Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Smitfraud-c And/or Win32.trojaninstaller.medianew


  • Please log in to reply
7 replies to this topic

#1 Nightsgale

Nightsgale

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 16 October 2007 - 04:20 AM

When I start up, a big false background appears, with a biohazard symbol and most of the desktop is a hyperlink of some kind. I can't get it to give me any details when I right click on it, and it doesn't go anywhere if I try to change the background. There is a small gray bar that becomes visible when I hover the mouse over the top part of the screen, and it has a few options, among them an option to minimize and close the offending fake background.

Beyond this, I have no less than three "shortcuts" added to my desktop, I do not have them on the desktop anymore as my first instinct was to delete them upon determining that they didn't lead to anywhere on my computer, that they were false, themselves. They had no target path other than leading to my desktop.

After this, there are multiple other symptoms of some kind of infection, all involving Internet Explorer. I do not use IE _at all_. I primarily use Netscape and Firefox.

Symptom 1: "Windows Security Alert"
- The text for this reads: "Windows has detected an Internet attack attempt... Somebody's trying to infect your PC with spyware or harmful viruses. Run full system scan now to protect your PC from Internet attacks, hijacking attempts and spyware! Click here to download spyware remover for total protection." It only offers an OK button, but I use the X button at the corner of the window.

Symptom 2: "Spyware Alert"
- The text for this "alert" reads:
"Security Warning!

Trojan.W32.Looksky detected on your machine. This virus is distributed via the Internet through e-mail and Active-X objects. The worm has its own SMTP engine which means it gathers e-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. This process should be removed from your system.

Type: Virus
System Affected: Windows 2000, NT, ME, XP, Vista
Security Risk (0-5): 5
Recomendations: Click Yes to remove it from your PC immediately."

There is a Yes and a No button, and the symbol in the "Spyware Alert" window is a yellow triangle with a black exclamation mark in it. Additionally, the X at the upper right corner of the window is grayed out, forcing me to choose either Yes or No. I always choose No.
Typically, after this symptom crops up, a blinking red octagon with a white X in it appears in my system tray. It does not yield any information when I hover my mouse over it, and it does not provide any options when I right click on it. It's just there.

Symptom 3: "System Alert"
- This next symptom seems to be more elaborate than the others, and could be genuine, but I doubt it, as the word, "recomended" is used, and while Microsoft may be many things, they do know how to spell "recommended". It pops up in the form of an alert bubble from the system tray (possibly an extension of this phantom octagon), much like standard Windows XP system messages from the system tray. The text for this 'alert' reads: "System detected virus activities. These may impact the performance of your computer. Please, use recomended antispyware software to protect your system from parasite programs."

In all three symptoms, an Internet Explorer window usually opens automatically. Now, I have Internet Explorer set to "browse offline", but that doesn't seem to help too much, as it seems to skip that step entirely.
The URL it goes directly for is this: http://pcsecuresystem.com/data/?cmpname=ra...&410e035504

It then usually loads to this site that has the heading (across the top of the window) "WARNING: You must protect your system from threats!" with a URL of: http://pcsecuresystem.com/data/index.php?5...6030543525c0453

There are other times that Internet Explorer will open a window randomly, with no symptom previously described preceding it. It goes to the following URL: http://nameservicedirect.com/r.php?sid=502...aid=86&pn=4
In this case, unless I close the window, the offline browsing keeps it from doing anything, and it just sits there refreshing constantly trying to access.

And finally, I have found a fourth site it tries to send me to (while typing all this up). URL as follows: http://www.safenavweb.com/index.php?sid=50...;pn=4&pid=1
This, too, seems to be blocked by the offline browsing.

I followed the full instructions given on the Preparation Guide, but upon using Spybot, it deleted the files related to Smitfraud-C, and from there, it immediately comes up with a Spybot pop-up alert, telling me that it has detected an important registry entry that has been changed.
The information appears as follows:
Category: System Startup user entry
Change: Value added
Entry: SpybotDeletingB1796
Old data:
New data: command /c del "C:\WINDOWS\dat.txt"

It offers me the choice to Allow the change, to get more info on what it means when this suddenly happens (which Spybot's help function tells me that when this occurs as such I should be cautious...).
I had previously chosen to deny the change, and told the computer to remember this decision. From that point on, almost ever 10 seconds, sometimes less, an alert window would pop up telling me that the process of changing the registry had been denied, until it had done so several times, then it just said the process was blacklisted.

While typing this, minimized windows (which only blink on the task bar if something has happened in the program) start blinking at me randomly, and I check and nothing has changed.
And lastly, so far as I can tell, the entire thing has gummed up my computing speed. Whenever running either Ad-Aware or Spybot, or doing cleanmgr on my computer, the normally quick process draws out to twice, even three times as long as it should take.

This pretty much fully details the situation I have, at the moment.

What follows is the HijackThis log:

---------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:34:43 AM, on 10/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Netscape\Navigator 9\navigator.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: MSVPS System - {C4F4DBBD-4A4C-4B40-97DA-2FE06DBB2901} - C:\WINDOWS\bndsrsqo.dll
O3 - Toolbar: The netadv - {F17B1418-2C0C-4295-BD55-BCDD3C730FBE} - C:\WINDOWS\netadv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunOnce: [SpybotDeletingA1128] command /c del "C:\WINDOWS\dat.txt"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5793] cmd /c del "C:\WINDOWS\dat.txt"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB1796] command /c del "C:\WINDOWS\dat.txt"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2181] cmd /c del "C:\WINDOWS\dat.txt"
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O21 - SSODL: msvb - {A42737A0-53A1-4D19-916F-54C2E105EED7} - C:\WINDOWS\msvb.dll
O21 - SSODL: sysdx - {FAA5ADE0-6632-451A-9968-B6ABC9904C09} - C:\WINDOWS\sysdx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

--
End of file - 4091 bytes

BC AdBot (Login to Remove)

 


#2 sarahw

sarahw

  • Members
  • 248 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 16 October 2007 - 09:42 AM

Hi Nightsgale,
Welcome to the site

I will be handling your log to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.

