLASSES_ROOT\SSubTimer6.ISubclass /grant=administrators=f /grant=system=f /grant=restricted=r /grant=%USERNAME%=f /setowner=administrators
subinacl /subkeyreg HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.cGridCell /grant=administrators=f /grant=system=f /grant=restricted=r /grant=%USERNAME%=f /setowner=administrators
subinacl /subkeyreg HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.cGridSortObject /grant=administrators=f /grant=system=f /grant=restricted=r /grant=%USERNAME%=f /setowner=administrators
subinacl /subkeyreg HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.IGridCellOwnerDraw /grant=administrators=f /grant=system=f /grant=restricted=r /grant=%USERNAME%=f /setowner=administrators
subinacl /subkeyreg HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.vbalGrid /grant=administrators=f /grant=system=f /grant=restricted=r /grant=%USERNAME%=f /setowner=administrators
ECHO .
ECHO All done.  Please try to reinstall Malwarebytes now.
pause

[/indent]

STEP 2
[indent]Now try to reinstall Malwarebytes v1.50.1 again[/indent]STEP 3
[indent]Please let us know if this corrected the issue so that we can build this into the regular installer.[/indent]

[CharlesG]

 AdvancedSetup, on Nov 9 2008, 01:42 PM, said:

C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
Unable to register the DLL/OCX: RegSvr32 failed with exit code 0x5

The other two files registered; mbamext didn't. When I then attempted to register mbamext.dll using regsvr32, the error message return code was 0x80040154, which Winerror.h says is:

//MessageId: REGDB_E_CLASSNOTREG
//
// MessageText:
//
// Class not registered

Before installation of 1.75 the MBAMext keys didn't exist. Even after I installed 1.75 (by clicking ignore when I got the "failed to register" message), the mbamext keys didn't exist. However, the scanner seemed to run without problems and completed its log. (I did both a quick and a full scan.)

I then created the two MBAMext keys and ran the two related subinacl commands. These just added the RESTRICTED group and changed the owner from my username (which is an administrator) to the administrators group. (I'm not sure the RESTRICTED group means anything, since I'm running XP SP2.)

I again attempted to register mbamext.dll using regsvr32, but the error message return code was still 0x80040154. That seemed logical as the MBAMext keys that I created don't have clsid subkeys.

I hope this will help you debug the problem. I don't know how the class ID system works, but if the numbers are the same for all installations, perhaps you could supply a reg file so the registration could be done manually. Also, can you confirm whether MBAMext.dll needs to be registered just for scanning?

Thanks for your help.

[AdvancedSetup]

There is no v1.75 for Malwarebytes. Where did you get this file from?

The latest version is v1.30

[CharlesG]

 AdvancedSetup, on Nov 9 2008, 06:27 PM, said:

There is no v1.75 for Malwarebytes. Where did you get this file from?

The latest version is v1.30

Sorry, my mistake. It was 1.30 and I downloaded it from this site.

[bubbleboi]

OMG IT WORKED!!!!! This is it AdvancedSetup. Ppl if it worked for me it will work for you. Im running a scan rite now i'll write back an say how it goes. I think this error is finaly resolved. Good work AdvancedSetup

Edited by JeanInMontana, 10 November 2008 - 09:11 PM.
Remove quotes

[AdvancedSetup]

 CharlesG, on Nov 9 2008, 05:06 PM, said:

The other two files registered; mbamext didn't. When I then attempted to register mbamext.dll using regsvr32, the error message return code was 0x80040154, which Winerror.h says is:

//MessageId: REGDB_E_CLASSNOTREG
//
// MessageText:
//
// Class not registered

Hi Charles,

Well you may want to try to follow the routine below as best you can (ignoring the MBAM portion for now)

Please read and follow the instructions provided here: Pre- HJT Post Instructions
When ready please post your logs here: Malware Removal - HijackThis Logs

During this scan and cleanup process you should not install any other software unless requested to do so.


We will try to see if some other Malware or other issue is causing this as best we can.

