Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unidentified Root-kit


  • This topic is locked This topic is locked
3 replies to this topic

#1 sfan985

sfan985

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:18 PM

Posted 13 July 2010 - 01:32 PM

I initially posted this in the other forum, but I've asked for it's removal. Here is the condensed version. Thank you in advance for any and all help.


My Windows Vista Home x32 desktop started having trouble loading up a few days ago. It would load up to a black screen right where Vista would usually make the welcome sound, and then restart. Also, it would load into the recovery screen. The other times, my computer would not load at all. I immediately considered a hardware problem to be the source of my issues, but I'm second guessing myself and so I am here.

Some symptoms I have noticed :

Recurring iexplore.exe processes running immediately at start up that do not stay turned off. I downloaded process explore to try and turn them off more easily, but they continue to come back. I do not use IE. I checked the properties and they all seem to be located in the correct location C:\programfiles\Internet Explorer\ . At any given time between 3-6 will run expect immediatly after process killing, where only 2 will run

Too many svchost.exe running. I am accustomed to 4, not the current 14. I've turned off a few services to see if it would limit the number, but there is no correlation between service shut offs (I keep them limited anyway) and how many are running.

Three taskeng.exe run at any given time. I am accustomed to 1. Also 2 csrss.exe running.

Windows will start with my desktop rearranged, or icons missing. Every time is a surprise. My basic windows settings are also in constant transition with every boot up (what icons are by my start icon, what the theme is, transparency of that top bar above each window, etc. Recent documents only just started working again. Firefox was asking me with every boot to make it the default. It also did not save my bookmarks above the tabs which are visible. Right now it's kept one over two boot sessions. They were all deleted a few boots ago.


What I have done: Installed and run mbam, which ran regularly anyway, avg, and Windows defender (which ran scans regularly as well.) Nothing on that end.

Run GMER.exe but nothing in it resembles any problems documented online. (edit: I am not even close to competent at this though, and I see things which look like problems, but I don't what I am doing here.)

Run MBR.exe The log shows a problem on the user level in reading the MBR.

Run Combofix (I was desperate, and did all the required work as stated in the guide prior to) It deleted some loose ends from a game I had called Mafia that hasn't been accessed in ages. Nothing else.

As we speak there are 5 instances of iexplore.exe running, with mem use ranging form 20k to 75k . Any ideas? I know this is a doozy. I do not want to restore to factory default, but I understand I may have to. However, considering what I've read about rootkits, even that is not a perfect cure.

After the initial post I did find someone else's post and so I tried these fixes:

I had a warning come up telling me unkown boot code has come up on some of my physical drives.


I tried the fix using the program bootkit remover by running "remover.exe fix" from command prompt , and I received an error that reads: No Standard Boot Code found for your OS. Then it lists the OS's.. vista is included.
This is my MBR dump. I seem to have found an issue.

00000000: 31 c0 8e d8 8e c0 8e d0 bc 00 7c be 00 7c bf 00 | 1.........|..|..
00000010: 06 b9 80 00 fd fc fc f3 66 a5 90 ea 20 06 00 00 | ........f... ...
00000020: 66 31 c0 be be 07 b1 04 66 50 66 b8 37 03 00 00 | f1......fPf.7...
00000030: 66 58 66 39 44 08 72 08 66 8b 44 08 66 03 44 0c | fXf9D.r.f.D.f.D.
00000040: 83 c6 10 83 2e 88 06 04 e2 e8 66 09 c0 74 3d 66 | ..........f..t=f
00000050: 83 c0 02 b9 40 00 bb 00 7c bf 01 07 83 2e 88 06 | ....@...|.......
00000060: 04 e8 69 00 72 26 66 68 83 c4 14 90 90 90 66 68 | ..i.r&fh......fh
00000070: 04 46 e2 f9 66 68 80 ff d7 30 66 68 89 c3 b9 00 | .F..fh...0fh....
00000080: 66 68 be 00 7c 66 0f 83 76 75 90 e8 be be 07 b1 | fh..|f..vu......
00000090: 04 80 3c 80 74 0d 38 2c 0f 85 97 00 83 c6 10 e2 | ..<.t.8,........
000000a0: f0 cd 18 66 8b 44 08 89 e3 b9 01 00 e8 1e 00 73 | ...f.D.........s
000000b0: 0d 8b 4c 02 b8 01 02 cd 13 90 0f 82 90 00 81 3e | ..L............>
000000c0: fe 7d 55 aa 0f 85 a8 00 ea 00 7c 00 00 66 60 bb | .}U.......|..f`.
000000d0: aa 55 b4 41 cd 13 73 04 f9 66 61 c3 81 fb 55 aa | .U.A..s..fa...U.
000000e0: 75 f6 f6 c1 01 74 f1 66 61 66 60 90 6a 00 6a 00 | u....t.faf`.j.j.
000000f0: 66 50 06 53 51 6a 10 b4 42 89 e6 cd 13 61 66 61 | fP.SQj..B....afa
00000100: c3 66 69 db fd 43 03 00 66 81 c3 c3 9e 26 00 66 | .fi..C..f....&.f
00000110: 89 d8 66 c1 e8 10 66 25 ff 00 00 00 c3 66 56 66 | ..f...f%.....fVf
00000120: 5e 5e ac 08 c0 74 fc 56 1e bb 07 00 b4 0e cd 10 | ^^...t.V........
00000130: 1f eb ea e8 e7 ff 49 6e 76 61 6c 69 64 20 70 61 | ......Invalid pa
00000140: 72 74 69 74 69 6f 6e 20 74 61 62 6c 65 00 e8 cc | rtition table...
00000150: ff 45 72 72 6f 72 20 6c 6f 61 64 69 6e 67 20 6f | .Error loading o
00000160: 70 65 72 61 74 69 6e 67 20 73 79 73 74 65 6d 00 | perating system.
00000170: e8 aa ff 4d 69 73 73 69 6e 67 20 6f 70 65 72 61 | ...Missing opera
00000180: 74 69 6e 67 20 73 79 73 74 65 6d 00 00 00 00 00 | ting system.....
00000190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000001a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
000001b0: 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 01 | ...........0....
000001c0: 01 00 de fe 3f 06 3f 00 00 00 08 b7 01 00 00 02 | ....?.?.........
000001d0: 3c 07 07 fe ff ff 00 b8 01 00 00 00 e0 01 80 fe | <...............
000001e0: ff ff 07 fe ff ff 00 b8 e1 01 00 a0 56 38 00 00 | ............V8..
000001f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa | ..............U.