I want you to show hidden files. There are instructions HERE to help you do this.
You should have Administrator rights to perform the fixes. Some of the instructions I give may need to be printed or saved for reference during the fix. Some of the fix will be done in safe mode so you will be unable to access this thread at that time. These instuctions should be read first, then followed. If you do not understand something, don't be afraid to ask, or see if I'm on chat. :thumbsup:

#3 sarahw

sarahw

  • Members
  • 248 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 16 October 2007 - 09:45 AM

.

Edited by sarahw, 16 October 2007 - 09:57 AM.


#4 Nightsgale

Nightsgale
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 16 October 2007 - 05:21 PM

I work during the day, I am in Central Time Zone, so I will not be back at home (and thus at my computer) until 12am. I have already changed the computer's settings to show hidden files, as you instructed. Do you want me to run another HijackThis log and post its results?

Edit: I went ahead and did the HijackThis log tonight, after I got home from work and did the scanning and cleaning, and this is what I got:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:23:25 AM, on 10/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: MSVPS System - {C4F4DBBD-4A4C-4B40-97DA-2FE06DBB2901} - C:\WINDOWS\bndsrsqo.dll
O3 - Toolbar: The netadv - {F17B1418-2C0C-4295-BD55-BCDD3C730FBE} - C:\WINDOWS\netadv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O21 - SSODL: msvb - {A42737A0-53A1-4D19-916F-54C2E105EED7} - C:\WINDOWS\msvb.dll
O21 - SSODL: sysdx - {FAA5ADE0-6632-451A-9968-B6ABC9904C09} - C:\WINDOWS\sysdx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

--
End of file - 3673 bytes

Edited by Nightsgale, 17 October 2007 - 12:30 AM.


#5 sarahw

sarahw

  • Members
  • 248 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 19 October 2007 - 10:31 AM

Hi,
I'm very sorry about the delay.


While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
  • Open Spybot Search & Destroy.
  • In the Mode menu click "Advanced mode" if not already selected.
  • Choose "Yes" at the Warning prompt.
  • Expand the "Tools" menu.
  • Click "Resident".
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • In the File menu click "Exit" to exit Spybot Search & Destroy.

Please download SmitfraudFix (by S!Ri) to your Desktop.

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.


Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

#6 Nightsgale

Nightsgale
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 19 October 2007 - 08:49 PM

Okay, so, SmitfraudFix report coming right up. By the way, in case I hadn't mentioned already... Thank you very much for your help in this matter!

--------------------

SmitFraudFix v2.240

Scan done at 20:44:05.85, Fri 10/19/2007
Run from C:\Documents and Settings\Ray\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Netscape\Navigator 9\navigator.exe
C:\WINDOWS\system32\cmd.exe

hosts

hosts file corrupted !

127.0.0.1 legal-at-spybot.info
127.0.0.1 www.legal-at-spybot.info

C:\


C:\WINDOWS

C:\WINDOWS\msvb.dll FOUND !
C:\WINDOWS\netadv.dll FOUND !
C:\WINDOWS\sysdx.dll FOUND !
C:\WINDOWS\wsremover.exe FOUND !

C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32


C:\Documents and Settings\Ray


C:\Documents and Settings\Ray\Application Data


Start Menu


C:\DOCUME~1\Ray\FAVORI~1

C:\DOCUME~1\Ray\FAVORI~1\Error Cleaner.url FOUND !
C:\DOCUME~1\Ray\FAVORI~1\Privacy Protector.url FOUND !

Desktop

C:\DOCUME~1\Ray\Desktop\Error Cleaner.url FOUND !
C:\DOCUME~1\Ray\Desktop\Privacy Protector.url FOUND !
C:\DOCUME~1\Ray\Desktop\Spyware?Malware Protection.url FOUND !

C:\Program Files


Corrupted keys


Desktop Components



Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


Rustock



DNS

Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{82AAB1F9-1F0A-4C04-B510-4FA5A18B3593}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{82AAB1F9-1F0A-4C04-B510-4FA5A18B3593}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1


Scanning for wininet.dll infection


End

#7 Nightsgale

Nightsgale
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:42 AM

Posted 23 October 2007 - 02:26 PM

My sister's ex-husband came over the other day and heard that my computer had problems. He ran the Spybot, Ad-Aware, and ran the Smitfraudfix, and then found a file somewhere on my computer that the problems kept being regenerated from, and promptly deleted said file from the computer, and now the problems I have described thus far do not exist.

I'm still not entirely sure of the exact process he did, but that's what he told me he did, and now my computer appears to be fixed.

I hope that this hasn't inconvenienced you much. Good luck with all your other fixes you help people with. I am thankful for the help you did provide.

#8 sarahw

sarahw

  • Members
  • 248 posts
  • OFFLINE
  •  
  • Local time:06:42 PM

Posted 25 October 2007 - 10:27 AM

No problems. Glad you had the problem fixed. If you still want any help, post another Hiack This log. I also had you disable Spybot's Tea Timer, you can turn that back on now.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users