Internet Explorer 11 gone - but "is already installed on this system"

[bengta]

Internet Explorer 11 gone - but "is already installed on this system"

Hi,

I've been reading the previous threads about my problem, but I can't seem to find anything which fits my issues...

After Christmas when I got home from vacation, my system was acting weird. Apparently it had automatically installed some updates, and after that it's not the same. One thing which happened is that Internet Explorer (11) isn't starting at all. (When I clicked on it, nothing at all happened.)

I followed some suggestions in this forum to uninstall it by going to the View Installed Updates and unistalled Internet Explorer 11 - so now that is gone. I then downloaded an installer from the Microsoft website (IE11-Windows6.1-x64-en-us.exe). But when I run it I get "Internet Explorer did not finish installing. Internet Explorer 11 is already installed on this system.":



But when I check the installed Windows updates, there is nothing about Internet Explorer left... In the image below I have sorted all updates in alphabetical order to show that there is nothing starting with "I" left at all.



The links to Internet Explorer in the Start menu are gone altogether. I have no idea what to do next...

(I don't know if it's related, but all my Desktop Gadgets had also turned into small white squares. I have found a separate thread for this in this forum, but unfortunately it didn't fix anything.)

 

[DavidE]

You might get better help if you get this thread moved to the Windows Updates & Activation sub-forum.

I found this MS thread you can look through and see if you want to try some suggestions:
Cannot Uninstall Internet Explorer 11

 

[Slartybart]

Please follow the instructions in OPTION TWO of http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Copy C:\Windows\Logs\CBS\CBS.log to your Desktop (it is a protected file so you cannot attach the original)

Attach the copy of the entire CBS.log to a new post.

Thanks

 

[bengta]

sfc /scannow result

Thanks for the tips so far!

Slartybart, Attached is the CBS file. It was 105 MB uncompressed, so I rar-ed it. I hope that's ok?

 

[Slartybart]

Thanks, got it and filtered it.

The Reader's Digest condensed version
View attachment 348060

I'll ask another member to help create a patch, if one can be created. Hang on - they're busy folk.

Bill
.

 

[NoelDP]

Here's the critical problems...

 Line 454562: 2015-01-29 18:17:24, Info                  CSI    000005b2 [SR] Repairing 4 components
 Line 454563: 2015-01-29 18:17:24, Info                  CSI    000005b3 [SR] Beginning Verify and Repair transaction
 Line 454566: 2015-01-29 18:17:24, Info                  CSI    000005b5 [SR] Cannot repair member file [l:76{38}]"api-ms-win-downlevel-user32-l1-1-0.dll" of Microsoft-Windows-DownlevelApisets-Windows, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 454569: 2015-01-29 18:17:24, Info                  CSI    000005b7 [SR] Cannot repair member file [l:74{37}]"api-ms-win-downlevel-ole32-l1-1-0.dll" of Microsoft-Windows-DownlevelApisets-Com, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 454572: 2015-01-29 18:17:24, Info                  CSI    000005b9 [SR] Cannot repair member file [l:78{39}]"api-ms-win-downlevel-shell32-l1-1-0.dll" of Microsoft-Windows-DownlevelApisets-Shell, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 454575: 2015-01-29 18:17:24, Info                  CSI    000005bb [SR] Cannot repair member file [l:78{39}]"api-ms-win-downlevel-shlwapi-l2-1-0.dll" of Microsoft-Windows-DownlevelApisets-Shell, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 454578: 2015-01-29 18:17:24, Info                  CSI    000005bd [SR] Cannot repair member file [l:78{39}]"api-ms-win-downlevel-shlwapi-l1-1-0.dll" of Microsoft-Windows-DownlevelApisets-Shell, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 454581: 2015-01-29 18:17:24, Info                  CSI    000005bf [SR] Cannot repair member file [l:78{39}]"api-ms-win-downlevel-version-l1-1-0.dll" of Microsoft-Windows-DownlevelApisets-Shell, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 454584: 2015-01-29 18:17:24, Info                  CSI    000005c1 [SR] Cannot repair member file [l:80{40}]"api-ms-win-downlevel-advapi32-l1-1-0.dll" of Microsoft-Windows-DownlevelApisets-Base, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 454587: 2015-01-29 18:17:24, Info                  CSI    000005c3 [SR] Cannot repair member file [l:80{40}]"api-ms-win-downlevel-advapi32-l2-1-0.dll" of Microsoft-Windows-DownlevelApisets-Base, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 454590: 2015-01-29 18:17:24, Info                  CSI    000005c5 [SR] Cannot repair member file [l:80{40}]"api-ms-win-downlevel-normaliz-l1-1-0.dll" of Microsoft-Windows-DownlevelApisets-Base, Version = 7.1.7601.16492, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

I'll post a fix protocol a little later.