Here is the DDS log:


DDS (Ver_10-03-17.01) - NTFSx86
Run by SYSTEM at 14:07:23.72 on Tue 07/13/2010
Internet Explorer: 8.0.6001.18928 BrowserJavaVersion: 1.6.0_07
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3069.1753 [GMT -4:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
svchost.exe 4
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\spoolsv.exe
svchost.exe 4
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\UnHackMe\hackmon.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\locator.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_6fa9efce\STacSV.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\XPSMiniViewGadget\XPSMiniViewGadget.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\config\systemprofile\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [combofix] c:\combo-fix\cf21052.cfxxe /c c:\combo-fix\Combobatch.bat
mRunOnce: [combofix] c:\combo-fix\cf21052.cfxxe /c c:\Combo-FixCombobatch.bat
dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10e.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

================= FIREFOX ===================

FF - ProfilePath - c:\windows\system32\config\system~1\appdata\roaming\mozilla\firefox\profiles\mgjynjza.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-7-12 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-7-12 29584]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-12 308136]
R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atipmdag.sys [2010-2-3 5313536]
R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2010-2-2 150016]
R3 Rtnicxp;Dynex DX-E102/E202 10/100Mb NDIS Driver;c:\windows\system32\drivers\Rtnicxp.sys [2010-1-22 50688]
S0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [2010-7-12 35816]
S3 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-2-3 172032]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2009-11-14 36608]
S3 LNE100;Linksys LNE100TX(v5) Fast Ethernet Adapter;c:\windows\system32\drivers\lne100v5.sys [2010-1-15 36224]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2010-7-12 24416]
S3 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [2009-12-17 99152]

=============== Created Last 30 ================

2010-07-13 16:47:10 0 ----a-w- c:\windows\system32\config\systemprofile\defogger_reenable
2010-07-13 16:46:38 50477 ----a-w- C:\Defogger.exe
2010-07-13 16:35:00 499712 ----a-w- C:\remover.exe
2010-07-13 15:56:24 52432 ----a-w- c:\windows\system32\drivers\klmd.sys
2010-07-13 15:34:22 77312 ----a-w- c:\windows\MBR.exe
2010-07-13 15:34:21 256512 ----a-w- c:\windows\PEV.exe
2010-07-13 15:34:21 161792 ----a-w- c:\windows\SWREG.exe
2010-07-13 15:34:20 98816 ----a-w- c:\windows\sed.exe
2010-07-13 15:31:16 0 d-s---w- C:\Combo-Fix
2010-07-13 14:57:24 3738561 ----a-r- C:\Combo-Fix.exe
2010-07-13 05:55:17 10341832 ----a-w- C:\windows-kb890830-v3.8.exe
2010-07-13 03:36:16 147456 ----a-w- C:\catchme.exe
2010-07-13 03:35:36 77312 ----a-w- C:\mbr.exe
2010-07-13 01:50:04 0 d-----w- c:\windows\RestoreSafeDeleted
2010-07-13 01:49:58 24416 ----a-w- c:\windows\system32\drivers\regguard.sys
2010-07-13 01:36:17 2 --shatr- c:\windows\winstart.bat
2010-07-13 01:36:07 37600 ----a-w- c:\windows\system32\Partizan.exe
2010-07-13 01:36:07 35816 ----a-w- c:\windows\system32\drivers\Partizan.sys
2010-07-13 01:35:54 12808 ----a-w- c:\windows\system32\drivers\UnHackMeDrv.sys
2010-07-13 01:35:51 0 d-----w- c:\program files\UnHackMe
2010-07-13 01:23:49 909176 ----a-w- C:\WGAPluginInstall.exe
2010-07-13 00:56:01 3313664 ----a-w- C:\bootwizard.exe
2010-07-13 00:01:19 0 d-----w- c:\program files\Sophos
2010-07-12 23:35:25 0 d-----w- c:\windows\system32\config\systemprofile\Pavark
2010-07-12 23:33:04 0 d-----w- C:\IrfanView
2010-07-12 19:18:18 3887480 ----a-w- C:\procexp.exe
2010-07-12 18:35:19 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-12 18:35:13 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-12 18:35:11 0 d-----w- c:\windows\system32\drivers\Avg
2010-07-12 15:47:40 0 d-----w- c:\programdata\avg9
2010-07-12 13:31:11 0 d-----w- c:\programdata\WindowsSearch
2010-07-12 11:37:16 16409960 ----a-w- C:\spybotsd162.exe
2010-07-12 10:10:57 0 d-----w- C:\backups
2010-07-12 04:15:03 0 d-sh--w- c:\windows\system32\%APPDATA%
2010-07-12 04:14:27 174943782 ----a-w- c:\windows\MEMORY.DMP

