Jump to content


Photo

about:blank


  • This topic is locked This topic is locked
13 replies to this topic

#1 steve

steve

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 31 May 2004 - 05:19 AM

My homepage has been hijacked to about:blank and I get annoying spyware popups. Please help.

Here is my hijackthis log:

Logfile of HijackThis v1.97.7
Scan saved at 3:13:29 AM, on 5/31/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Acrobat3\Distillr\DISTASST.EXE
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\Program Files\America Online 8.0\waol.exe
C:\Program Files\America Online 8.0\aolwbspd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\schannel.exe
C:\Documents and Settings\Oink\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ocdcdnd.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ocdcdnd.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ocdcdnd.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ocdcdnd.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ocdcdnd.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ocdcdnd.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {089C37BB-5FE0-4AED-A02E-F93CEF051309} - C:\WINDOWS\System32\ocdcdnd.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [schannel] C:\WINDOWS\system32\schannel.exe
O4 - Startup: CompuServe 2000 Tray Icon.lnk = C:\CompuServe 2000\cstray.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Distiller Assistant 3.01.lnk = C:\Acrobat3\Distillr\DISTASST.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Microsoft® JavaScript® Console (HKLM)
O9 - Extra 'Tools' menuitem: JavaScript Console (HKLM)
O9 - Extra button: Microsoft® JavaScript® Console (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console (HKCU)
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.micr...b?1081488713390
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...38085.934525463
O17 - HKLM\System\CCS\Services\Tcpip\..\{8EE7F11B-B7C3-4AEA-9C24-849ABDDFEB15}: NameServer = 198.81.18.4

#2 steve

steve

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 31 May 2004 - 06:23 AM

bump

#3 freeatlast

freeatlast

    E x p l o r e r

  • Retired Staff
  • PipPipPipPipPip
  • 833 posts

Posted 31 May 2004 - 06:41 AM

Download and install: >>Find-All.exe (Win2K/XP only!)<<
Run : 'FIND-ALL.CMD', post the log.
Submit Files: Posted Image
----------------------------------------------------------------------
Posted ImagePosted ImagePosted Image

#4 steve

steve

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 31 May 2004 - 06:43 AM

Here it is
--==***@@@ 'FIND-ALL' »»*Original*»» VERSION 8.7 -5/30 @@@***==--


Mon May 31 04:32:54 2004 -- ++Results:
»»System Info:

Microsoft Windows XP [Version 5.1.2600]
'Find-All' is running from Drive:
C: "" (944B:6668) - FS:NTFS clusters:4k
Total: 41 060 593 664 [38G] - Free: 34 641 297 408 [32G]


»»IE version and Service packs:
6.0.2800.1106 C:\Program Files\Internet Explorer\Iexplore.exe
--a-- W32i APP ENU 6.0.2800.1106 shp 91,136 08-29-2002 iexplore.exe

! REG.EXE VERSION 2.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
MinorVersion REG_SZ ;SP1;Q832894;Q330994;

»»Google:

»»UserAgent:
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]


»»Wmplayer version:
8.0.0.4490 C:\Program Files\Windows Media Player\wmplayer.exe
--a-- W32i APP ENU 8.0.0.4490 shp 520,192 04-11-2003 wmplayer.exe
6.4.9.1125 C:\Program Files\Windows Media Player\mplayer2.exe
--a-- W32i APP ENU 6.4.9.1125 shp 4,639 08-29-2002 mplayer2.exe

»»M$Java version:
5.0.3810.0 C:\WINDOWS\System32\msjava.dll
--a-- W32i DLL ENU 5.0.3810.0 shp 947,472 02-28-2003 msjava.dll

»»NotePad(s) version(s)... added Tnx to shadoWWWW ;)
5.1.2600.0 C:\WINDOWS\notepad.exe
--a-- W32i APP ENU 5.1.2600.0 shp 66,048 08-29-2002 notepad.exe


»»PC uptime:
4:32am up 0 days, 19:44

»»Locked or 'Suspect' file(s) found...
\\?\C:\WINDOWS\System32\KBDJMPF.DLL +++ File read error
\\?\C:\WINDOWS\System32\KBDJMPF.DLL +++ File read error