 

[NoelDP]

I've uploaded a file - btaaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\btaaa
hit the enter key - if you get a 'Not Found' error try
DIR D:\btaaa
or
DIR E:\btaaa



The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...



XCOPY <drive>:\btaaa <drive>:\windows\winsxs /y /i /s /v /h



(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )



run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

 

[Slartybart]

Noel, you have my eternal gratitude.

 

[bengta]

Hi!

Amazing what geniouses can do. At least it seems genious. Uploaded new CBS.

No IE found though. And my gadgets are still gone, with a weird non-clickable area in the top left corner. But that's another problem I guess...

I appreciate the effort everyone is putting in here, NoelDB and Slartybart. Let's see if we can get this baby home!

/Bengt

 

[NoelDP]

The errors are still present.
Let's check the folder locations and see what's happened....

Open an Elevated COmmand prompt, and run the following commands...

DIR C:\btaaa
DIR C:\Windos\winsxs\btaaa

(the second one should respond 'not found')
post the results.


Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[bengta]

Hi,
I actually checked that it was the files I copied and not the directory.

Here are the results from the commands.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Bengt>DIR C:\btaaa
 Volume in drive C has no label.
 Volume Serial Number is F222-8506

 Directory of C:\btaaa

2015-01-31  21:09    <DIR>          .
2015-01-31  21:09    <DIR>          ..
2015-01-31  06:43    <DIR>          amd64_microsoft-windows-d..evelapisets-windo
ws_31bf3856ad364e35_7.1.7601.16492_none_e249fd3fed68cb81
2015-01-31  06:44    <DIR>          amd64_microsoft-windows-downlevelapisets-bas
e_31bf3856ad364e35_7.1.7601.16492_none_1ed670cbaddb31b7
2015-01-31  06:44    <DIR>          amd64_microsoft-windows-downlevelapisets-com
_31bf3856ad364e35_7.1.7601.16492_none_5b1161f912e23f6d
2015-01-31  06:45    <DIR>          amd64_microsoft-windows-downlevelapisets-she
ll_31bf3856ad364e35_7.1.7601.16492_none_2b20f882c1c0eaca
               0 File(s)              0 bytes
               6 Dir(s)  20 228 468 736 bytes free

C:\Users\Bengt>DIR C:\Windos\winsxs\btaaa
The system cannot find the path specified.

C:\Users\Bengt>

 

[NoelDP]

OK - let's see what else could have gone wrong.~
Are you sure that you copied the contained folders to the proper Drive letter? did you get any error messages?

 

[bengta]

Hi,
Yes, I'm sure it all went well. Xcopy said 9 files copied successfully. I redid it just now just to make sure.
I created one CBS after funning sfc before rebooting, and one after rebooting. the attachment without the date is the latest. The one with the date was the one created before the reboot. (I thought maybe both could be useful?)

Good luck!

 

[NoelDP]

The errors are still present
I'll try and create an alternative later today.

 

[bengta]

The errors are still present
I'll try and create an alternative later today.

Good luck! I'm looking forward to it. My computer is acting quite weird I think...

 

[Slartybart]

Run a few quick utilities, one to clean up temporary files across your system and the second one to check for malware.

---

Restart your machine in case there are any system operations pending

Click here to download Old Timer-TFC.
>> save the application to your Desktop.
:info: Old Timer-TFC is a standalone application, there is no install.

:warn:Save your work and close all open windows.
TFC will close ALL open programs including your browser!

Right click, run as administrator TFC

Click the Start button to begin the cleaning up temporary files and folders.
:warn: Do not work on other things while TFC is running - most applications use some sort of temporary files. Just let TFC run by itself on the machine until it completes.

:busted: If TFC prompts you to reboot, do so immediately.
:busted: If TFC does NOT prompt you, then reboot your machine immediately after TFC has completed.

---

Follow the Download, Scan, and Clean steps in this tutorial on the author's site: How to use AdwCleaner version 3.x

Malware is often difficult to erradicate - it is even more difficult if more than one path is taken on different sites.

As you have posted the issue here on SevenForums, also post any logs here on SevenForums - not on the General Changelog Team (GCT) site. SevenForums members might ask you to launch other on-demand scanners that are not familiar to GCT.

When your system is clean of malware, launch AdwCleaner a final time and click the Uninstall button.

 

[bengta]

Thanks for the good instructions. I have followed them. Here's the log after the cleaning was done. I hope it helps? It didn't look like it found anything very malicious... What to do now?