[CharlesG]

Will do. Can you tell me whether the mbamext.dll needs to be registered in order for scans to be valid? The program did perform the scans, and I could post the logs.

Thanks

[AdvancedSetup]

As far as I know the mbamext.dll file only adds the Right Click functionality to the program. It should not have any affect on the scanning.

[CharlesG]

 AdvancedSetup, on Nov 10 2008, 06:19 PM, said:

As far as I know the mbamext.dll file only adds the Right Click functionality to the program. It should not have any affect on the scanning.

That doesn't sound like the target a malware writer would want to attack, while at the same time letting the other DLL/OCX register and the scan run. I scanned with MBAM, Avira, Dr.Web and PandaOnline and the scans were clean (except for Dr. Web and Panda reporting some false positives in uninstalled software).

I had been having serious registry problems a few weeks ago with regsvr32 failing and jscript and vbscript not working. They were cured by running a script like yours, except it applied to the entire registry. See: Solving setup errors by using the SubInACL tool

I think my original problem was caused by changing my Windows username (the real one, not the login one). I successfully changed all references to it in registry keys, but I had an old QuickTime installed whose ownership was the old name. As a result, a lot of keys for filetypes and scripting now had owners who didn't exist, so the keys couldn't be deleted or modified. The SubInACL script fixed all that, but perhaps the original problem -- or the extreme cure -- created some other issues.

I finally succeeded in registering MBAMext by brute force. I examined the registry on another machine that had a successful installation of MBAM 1.27. I exported all the registry keys related to MBAMext and added them to my machine's registry. The MBAM scan context menu item now works. [Small suggestion: the log would be improved if it included the pathname of the folder or file scanned.]

I have attached the REG files to this post in a ZIP archive in case others will find them helpful.

Thanks for you help and for the great product!

Attached Files

•  MBAMextReg.zip   2.42K   338 downloads

[vopop]

Hi, registered new here because of your great work with Anti-Malware.

I was hit by a number of trojans etc which were blocking me out of Malwarebytes.org; today I successfully did a scan with AVAST which finally nailed them (I hope) - at least my browser will now go to your site, and I can download Anti-Malware. But I still get the "unable to register the dll/ocx" message at the end of trying to install.

So when I follow the link you posted to SubInACL, (using Firefox) I see the microsoft page fine, but when I click on "download" something buggy happens and I get "address not found". If I *very* quickly select the splash screen offering to try the "beta version" of the download page, I get something that looks exactly like the original page, but this time I can start the download... but what I'm downloading is Silverlight.exe and not the MSI file... IE doesn't find the download link at all, I just get "The page cannot be displayed".

I've disabled all add-ons in Firefox, and I tried pasting the MSI link into Leechget but it just stalls and does nothing.

Thanks for any further advice.

[vopop]

...actually don't worry too much - looks like you're correct about the right-click dll thing... the prog is running now and I successfully did an update check. Thanks again for the great work.

[AdvancedSetup]

Hello and Welcome to Malwarebytes.org


I'd suggest doing this portion so that we can help you get it fully cleaned up and then do the SubInACL so that you can have a proper install running on your system.


Please read and follow the instructions provided here: Pre- HJT Post Instructions
When ready please post your logs here: Malware Removal - HijackThis Logs

Someone will be happy to assist you further with cleaning your system.

During this scan and cleanup process you should not install any other software unless requested to do so.

[Boofo]

 vopop, on Nov 14 2008, 09:55 PM, said:

Hi, registered new here because of your great work with Anti-Malware.

I was hit by a number of trojans etc which were blocking me out of Malwarebytes.org; today I successfully did a scan with AVAST which finally nailed them (I hope) - at least my browser will now go to your site, and I can download Anti-Malware. But I still get the "unable to register the dll/ocx" message at the end of trying to install.