»»Tasks (services):
0 System Process
4 System
572 SMSS.EXE
636 CSRSS.EXE Title:
660 WINLOGON.EXE Title: NetDDE Agent
712 SERVICES.EXE Svcs: Eventlog,PlugPlay
724 LSASS.EXE Svcs: PolicyAgent,ProtectedStorage,SamSs
892 SVCHOST.EXE Svcs: RpcSs
972 SVCHOST.EXE Svcs: AudioSrv,BITS,Browser,CryptSvc,Dhcp,ERSvc,EventSystem,FastUserSwitchingCompatibi
ity,helpsvc,lanmanserver,lanmanworkstation,Netman,Nla,RasMan,Schedule,seclogon,S
NS,SharedAccess,ShellHWDetection,srservice,TapiSrv,TermService,Themes,TrkWks,upl
admgr,w32tim
1196 SVCHOST.EXE Svcs: Dnscache
1220 SVCHOST.EXE Svcs: LmHosts,SSDPSRV,WebClient
1332 EXPLORER.EXE Title: Program Manager
1460 SPOOLSV.EXE Svcs: Spooler
1528 mcagent.exe Title: McAgent_Main_Hidden_Window
1544 mcvsshld.exe Title: ##VSO###MCVSSHLD##
1552 Support.exe Title: Support
1592 aoltray.exe Title:
1612 DISTASST.EXE Title: Distiller Assistant 3.01
1620 NotifyAlert.exe Title: WindowsFormsParkingWindow
1652 EasyShare.exe Title:
1680 backWeb-7288971.Kodak Software Updater AgentTitle: Kodak Software Updater Agent
1776 HOTSYNC.EXE Title: PNRP Window
2000 ALG.EXE Svcs: ALG
2012 CISVC.EXE Svcs: CiSvc
2044 KodakCCS.exe Svcs: KodakCCS
172 mcvsrte.exe Svcs: MCVSRte
204 nvsvc32.exe Svcs: NVSvc
220 ScsiAccess.EXE Svcs: ScsiAccess
308 wanmpsvc.exe Svcs: WANMiniportService
1560 McShield.exe Svcs: McShield
2496 CIDAEMON.EXE
2520 CIDAEMON.EXE Title: OleMainThreadWndName
2028 AcroRd32.exe Title: AVToolTipView
3352 waol.exe Title: America Online provided by Dell®
2640 aolwbspd.exe Title:
3808 IEXPLORE.EXE Title: SWI Forums -> Malware Removal - Microsoft Internet Explorer
3064 schannel.exe Title: OleMainThreadWndName
1028 CMD.EXE Title: C:\WINDOWS\System32\cmd.exe
2644 NTVDM.EXE
3796 tlist.exe
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{089C37BB-5FE0-4AED-A02E-F93CEF051309}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]

REGEDIT4

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter]

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/octet-stream]
"CLSID"="{1E66F26B-79EE-11D2-8710-00C04F79ED0D}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/x-complus]
"CLSID"="{1E66F26B-79EE-11D2-8710-00C04F79ED0D}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/x-msdownload]
"CLSID"="{1E66F26B-79EE-11D2-8710-00C04F79ED0D}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\Class Install Handler]
@="AP Class Install Handler filter"
"CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\deflate]
@="AP Deflate Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\gzip]
@="AP GZIP Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml]
@="AP lzdhtml encoding/decoding Filter"
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html]
"CLSID"="{4E7BF0A1-B3BB-42EE-B414-3652C8685F75}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/plain]
"CLSID"="{4E7BF0A1-B3BB-42EE-B414-3652C8685F75}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml]
@="WebView MIME Filter"
"CLSID"="{733AC4CB-F1A4-11d0-B951-00A0C90312E1}"

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

»»Security settings for 'Windows' key:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Full access DD541D31\Oink
(ID-IO) ALLOW Full access CREATOR OWNER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read BUILTIN\Users
Full access BUILTIN\Administrators
Full access NT AUTHORITY\SYSTEM
Full access DD541D31\Oink




»»Size of 'Windows' key: (Defaults *450)
Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 398

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows\SYS:Microsoft\Windows NT\CurrentVersion\Windows : AppInit_DLLs

»»Group/user settings:


User: [DD541D31\Oink], is a member of:

BUILTIN\Administrators
\Everyone

User is a member of group DD541D31\None.
User is a member of group \Everyone.
User is a member of group BUILTIN\Administrators.
User is a member of group BUILTIN\Users.
User is a member of group \LOCAL.
User is a member of group NT AUTHORITY\INTERACTIVE.
User is a member of group NT AUTHORITY\Authenticated Users.

»»ACLs list:
C:\junkxxx BUILTIN\Administrators:F
BUILTIN\Administrators:(OI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
DD541D31\Oink:F
CREATOR OWNER:(OI)(CI)(IO)F
BUILTIN\Users:R
BUILTIN\Users:(OI)(CI)(IO)(special access:) GENERIC_READ
GENERIC_EXECUTE

BUILTIN\Users:(CI)(special access:) FILE_APPEND_DATA

BUILTIN\Users:(CI)(special access:) FILE_WRITE_DATA


ERROR: There are no more files.
»»Contents of file(s) in 'junkxxx' folder:

»»Md5sums

MD5sums 1.1 freeware for Win9x/ME/NT/2000/XP+
Copyright © 2001-2002 Jem Berkes - http://www.pc-tools.net/


0 bytes, 0 ms = 0.00 MB/sec
------
»»Rehash:

Mon May 31 04:33:10 2004 -- ++Find-All backups created:
A C:\Find-All\Find-All\winBackup.hiv
A C:\Find-All\Find-All\windows.txt
A C:\FindallwinBackup.hiv
A C:\findallappinit.reg

***Next Registry run should open this key directly:

! REG.EXE VERSION 2.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
LastKey REG_SZ My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows



#5 freeatlast

freeatlast

    E x p l o r e r

  • Retired Staff
  • PipPipPipPipPip
  • 833 posts

Posted 31 May 2004 - 07:39 AM

Ok...
I see some *new problems on your log.

