Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

infected by I believe either pc antispyware2010 or vundo or both


  • This topic is locked This topic is locked
15 replies to this topic

#1 Asyr

Asyr

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 10 March 2010 - 09:16 PM

My boyfriend's computer used to have malwarebyte's antimalware installed and logs from 08/30/09 show that it picked up multiple instances of files infected by PC_Antispyware2010 and the spyware family so to speak. I noticed several suspicious files as well such as msa.exe, b.exe, a.exe while in the process of trying to download an update for a program. The internet got hijacked and I wasn't able to get into any known security websites but instead got redirected. Then when I was finally able to download hijackthis I started the scan and it shut down and I was told I didn't have necessary permissions to run and then the same thing happened with Malwarebyte's and I still cannot get it to open. I get an .ocx error msg everytime. I cannot start any of the services and have an unknown owner file showing up but cannot locate it so am not able to back up personal files, etc. I was finally able to get hijackthis and other scans to work; however, no antispyware, antivirus etc can run as of yet. HELP!! Here are the logs from the dds and gmer scans.

DDS (Ver_09-12-01.01) - NTFSx86
Run by Owner at 16:37:42.48 on Wed 03/10/2010
Internet Explorer: 7.0.5730.13

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\system32\ctfmon.exe
F:\dds.scr

============== Pseudo HJT Report ===============

mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearchAssistant = hxxp://www.google.com
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

============= SERVICES / DRIVERS ===============

R? AMDMSRIO;AMDMSRIO
S? HSFHWATI;HSFHWATI

=============== Created Last 30 ================

2010-03-04 01:37:49 0 d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software
2010-03-03 02:31:16 126 ----a-w- c:\windows\system32\mmc.exe.config

==================== Find3M ====================

2010-03-02 22:26:23 1023488 -c--a-w- c:\windows\system32\browseui(3).dll
2010-03-02 22:06:41 91648 ----a-w- C:\mtxoci_1.dll
2010-03-02 21:33:13 15360 ----a-w- c:\windows\system32\ctfmon.exe
2009-12-29 04:26:19 63488 ----a-w- C:\icardie.dll
2009-12-24 21:44:04 0 ----a-w- c:\documents and settings\owner\settings.dat
2009-08-31 01:55:31 18730 -c--a-w- c:\program files\common files\ilis.dat
2009-08-31 01:55:30 19576 -c--a-w- c:\program files\common files\zitawih.scr

============= FINISH: 16:38:13.00 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:47 AM

Posted 13 March 2010 - 09:16 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process. Please also continue to work with me until I give you the all clear. Even if your computer appears to act better, you may still be infected.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.

Once we start working together, please reply back within 3 days or this thread may be closed so we can help others who are waiting.

We need to create an OTL report,
  • Please download OTL from this link.
  • Save it to your desktop.
  • Double click on the icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Under the Custom Scan box paste this in:

    netsvcs
    msconfig
    activex
    drivers32
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32
    ahcix86s.sys
    nvrd32.sys
    /md5stop
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT

  • Click the Quick Scan button.
  • The scan should take a few minutes.
  • Please copy and paste both logs in your reply.

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new OTL log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


In your reply, please post both OTL logs and the GMER log.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#3 Asyr

Asyr
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 16 March 2010 - 01:37 PM

Sorry it has taken me a few days to respond. I was out of town. I got the instructions and am in the process of running the scans as requested and will post results when finished.


#4 Asyr

Asyr
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 16 March 2010 - 03:01 PM

My boyfriend's computer used to have malwarebyte's antimalware installed and logs from 08/30/09 show that it picked up multiple instances of files infected by PC_Antispyware2010 and the spyware family so to speak. I noticed several suspicious files as well such as msa.exe, b.exe, a.exe while in the process of trying to download an update for a program. The internet got hijacked and I wasn't able to get into any known security websites but instead got redirected. Then when I was finally able to download hijackthis I started the scan and it shut down and I was told I didn't have necessary permissions to run and then the same thing happened with Malwarebyte's and I still cannot get it to open. I get an .ocx error msg everytime. I cannot start any of the services and have an unknown owner file showing up but cannot locate it so am not able to back up personal files, etc. I was finally able to get hijackthis and other scans to work; however, no antispyware, antivirus etc can run as of yet. HELP!! I cannot turn on any services, or access the internet. I am able to open programs from an external jump drive or transfer from the jump to computer; however, I cannot do the reverse from computer to jump. I cannot run a backup of files and settings or open any programs. I have installed antispyware and tried to run it but I always get some type of installation or configuration error. Essentially I cannot do anything with this computer. I am posting copies of both the OTL log that I did while in safe mode as well as norma mode and the gmer log as requested. Thank you for your help.

Attached Files

  • Attached File  OTL.Txt   62.7KB   11 downloads
  • Attached File  otl1.txt   31.35KB   8 downloads
  • Attached File  ark.log   7.41KB   11 downloads


#5 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:47 AM

Posted 17 March 2010 - 06:09 PM

Hello, Asyr.