==================== Find3M ====================

2010-05-26 17:06:41 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47:41 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 18:14:28 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-04 05:59:21 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55:42 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55:42 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31:05 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13:48 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-05-01 03:20:52 86016 ----a-w- c:\windows\inf\infpub.dat
2010-05-01 03:20:52 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-05-01 03:20:52 143360 ----a-w- c:\windows\inf\infstor.dat
2010-04-23 14:13:55 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-28 21:59:26 665600 ----a-w- c:\windows\inf\drvindex.dat
2008-01-21 02:43:21 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2006-09-29 05:57:04 489216 ----a-w- c:\windows\inf\wn121t\WN121TXP.sys
2006-07-05 16:21:50 212992 ----a-w- c:\windows\inf\wn121t\CopyWHQLDriver.exe
2009-10-14 16:52:18 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-05-22 02:16:05 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009052120090522\index.dat
2010-01-19 04:13:57 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 14:09:07.00 ===============


I can't seem to find the attach option as shown on the preparation guide. - Found it, attachments are in place.

Attached Files


Edited by sfan985, 13 July 2010 - 02:15 PM.


BC AdBot (Login to Remove)

 


#2 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:03:18 AM

Posted 18 July 2010 - 04:35 PM

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.
  • Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Options box to the right of your topic title and selecting Track This Topic.

  • Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.

  • Please reply to this post so I know you are there.
The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

Once I receive a reply then I will return with your first instructions.

Thanks thumbup2.gif
Posted Image
m0le is a proud member of UNITE

#3 sfan985

sfan985
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:18 PM

Posted 19 July 2010 - 01:47 AM

Well, I tried to wait a few days, but I caved. I went ahead and used a regular trick to fix the MBR by using my partition drive. It didn't work off of CD, but the partition drive did the trick. Now, I have no more strange iexplore.exe, my documents are back, and the MBR is coming back clear. I tried finding the files using mbam and avg with no results, but I have a feeling that I didn't get this through a file but rather through some sort of firefox attack (a bad site?)

Sorry, I did not mean to be impatient, but you guys are busy, and I'm not incompetent. Thanks for your time and guides though.

Edit: Also, can you guys add a message saying that posts are not handled necessarily in order. I had my computer on for 3 days straight waiting, and frustrated, because people who posted after me got helped first, and my logs were being downloaded but not a word. I didn't post anything about it because I was told in my original topic on "Am I infected?" that if I reply to my own posts, it'll take even longer because usually you all search for people with 0 responses. Thanks. It'll take some frustration away and keep people from going off and working on it on their own. I only caved because there didn't seem to be much rhyme or reason to the order or hope that I'd get addressed. Thanks again for all you guys do, and I know you are swamped, but a fair warning would help. Thanks.

Edited by sfan985, 19 July 2010 - 01:55 AM.


#4 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:03:18 AM

Posted 19 July 2010 - 01:58 PM

There is a system which shows the order of waiting logs and this is followed by most of the volunteers but it is because we are volunteers that the owner of this site has no real control over which logs the volunteers take. It also comes down to levels of experience of these volunteers as to what they feel comfortable taking. Trainees are also asked to take newer logs so that they get a higher chance of a reply and therefore gain valuable experience and training and are able to graduate and become fully fledged helpers.

In most cases the order is followed. I understand it is frustrating but there is a system and no-one on this site is overlooked. smile.gif

------------------------------------------------------------------------------

This topic has been closed.

If you're the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.




Posted Image
m0le is a proud member of UNITE




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users