# AdwCleaner v4.110 - Logfile created 06/02/2015 at 00:00:33
# Updated 05/02/2015 by Xplode
# Database : 2015-02-05.2 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : Bengt - ULTRA
# Running from : C:\Users\Bengt\Desktop\adwcleaner_4.110.exe
# Option : Cleaning

***** [ Services ] *****

[#] Service Deleted : hshld

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Windows\SysWOW64\SearchProtect
Folder Deleted : C:\Users\Bengt\AppData\Local\Hola
Folder Deleted : C:\Users\Bengt\AppData\Local\CrashRpt
Folder Deleted : C:\Users\Bengt\AppData\LocalLow\Delta
Folder Deleted : C:\Users\Bengt\AppData\Roaming\Uniblue
Folder Deleted : C:\Users\Bengt\AppData\Roaming\Mozilla\Firefox\Profiles\atrz4mzx.default\Extensions\[email protected]
Folder Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm
Folder Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj
Folder Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim
Folder Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmnlcjabgnpnenekpadlanbbkooimhnj
File Deleted : C:\Users\Bengt\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\speedupmypc.lnk
File Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
File Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage
File Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static-trackers.adtarget.me_0.localstorage
File Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static-trackers.adtarget.me_0.localstorage-journal
File Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.ak.facebook.com_0.localstorage
File Deleted : C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage-journal

***** [ Scheduled tasks ] *****

Task Deleted : SpeedUpMyPC

***** [ Shortcuts ] *****

Shortcut Disinfected : C:\Users\Bengt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RemoteControl for Winamp\Uninstall RemoteControl for Winamp.lnk

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\HssIE.HssIEApp
Key Deleted : HKLM\SOFTWARE\Classes\HssIE.HssIEApp.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\speedupmypc
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\Headlight
Key Deleted : HKCU\Software\AppDataLow\Software\adawarebp
Key Deleted : HKLM\SOFTWARE\dt soft\daemon tools toolbar
Key Deleted : HKLM\SOFTWARE\PIP
Key Deleted : HKLM\SOFTWARE\Uniblue
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1
Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\464AA55239C100F32AF2D438EDDC0F47
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5652BA3D5FB98AE31B337BF0AF939856
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EB95E1AFCBABE3DB9ECCC669B99494
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - localhost:8080

***** [ Web browsers ] *****

-\\ Internet Explorer v0.0.0.0


-\\ Mozilla Firefox v32.0 (x86 en-US)

[atrz4mzx.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");

-\\ Google Chrome v40.0.2214.94

[C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxps://int.basefarm.com/dosearchsite.action?queryString={searchTerms}
[C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxps://int.basefarm.com/dosearchsite.action?spaceSearch=false&queryString={searchTerms}

-\\ Chromium v

[C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxps://int.basefarm.com/dosearchsite.action?queryString={searchTerms}
[C:\Users\Bengt\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxps://int.basefarm.com/dosearchsite.action?spaceSearch=false&queryString={searchTerms}

*************************

AdwCleaner[R0].txt - [6089 bytes] - [05/02/2015 23:57:30]
AdwCleaner[S0].txt - [6426 bytes] - [06/02/2015 00:00:33]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6485  bytes] ##########

 

[Slartybart]

There were a few malware in there - conduit (search protect) and others I didn't research.
I trust AdwCleaner to do the job it was written to do.

I'd like you to run two more scanners, TDSSkiller and Malwarebytes Anti-Malware.

http://www.sevenforums.com/tutorials/338877-kaspersky-tdsskiller-detect-repair-tdss-rookits.html
Restart the machine

http://www.sevenforums.com/tutorials/338716-malwarebytes-anti-malware-free.html
Restart the machine

Post the malware scan logs, then run another SFC and post that output.

Thanks,

Bill
.

 

[bengta]

OK! Done!

Kaspersky scan, Malwarebytes scan and CBS.log attached.

Malwarebytes scan here also:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2015-02-06
Scan Time: 17:16:02
Logfile: Malwarebytes scan result 2015-02-06.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.06.05
Rootkit Database: v2015.02.03.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Bengt

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 407940
Time Elapsed: 13 min, 56 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

(Neither scan found any malware.)

I really appreciate the help I'm getting here!

/Bengt

 

[Slartybart]

It looks as though you opted for the Mbam Pro trial

License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled​

You might have done that on purpose, but if you missed the step that said "remove the checkmark form the trial offer" then you can just uninstall Mbam so you won't be pestered later about buying the product. You can then reinstall Mbam FREE.

Kaspersky seems to be waiting on a second launch (30 items waiting). It sent suspicious objects to be checked against their Labs DB - a 2nd launch of Kaspersky retrieves the results when you scan the system - it should be faster that the first.

Please run TDSSkiller one more time and post the log - thanks.

Once I'm confident there isn't malicious software on your machine, you can try the patch Noel provided in post# 7
-Not yet though ... I still have a lot of reading to do and maybe more scanners - it's tough to be confident where malware is concerned. The only thing you can really do is scan and clean with a few good tools.

Bill
.