Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Personal Protector/Voice Adverts


  • Please log in to reply
7 replies to this topic

#1 sccrkid96

sccrkid96

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 29 November 2009 - 06:58 PM

My brother was watching movies online off a link we got on watch-movies.net. Then he suddenly started getting annoying adverts and everytime he clicked a link on google it redirected him to a new page. I tried malwarebytes and superantispyware but they never found anything (both were updated). So i decided to leave it alone for a while. Now today i suddenly got the fake Personal protector 2009 out of the blue. So i went again and did virus scan. Superantispyware found it and i clicked delete and then rebooted computer and it was back again. I have already followed the guide using Rkill to try to delete it and it wouldnt work. Now more viruses have been coming in and they are attachted to SYSTEM32 files which i am afraid to delete.


Sorry if i wrote to much. =/ Thank you to whoever may help me.

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:01:10 AM

Posted 29 November 2009 - 07:23 PM

I'm moving this from the XP forum to the Am I Infected forum where folks can assist you with this issue.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 sccrkid96

sccrkid96
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 06 December 2009 - 12:25 PM

Would like some help its been about a week

#4 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:10 AM

Posted 06 December 2009 - 08:47 PM

Hello.

Now more viruses have been coming in and they are attachted to SYSTEM32 files which i am afraid to delete.

Can you let me know what these files are in question please. Thanks.

--
Run Malwarebytes for me and we'll see what's left.

Download and run MalwareBytes Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

For complete or visual instructions on installing and running Malwarebytes Anti-Malware please read this link

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#5 sccrkid96

sccrkid96
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 07 December 2009 - 03:11 PM

MBAM doesnt pickup anything. Although i just went through my superantispware quarantine and there is adware.vundo/variant-swarm. Rootkit.agent/gen-Kbi..... Trojan.agent/gen-net.... Also whenever i run it it picks up The personal protector 9 files to be exact and i delete them then personal protector starts running again.. Thanks for helping me!

#6 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:10 AM

Posted 07 December 2009 - 04:13 PM

Can you post the SAS log then? Also post the MBAM log too so I can see the information and scan engine database of it that was ran.

Thanks.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#7 sccrkid96

sccrkid96
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:10 AM

Posted 07 December 2009 - 06:54 PM

Here is SAS log from 12-7-09 SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/07/2009 at 06:22 PM

Application Version : 4.31.1000

Core Rules Database Version : 4318
Trace Rules Database Version: 2177

Scan type : Quick Scan
Total Scan Time : 00:11:51

Memory items scanned : 414
Memory threats detected : 0
Registry items scanned : 398
Registry threats detected : 0
File items scanned : 5026
File threats detected : 37

Adware.Tracking Cookie
C:\Documents and Settings\lecinho\Cookies\lecinho@interclick[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@dr.findlinks[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@collective-media[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@eyewonder[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@fr.sitestat[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@mediatraffic[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@admarketplace[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@richmedia.yahoo[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@adultfriendfinder[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@clickthrough.kanoodle[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@home.findology[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@enhance[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@ad.wsod[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@chitika[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@bridge2.admarketplace[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@www.businessfind[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@d.mediaforceads[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@findology[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@247traffic[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@xml.trafficengine[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@businessfind[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@adserver.adtechus[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@adecn[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@ads.undertone[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@theclickcheck[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@click.fastpartner[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@fr.sitestat[2].txt

Rogue.PersonalProtector
C:\Program Files\Personal Protector\base.wdb
C:\Program Files\Personal Protector\baseadd.wdb
C:\Program Files\Personal Protector\conf.wcf
C:\Program Files\Personal Protector\personalprotector.exe
C:\Program Files\Personal Protector\q
C:\Program Files\Personal Protector\quarant.wdb
C:\Program Files\Personal Protector\queue.wdb
C:\Program Files\Personal Protector\un.exe
C:\Program Files\Personal Protector
C:\WINDOWS\Prefetch\PERSONALPROTECTOR.EXE-1298924E.pf




This next one is from 11-29 but i just left the trojans and rootkit in quartine since they are in SYSTEM32 some of them

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/29/2009 at 12:58 PM

Application Version : 4.31.1000

Core Rules Database Version : 4318
Trace Rules Database Version: 2177

Scan type : Quick Scan
Total Scan Time : 00:11:03

Memory items scanned : 417
Memory threats detected : 1
Registry items scanned : 388
Registry threats detected : 27
File items scanned : 4926
File threats detected : 96

Adware.Vundo/Variant-Swarm
C:\WINDOWS\SYSTEM32\EEAADDFBAEEEEDE.DLL
C:\WINDOWS\SYSTEM32\EEAADDFBAEEEEDE.DLL
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\eeaaddfbaeeeede