OK, thanks for the update. Let's run Combofix. It's very important that you run it from the hard drive of the infected computer...NOT from the flash drive.

next time you get an .ocx error, please report the full error.



One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you do decide to proceed, please continue with the fix below.

The log shows that you have been using so called peer-to-peer or file-sharing programmes (in your case Azereus). These programmes allow to share files between users as the name(s) suggest. In today's world the cyber crime has come a long way and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of their malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. I recommend that you uninstall this program. That is optional, however. If you decide to not uninstall, please refrain from using it until I let you know your computer is clean.



Step 1

Next, please download ComboFix from one of these locations:* IMPORTANT !!! Save ComboFix.exe to your Desktop as AsyrCF.exe
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on AsyrCF.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply, along with any symptoms that are present after it runs.

EDIT: PS> If you want to get files off of that computer before we do anything, let me know and we can create a bootable CD.

etavares

Edited by etavares, 17 March 2010 - 06:10 PM.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#6 Asyr

Asyr
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 17 March 2010 - 06:59 PM

hi, I got your instructions and am doing the steps you suggested. I don't have a problem doing a clean install except for the fact that I can't xfr files from my documents to an external drive or even run a backup of those files, and I cannot connect this computer to the internet. Everytime I try to turn on the services it says error 1068 and when I right click on properties the properties file won't open so I can't look at that either. Do you have a suggestion for this, I don't believe the recovery console is installed but will let you know. Ok, I tried what you recommended I do and I can't save it to the desktop, it will only let me run it from the jump drive. I believe this may be due to the services being disabled and me being unable to restart. Do you have any other suggestions?

Edited by Asyr, 17 March 2010 - 10:53 PM.


#7 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:47 AM

Posted 18 March 2010 - 05:26 PM

Hi Asyr-

Ok, we have a decision point here. I can offer the following choices.

First, see this article from Microsoft. Do you still get the 1068 error after trying these instructions?
http://support.microsoft.com/kb/827328

If no, we can install the recovery console manually.

Second, since you are ok reformatting, we can create a bootable CD that will allow you to boot up this computer and transfer any and all files off of it.

How would you like to proceed? Please let me know and I can post instructions.

Edited by etavares, 18 March 2010 - 05:53 PM.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#8 Asyr

Asyr
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 19 March 2010 - 11:47 AM

I believe at this point it is better to create a bootable cd so i can transfer the files and then I can proceed with the reformatting process. He has 5 disks that are his recovery/reinstall disks made when he first got the computer and I know they work.

#9 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:47 AM

Posted 19 March 2010 - 04:13 PM

Hello, Asyr.
OK, probably a wise decision based on what I see here. Please follow the steps below. You'll need a clean computer, a CD burner and a blank CD.

One note...when you boot up off of the boot CD, it will look like it loads, then hangs at 100% complete. Walk away and come back in 10-20 minutes and it'll work fine. You should be able to hook up a flash drive to back up your data, you can also access the web if you need to. Be careful backing it up. Stick to photos, videos, documents, etc. Don't back up full programs in case they are infected. Also, whatever you copy it to, please hold down Shift before you plug it into a clean computer so nothing infects the clean computer. Keep Shift pressed down from before you plug it in until it's recognized by your computer and says it's installed and ready to use. This keeps malware from autorunning. Then, scan the drive with an antivirus program before doing anything else.

If you only want to back it up, stop follow the instructions once you load up. If you want to try and repair it, continue on to create and OTLPE log.



Step 1After you have successfully burned the OTLPE ISO to disc you will need to transfer the disc to the CD drive of your sick computer and boot from it.
  • Insert the CD-ROM into the CD-ROM drive, and then restart the computer.
  • If your PC is not booting from the CD, you need to change the boot order:
    • Restart your PC
    • As soon as you get an image, press the Setup key. This is usually F2, or Del. On some machines the key can also be a different one. It should, however, be stated on the screen which key is the setup key.
    • Once you enter the computer's BIOS, use the arrow keys and tab key to move between elements. Press enter to select an item to change.
    • Navigate to the tab, where you can set the boot order. It should be called Boot or Boot order
    • The tab should now show your current boot order.
      If the CD-drive is not at the top, please navigate to the CD-Rom drive with the keys arrows. Then move it to the top of the list. The keys for switching boot position are usually + to move up and - to move down. However they can be different, but they should be stated in the help, so that you can find them easily.
    • Once the CD-drive is on top of the boot order, navigate to Exit and select Exit saving changes.
    • Your PC should now boot from your CD.
    • Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.
  • Please be patient as "Windows" loads
  • Your system should now display a REATOGO-X-PE desktop.
  • Double click on the icon on your desktop.
  • When asked "Do you wish to load the remote registry", select Yes
  • When asked "Do you wish to load remote user profile(s) for scanning", select Yes
  • Ensure the box "Automatically Load All Remaining Users" is checked and press OK
  • OTL should now start. Change the following settings
    • Under "Extra Registry" please check "Use Safelist" and also check "LOP Check" and "Purity Check" as pictured.
    • Copy and Paste the following code into the textbox. Do not include the word "code".