Can you do this, run search for notepad.exe and post
back where it was found.
You should have a copy in the system32
folder (as well as in Windows), presumably missing...

Next,

Your Windows registry is set to open this key directly:
*My Computer\HKEY_LOCAL_MACHINE\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows*

Go to Start/run/type:
regedit
The registry should open with the Windows Subfolder
hilited.
(*compare and be sure the path on the status
bar is same as indicated above!)

See if there is a value named, "AppInit_Dlls" on the right side pane.
According to your log it doesn't exist! :scratchhead:

Also do 'find-files' for: "KBDJMPF.DLL" and
post back whether it was found anywhere...

There is a file created: C:\FindallwinBackup.hiv
Click on the 'Submit' tab in my signature and mail that file there.

I suspect you might have a new strain
and some of our known steps may no longer work...
Or it's possible you don't have the same problem.
Submit Files: Posted Image
----------------------------------------------------------------------
Posted ImagePosted ImagePosted Image

#6 steve

steve

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 31 May 2004 - 08:01 AM

Freeatlast,
Some of the confusion is my fault. I looked on the other "about:blank posts" and followed some of your earlier advice and deleted the AppInit_Dlls file. The log you saw is after I did that and so unfortunately only partially reflects your earlier directions.

Subsequent to my last posting I rebooted into safe mode and deleted
C:\WINDOWS\System32\ocdcdnd.dll
and C:\WINDOWS\System32\KBDJMPF.DLL.

It seems to have worked. Hopefully that was the right thing to do.

#7 steve

steve

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 31 May 2004 - 08:12 AM

Thanks to you and Pomp.

#8 freeatlast

freeatlast

    E x p l o r e r

  • Retired Staff
  • PipPipPipPipPip
  • 833 posts

Posted 31 May 2004 - 08:21 AM

The log you saw is after I did that and so unfortunately only partially reflects your earlier directions

I see...

There is a minor issue if you didn't back
up the key (hiv) manually.
It's security settings is lost, and merged to all other Subfolders &userGroups.

In my 'Find-All' there is a backup created as first step,
And remerge as last step!
, but it seems you renamed your key
previously to that, so the restore won't accomplish anything.

There is no known way to restore it by hand.
You should look up the security templates
applicable to your OS ,
presumably XP 'home' and find a way
to reset/restore "basicwk.inf", or
whichever template is applicable.

XP home is unlikely to be as affected by this as 2K/XP pro.
Hopefully you can leave it as it is. :scratchhead:
Submit Files: Posted Image
----------------------------------------------------------------------
Posted ImagePosted ImagePosted Image

#9 steve

steve

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 31 May 2004 - 08:34 AM

This is far beyond my understanding-- but I did go through a step of renaming the folder that AppInit_Dlls was in before I did anything and then subsequently changed the folder name back (if that previous sentence makes any sense). Anyway, how can I verify if I screwed anything up major?

#10 freeatlast

freeatlast

    E x p l o r e r

  • Retired Staff
  • PipPipPipPipPip
  • 833 posts

Posted 31 May 2004 - 08:42 AM

Well, I'm not sure at which point you renamed the 'Windows' key.
Since you decided to follow this on your own, there is no way to tell..

However, IF you ran 'Find-All prior to
renaming the key, you can use the
backup it created.

To restore you just need to follow these steps.
(You can ignore the 'junkxxx.zip'/email part.)

http://www.spywarein...t=0

As previously stated, if you renamed
it BEFORE first Find-All run, it
would make no difference.
Submit Files: Posted Image
----------------------------------------------------------------------
Posted ImagePosted ImagePosted Image

#11 steve

steve

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 31 May 2004 - 08:52 AM

Thanks. I followed the steps. How can I verify if it restored things or not?

#12 freeatlast

freeatlast

    E x p l o r e r

  • Retired Staff
  • PipPipPipPipPip
  • 833 posts

Posted 31 May 2004 - 09:01 AM

How can I verify if it restored things or not?

As previously stated, if you renamed
it BEFORE first Find-All run, it
would make no difference.

It was restored to defaults *only* the way 'Find'All saw it the first time it ran.
It can't repair what wasn't there.

The minute you rename 'secured' key, Windows assigns
new default templates as if a brand new key is created.
Whatever was listed for key before, is removed.

If you ran Find-All first, it makes a backup of
previously stored settings and later
the 'Zipzap' reset them back.

If all works well you don't have to worry much.
Submit Files: Posted Image
----------------------------------------------------------------------
Posted ImagePosted ImagePosted Image

#13 steve

steve

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 31 May 2004 - 09:11 AM

Oh well. It seems to be working fine. Thanks for the help.

#14 cnm

cnm

    Mother Lion of SWI

  • Administrators
  • PipPipPipPipPip
  • 25,317 posts

Posted 01 June 2004 - 08:56 AM

Glad we could help. :)

If you need this topic reopened, please request this by sending the moderating team an email with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Microsoft MVP Windows Security 2005-2006
How camest thou in this pickle? -- William Shakespeare:(1564-1616)
The various helper groups here
UNITE





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button