Trojan.Agent/Gen-Vumer[PartTime]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{506CD401-5203-4B27-BB5A-03C97758FD02}
HKCR\CLSID\{506CD401-5203-4B27-BB5A-03C97758FD02}
HKCR\CLSID\{506CD401-5203-4B27-BB5A-03C97758FD02}
HKCR\CLSID\{506CD401-5203-4B27-BB5A-03C97758FD02}\InprocServer32
HKCR\CLSID\{506CD401-5203-4B27-BB5A-03C97758FD02}\InprocServer32#ThreadingModel
HKCR\CLSID\{506CD401-5203-4B27-BB5A-03C97758FD02}\ProgID
HKCR\CLSID\{506CD401-5203-4B27-BB5A-03C97758FD02}\Programmable
HKCR\CLSID\{506CD401-5203-4B27-BB5A-03C97758FD02}\TypeLib
HKCR\CLSID\{506CD401-5203-4B27-BB5A-03C97758FD02}\VersionIndependentProgID
HKCR\apar
HKCR\apar\CLSID
HKCR\PartTimeB
HKCR\PartTimeB\CLSID
HKCR\PartTimeB\CurVer
HKCR\TypeLib\{AE17DD77-E0F3-44DD-8CBA-1EBCE6B5ED55}
HKCR\TypeLib\{AE17DD77-E0F3-44DD-8CBA-1EBCE6B5ED55}\1.0
HKCR\TypeLib\{AE17DD77-E0F3-44DD-8CBA-1EBCE6B5ED55}\1.0\0
HKCR\TypeLib\{AE17DD77-E0F3-44DD-8CBA-1EBCE6B5ED55}\1.0\0\win32
HKCR\TypeLib\{AE17DD77-E0F3-44DD-8CBA-1EBCE6B5ED55}\1.0\FLAGS
HKCR\TypeLib\{AE17DD77-E0F3-44DD-8CBA-1EBCE6B5ED55}\1.0\HELPDIR
C:\WINDOWS\SYSTEM32\LASTMON.DLL
HKU\S-1-5-21-1993962763-1214440339-1417001333-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{506CD401-5203-4B27-BB5A-03C97758FD02}
HKCR\Interface\{4CBCC4E2-073C-4109-A719-458D8CF9900E}
HKCR\Interface\{4CBCC4E2-073C-4109-A719-458D8CF9900E}\ProxyStubClsid
HKCR\Interface\{4CBCC4E2-073C-4109-A719-458D8CF9900E}\ProxyStubClsid32
HKCR\Interface\{4CBCC4E2-073C-4109-A719-458D8CF9900E}\TypeLib
HKCR\Interface\{4CBCC4E2-073C-4109-A719-458D8CF9900E}\TypeLib#Version

Adware.Tracking Cookie
C:\Documents and Settings\lecinho\Cookies\lecinho@collective-media[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@eyewonder[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@myroitracking[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@mediatraffic[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@admarketplace[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@2o7[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@msnportal.112.2o7[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@ppvdominator[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@clickthrough.kanoodle[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@enhance[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@ad.wsod[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@chitika[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@www.findweblocate[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@bridge2.admarketplace[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@bizrate[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@ads.adap[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@featuredlocalfind[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@www.locatefindsearch[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@findology[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@ads.financialcontent[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@xml.trafficengine[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@www.searchdiscoverfind[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@serving.adsrevenue.clicksor[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@specificmedia[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@intermundomedia[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@tracking.realtor[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@ads.undertone[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@theclickcheck[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@clicks.search312[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@www.locatefind[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@go[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@dr.findlinks[1].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@www.cftrack[2].txt
C:\Documents and Settings\lecinho\Cookies\lecinho@link.mercent[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@runetracker[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@clicksense[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@specificmedia[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@ads.lucidmedia[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@adlegend[2].txt
C:\Documents and Settings\Guest\Cookies\guest@tribalfusion[1].txt
C:\Documents and Settings\Guest\Cookies\guest@serving-sys[2].txt
C:\Documents and Settings\Guest\Cookies\guest@media6degrees[2].txt
C:\Documents and Settings\Guest\Cookies\guest@ad.yieldmanager[2].txt
C:\Documents and Settings\Guest\Cookies\guest@tacoda[2].txt
C:\Documents and Settings\Guest\Cookies\guest@socialmedia[2].txt
C:\Documents and Settings\Guest\Cookies\guest@mlarmani.122.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@doubleclick[2].txt
C:\Documents and Settings\Guest\Cookies\guest@stats.paypal[2].txt
C:\Documents and Settings\Guest\Cookies\guest@revsci[2].txt
C:\Documents and Settings\Guest\Cookies\guest@interclick[2].txt
C:\Documents and Settings\Guest\Cookies\guest@adlegend[2].txt
C:\Documents and Settings\Guest\Cookies\guest@at.atwola[2].txt
C:\Documents and Settings\Guest\Cookies\guest@apmebf[2].txt
C:\Documents and Settings\Guest\Cookies\guest@web4.realtracker[1].txt
C:\Documents and Settings\Guest\Cookies\guest@azjmp[1].txt
C:\Documents and Settings\Guest\Cookies\guest@atdmt[1].txt
C:\Documents and Settings\Guest\Cookies\guest@ileadztracker[1].txt
C:\Documents and Settings\Guest\Cookies\guest@mywebsearch[2].txt
C:\Documents and Settings\Guest\Cookies\guest@msnbc.112.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@specificclick[2].txt
C:\Documents and Settings\Guest\Cookies\guest@invitemedia[1].txt
C:\Documents and Settings\Guest\Cookies\guest@trafficmp[2].txt
C:\Documents and Settings\Guest\Cookies\guest@specificmedia[2].txt
C:\Documents and Settings\Guest\Cookies\guest@advertising[2].txt
C:\Documents and Settings\Guest\Cookies\guest@bs.serving-sys[1].txt
C:\Documents and Settings\Guest\Cookies\guest@insightexpressai[1].txt
C:\Documents and Settings\Guest\Cookies\guest@247realmedia[1].txt
C:\Documents and Settings\Guest\Cookies\guest@cdn4.specificclick[2].txt
C:\Documents and Settings\Guest\Cookies\guest@realmedia[1].txt
C:\Documents and Settings\Guest\Cookies\guest@dmtracker[1].txt
C:\Documents and Settings\Guest\Cookies\guest@fastclick[2].txt
C:\Documents and Settings\Guest\Cookies\guest@2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@casalemedia[2].txt
C:\Documents and Settings\Guest\Cookies\guest@paypal.112.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@collective-media[1].txt
C:\Documents and Settings\Guest\Cookies\guest@msnportal.112.2o7[1].txt
C:\Documents and Settings\Guest\Cookies\guest@mediaplex[2].txt
C:\Documents and Settings\LocalService\Cookies\system@tracking.realtor[1].txt
C:\Documents and Settings\LocalService\Cookies\system@apmebf[1].txt
C:\Documents and Settings\LocalService\Cookies\system@clickthrough.kanoodle[1].txt
C:\Documents and Settings\LocalService\Cookies\system@doubleclick[1].txt