      Please note: Double click the Firefox Icon on the desktop to connect to this thread if you have a Wired connection otherwise you can use a flash drive and copy this script into a txt file from a clean computer to transfer to this computer.

      CODE
      netsvcs
      msconfig
      safebootminimal
      safebootnetwork
      activex
      drivers32
      %ALLUSERSPROFILE%\Application Data\*.
      %ALLUSERSPROFILE%\Application Data\*.exe /s
      %APPDATA%\*.
      %APPDATA%\*.exe /s
      %SYSTEMDRIVE%\*.exe
      /md5start
      userinit.exe
      winlogon.exe
      eventlog.dll
      scecli.dll
      netlogon.dll
      cngaudit.dll
      sceclt.dll
      ntelogon.dll
      logevent.dll
      iaStor.sys
      nvstor.sys
      atapi.sys
      IdeChnDr.sys
      viasraid.sys
      AGP440.sys
      vaxscsi.sys
      nvatabus.sys
      viamraid.sys
      nvata.sys
      nvgts.sys
      iastorv.sys
      ViPrt.sys
      eNetHook.dll
      ahcix86.sys
      KR10N.sys
      nvstor32.sys
      ahcix86s.sys
      /md5stop
      %systemroot%\*. /mp /s
      %systemroot%\system32\*.dll /lockedfiles
    • Push
    • When finished, the file will be saved in drive C:\OTL.txt
    • Please copy and paste the contents of the C:\OTL.txt file in your next reply.
    • Copy this file to your USB drive if you do not have an internet connection.
etavares

Edited by etavares, 19 March 2010 - 04:14 PM.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#10 Asyr

Asyr
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 20 March 2010 - 02:28 PM

Hi, thanks for the info. I will get that log posted asap. The only full program he has on the computer that can't be gotten again is his sniper game, but he has the disk for that to reinstall. I'll just back up the saved game portion for the profile. Other than that it will be pics, music and videos and other misc. files. However, I will take precaution and do as you stated with the shift key. I am on my lunch brk at work for now so this will have to wait until I get off tonight. Again thank you for your help with this problem and I agree with you and think it is best too. If wasn't for the files that can't be regotten easily esp some of mine I xfrd to his computer while I was trying to fix a drive issue and never had a chance to xfr back. I have antivirus running on all of my computers. I use Avast and Malewarebyte's so should be ok. Will post when finished and look for your response. One question did you still want me to run the combofix while I'm doing this as well or no. Let me know and if you want me to I will do.

#11 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:47 AM

Posted 21 March 2010 - 08:38 AM

No, please don't run combofix through OTLPE. It's not made for recovery environments.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#12 Asyr

Asyr
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 24 March 2010 - 02:02 PM

Hi,

Sorry it has taken me so long to get back to you. I have been really sick. Here is the scan logs you requested and I am in the process of transferring files off his computer as I send this. So far so good. Any suggestions as to how to proceed to make sure disk is securely wiped before running his recovery disks so to insure that the virus is shut down or do you see anything that indicates it can be fixed without having to start fresh. My opinion is the reformat and reinstall; but want to make sure.



Attached Files



#13 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:47 AM

Posted 25 March 2010 - 07:06 AM

Hi!

Hope you feel better. The important thing is to reformat the computer. Merely reinstalling will not necessarily eliminate a backdoor. Generally, a recovery disk should reformat the computer before restoring it to factory state. Here's some information for you.

We can always try to fix it, but reformatting a backdoor is the only way to truly know it is gone. I can't make the choice for you or him. smile.gif Just let me know if you want to try to fix it.

Here's a good article on how to reformat:
When Should I Format, How Should I Reinstall

Also, to protect yourself against malware and reduce your chance of reinfection in the future, I strongly recommend to have a look at following links (giving some advice and tips):


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#14 Asyr

Asyr
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 25 March 2010 - 08:23 PM

Hi,

Thanks for the links. I spoke with him about your suggestions as well as my concerns about not doing a reformat and clean installa nd he agrees that it would be better to just make sure there is no chance the backdoor can stay open. All of the files I transferred came up clean. I have to go through his computer one more time and make sure I didn't miss any files before I reformat the disk and I want to review that one link before I do the clean install. It probably won't get done until this weekend due to my work schedule but I will post when it's finished and let you know how it all went and how computer is doing as well as find out if there is anything else you want me to do at that point to make sure all is still ok. Thanks again for your help. It is greatly appreciated by both him and I.

#15 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:47 AM

Posted 28 March 2010 - 01:24 PM

OK, thanks for the heads up. I'll leave this thread open for a few days.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users