So when I follow the link you posted to SubInACL, (using Firefox) I see the microsoft page fine, but when I click on "download" something buggy happens and I get "address not found". If I *very* quickly select the splash screen offering to try the "beta version" of the download page, I get something that looks exactly like the original page, but this time I can start the download... but what I'm downloading is Silverlight.exe and not the MSI file... IE doesn't find the download link at all, I just get "The page cannot be displayed".

I've disabled all add-ons in Firefox, and I tried pasting the MSI link into Leechget but it just stalls and does nothing.

Thanks for any further advice.

Silverlight is Micorsoft's answer to the flash war they are having with Adobe. Some of their sites are going that route now and need to have Silerelight installed to take full advantage of some things the have to offer.

[girpace]

this is my result
we can not
help


LookupAccountName : HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt:administrators 1337 Str
ucture d'ID de sécurité non valide.

Current object HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt will not be processed


Elapsed Time: 00 00:00:00
Done: 0, Modified 0, Failed 0, Syntax errors 1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt
LookupAccountName : HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1:administrators 1337 S
tructure d'ID de sécurité non valide.

Current object HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1 will not be processed


Elapsed Time: 00 00:00:00
Done: 0, Modified 0, Failed 0, Syntax errors 1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - HKEY_CLASSES_ROOT\MBAMExt.MBAMShlExt.1
LookupAccountName : HKEY_CLASSES_ROOT\SSubTimer6.CTimer:administrators 1337 Stru
cture d'ID de sécurité non valide.

Current object HKEY_CLASSES_ROOT\SSubTimer6.CTimer will not be processed


Elapsed Time: 00 00:00:00
Done: 0, Modified 0, Failed 0, Syntax errors 1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - HKEY_CLASSES_ROOT\SSubTimer6.CTimer
LookupAccountName : HKEY_CLASSES_ROOT\SSubTimer6.GSubclass:administrators 1337 S
tructure d'ID de sécurité non valide.

Current object HKEY_CLASSES_ROOT\SSubTimer6.GSubclass will not be processed


Elapsed Time: 00 00:00:00
Done: 0, Modified 0, Failed 0, Syntax errors 1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - HKEY_CLASSES_ROOT\SSubTimer6.GSubclass
LookupAccountName : HKEY_CLASSES_ROOT\SSubTimer6.ISubclass:administrators 1337 S
tructure d'ID de sécurité non valide.

Current object HKEY_CLASSES_ROOT\SSubTimer6.ISubclass will not be processed


Elapsed Time: 00 00:00:00
Done: 0, Modified 0, Failed 0, Syntax errors 1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - HKEY_CLASSES_ROOT\SSubTimer6.ISubclass
LookupAccountName : HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.cGridCell:administrato
rs 1337 Structure d'ID de sécurité non valide.

Current object HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.cGridCell will not be proce
ssed


Elapsed Time: 00 00:00:00
Done: 0, Modified 0, Failed 0, Syntax errors 1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.cGridCell
LookupAccountName : HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.cGridSortObject:admini
strators 1337 Structure d'ID de sécurité non valide.

Current object HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.cGridSortObject will not be
processed


Elapsed Time: 00 00:00:00
Done: 0, Modified 0, Failed 0, Syntax errors 1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.cGridSortObject
LookupAccountName : HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.IGridCellOwnerDraw:adm
inistrators 1337 Structure d'ID de sécurité non valide.

Current object HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.IGridCellOwnerDraw will not
be processed


Elapsed Time: 00 00:00:00
Done: 0, Modified 0, Failed 0, Syntax errors 1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.IGridCellOwnerDraw
LookupAccountName : HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.vbalGrid:administrator
s 1337 Structure d'ID de sécurité non valide.

Current object HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.vbalGrid will not be proces
sed


Elapsed Time: 00 00:00:00
Done: 0, Modified 0, Failed 0, Syntax errors 1
Last Syntax Error:WARNING : /grant=administrators=f : Error when checking argume
nts - HKEY_CLASSES_ROOT\vbAcceleratorSGrid6.vbalGrid
.
All done. Please try to reinstall Malwarebytes now.
Appuyez sur une touche pour continuer...