Rootkit.Agent/Gen-KBI
C:\WINDOWS\SYSTEM32\KBIWKMQEEBEMUR.DAT

Rogue.PersonalProtector
C:\Program Files\Personal Protector\base.wdb
C:\Program Files\Personal Protector\baseadd.wdb
C:\Program Files\Personal Protector\conf.wcf
C:\Program Files\Personal Protector\personalprotector.exe
C:\Program Files\Personal Protector\q
C:\Program Files\Personal Protector\quarant.wdb
C:\Program Files\Personal Protector\queue.wdb
C:\Program Files\Personal Protector\un.exe
C:\Program Files\Personal Protector
C:\WINDOWS\Prefetch\PERSONALPROTECTOR.EXE-1298924E.pf

Trojan.Agent/Gen-NET
C:\WINDOWS\SYSTEM32\NET.NET
C:\WINDOWS\Prefetch\NET.NET-0FD013A1.pf





HERE IS THE MBAM LOG.

Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 3

12/7/2009 6:53:58 PM
mbam-log-2009-12-07 (18-53-54).txt

Scan type: Quick Scan
Objects scanned: 112908
Time elapsed: 11 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\drivers\str.sys (Rootkit.Agent) -> No action taken.

#8 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:10 AM

Posted 07 December 2009 - 08:51 PM

Your Malwarebytes scan is outdated and also it shows no action taken.

Make sure you UPDATE IT first...

Update and Scan with MalwareBytes Anti-Malware
  • Launch Malwarebytes' Anti-Malware
  • Go to the Update tab
  • Select Check for Update and let MBAM download and install any available updates.
  • After the update is complete go to the Scanner tab.
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

---
Then run RootRepeal...

Download and run RootRepeal CR

Please download RootRepeal from the following location and save it to your desktop.
  • Unzip the RootRepeal.zip file it to it's own folder. (If you did not use the "Direct Download" mirror to download RootRepeal).
  • Close/Disable all other programs especially your security programs (anti-spyware, anti-virus, and firewall) Refer to this page, if you are unsure how.
  • Physically disconnect your machine from the internet as your system will be unprotected.
  • Double-click on RootRepeal.exe to run it. If you are using Vista, please right-click and run as Administrator...
  • Click the Posted Image tab at the bottom.
  • Now press the Posted Image button.
  • A box will pop up, check the boxes beside All Seven options/scan area
    Posted Image
  • Now click OK.
  • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  • The scan will take a little while to run, so let it go unhindered.
  • Once it is done, click the Save Report button. Posted Image
  • Save it as RepealScan and save it to your desktop
  • Reconnect to the internet.
  • Post the contents of that log in your reply please.

Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users