[coolman1232]

Hi all -
I seem to have a very similar problem. I receive the three "Unable to register" messages!

I am trying to reset registry permissions, as I have a feeling the malware has damaged the permissions of some registry files.
However, this will be my second time doing so. I tried installing subinacl, but it also gives me an error when I try to open it - it also failed with regsvr32.dll.

Now I'm stuck and can't fix it with anything

Anyone have ideas?
Thanks.

[exile360]

 coolman1232, on Nov 23 2008, 02:01 AM, said:

Hi all -
I seem to have a very similar problem. I receive the three "Unable to register" messages!

I am trying to reset registry permissions, as I have a feeling the malware has damaged the permissions of some registry files.
However, this will be my second time doing so. I tried installing subinacl, but it also gives me an error when I try to open it - it also failed with regsvr32.dll.

Now I'm stuck and can't fix it with anything

Anyone have ideas?
Thanks.

If you are using xp you can try this program, it's called dial-a-fix: http://djlizard.net/...-v0.60.0.24.zip Unzip it to your desktop and then double click on dial-a-fix.exe and when it opens, click on the Policies button at the bottom. As long as you are logged on as an administrator it should show and allow you to remove policy restrictions. If no restrictive policies are found, the window that pops up will be blank and it will say no restrictive policies found at the bottom, if they are found you can click the remove button to remove the restrictions. If that doesn't fix you up then it could be caused by a nasty infection and you should read the instructions here: http://www.malwareby...?showtopic=2936 and post your logs here: http://www.malwareby...php?showforum=7 One of the experts here will assist you in cleaning your machine. Good luck and safe surfing.

[AdvancedSetup]

Hello girpace,

Not sure exactly but just a note that the above method and script was only written and tested on Windows XP ENGLISH version. Using this script on any other Language version may not work correctly as it is hard coded and not based on language variables.

However as long as some service is not preventing it you can basically manually do the same thing from within REGEDIT by taking ownership of the registry keys in question back, then re-assign full permissions to those keys for your account again.

[Odyssee]

 exile360, on Nov 24 2008, 06:49 AM, said:

If you are using xp you can try this program, it's called dial-a-fix: http://djlizard.net/...-v0.60.0.24.zip Unzip it to your desktop and then double click on dial-a-fix.exe and when it opens, click on the Policies button at the bottom. As long as you are logged on as an administrator it should show and allow you to remove policy restrictions. If no restrictive policies are found, the window that pops up will be blank and it will say no restrictive policies found at the bottom, if they are found you can click the remove button to remove the restrictions. If that doesn't fix you up then it could be caused by a nasty infection and you should read the instructions here: http://www.malwareby...?showtopic=2936 and post your logs here: http://www.malwareby...php?showforum=7 One of the experts here will assist you in cleaning your machine. Good luck and safe surfing.

I can not thank you enough. This tool did the trick for me, i.e. Dial a fix: Tools and then the Repair Permissions option.
I reinstalled MalwareBytes without problems after running this tool.

[exile360]

 Odyssee, on Nov 24 2008, 09:56 AM, said:

I can not thank you enough. This tool did the trick for me, i.e. Dial a fix: Tools and then the Repair Permissions option.
I reinstalled MalwareBytes without problems after running this tool.

Excellent, I'm glad I could help. Don't forget though, you may still have a lingering infection so to be safe I would recommend reading the instructions here: http://www.malwareby...?showtopic=2936 and post your logs here: http://www.malwareby...php?showforum=7 One of the experts here will have a look at your logs (be patient, it takes time they are busy), and they will let you know if you are clean.

[Blackdog]

My experience was similar and I tried this process but it failed to work for me.

My install of Malwarebytes failed this way before and after the fix described in this thread...

C:\Program Flles\Malwarebytes' Anti-Malware \ssubtmr6.dll
Mine failed with Unable to register the Dll/OCX: RegSrv32 failed exit code 0x3... not 0x5.