Jump to content


Photo

Help! Trojans have got me


  • Please log in to reply
9 replies to this topic

#1 PerplexedKylie

PerplexedKylie

    Member

  • Full Member
  • Pip
  • 28 posts

Posted 20 June 2004 - 10:35 AM

Hi. I hope someone can help me please. My homepage and favorites keep getting changed. I change them back, run Coolwebshredder v.1.59.0 and it fixes a problem with cws.therealsearch . I ran Spybot 1.3 and it fixed a few problems too. When I run Hijackthis v.1.97.7 it shows five registry entries (the ones starting with 01) which I delete, but they come back when I reboot. On top of all that I see in taskmanager that I have two files called toppop.exe running (which I stop). I ran Housecall and it found 18 problems (including toppop.exe) which it deleted but it couldn't delete two as they were .tmp files in use. When I rebooted and ran Housecall again I had 16 viruses back again (Troj Startpage, KrepperQ, ReopA etc). Here is my Hijackthis log ...

Logfile of HijackThis v1.97.7
Scan saved at 1:30:53 AM, on 21/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Kylie\Local Settings\Temp\HijackThis.exe

O1 - Hosts: 64.237.45.18 www.burstnet.com
O1 - Hosts: 64.237.45.18 oz.valueclick.com
O1 - Hosts: 64.237.45.18 a.tribalfusion.com
O1 - Hosts: 64.237.45.18 servedby.advertising.com
O1 - Hosts: 64.237.45.18 pagead2.googlesyndication.com
O2 - BHO: (no name) - {A9A674BF-771F-42E5-A440-D20DDA85A862} - C:\WINDOWS\System32\ho9jtr6xph.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msss] C:\WINDOWS\System32\msss.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [m4fm2wnxd5] C:\Program Files\Symantec\84yzr6eyto.exe
O4 - HKCU\..\Run: [Uninstal] regsvr32 /u /s image.dll
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macr...director/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.tre...all/Xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...7977.9865393518
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw15fd.law15....ex/HMAtchmt.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

When I fix all these problems with Spybot, CWShredder, Hijackthis and Housecall they all come back as soon as I reboot.

Any ideas would be appreciated. Thank you.

#2 syquest15

syquest15

    Member

  • Full Member
  • Pip
  • 3 posts

Posted 20 June 2004 - 11:29 AM

-ok first of all hijackthis.exe needs to have a folder of its own, it creates backups of what it fixes/deletes and you dont want potentionally serious files flowing around in a temporary folder.

-sometimes updating your security of internet explorer can help prevent these from occuring in the future so visit windows update here:
http://v4.windowsupd.../en/default.asp

-i see you have programs for spyware and virus/alike stuff, you can download adaware 6.0 and it will help you get rid of what the other two dont catch.
http://download.com....page&tag=button

-make sure you update adaware before running it. here is some directions on how to set up and run adaware the most effecient way:

Open ad-aware
- lower right hand side above start click on "search for updates" download and install those updates
- Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Scanning Engine:
check: "Unload recognized processes during scanning."

- Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Cleaning Engine:
Check: "Let Windows remove files in use at next reboot."

Press 'Proceed'

Press 'Start'

- Select option 'Use Custom scanning options'
- Click 'Activate in-depth scan'
- Press 'Select drives\folders to scan' Select the active partition which is usually C:
- Click Customize
- Make the following are all are Checked
*'Scan Within Archives'
*'Scan Active Processes'
*'Scan Registry'
*'Deep Scan Registry'
*'Scan My IE Favorites For Banned URL'S
*'Scan My Hosts File'
- Click Proceed

Now press "Next" to let Ad-aware scan your drives...

Allow the Ad-aware to fix what it finds.

-next im going to have you download another file called DLLFIX. what hapens with CWS trjoans is when you get infect, a .dll file usually pops up somewhere when you are being hijacked, these .dll files are usually totally random named and stand out if you've seen a few before. in your case here is your problem .dll file:

O2 - BHO: (no name) - {A9A674BF-771F-42E5-A440-D20DDA85A862} - C:\WINDOWS\System32\ho9jtr6xph.dll.
(fixing this file in hijackthis will usually only respawn another dll file with a different name)

download ddl fix here.
http://tools.zerosrealm.com/dllfix.exe

-directions for dllfix:

Doubleclick it and install in folder of choice but on the root drive, most likely C:\

1.Run start.bat and press option 1. 'output.txt' will be created in the folder

2. IF hidden dll was successfully found, run start.bat again and choose option 2. Hit '1' and enter dll name manually.

3. If dll was not found after first running start.bat : Run start.bat again and choose option '2'. You must reboot after doing so.

post the contents of that output.txt in this thread.

#3 PerplexedKylie

PerplexedKylie

    Member

  • Full Member
  • Pip
  • 28 posts

Posted 20 June 2004 - 08:20 PM

Thanks for trying but I still haven't managed to fix this. I ran Adaware as you said and it removed 18 problems. Spybot says everything's clean. I tried to run the dllfix program but it doesn't look the way you said it should. There's only one application file called "AboutBlaster" and when I run it, it asks me for the URL of the homepage that comes up (i.e. http://www.searchmyrequest.com/hp.php). When I put that in, it tells me that it's an incorrect URL. Did I not download the right thing ??

I still have the unusual file toppop.exe running in the background. I haven't relocated HijackThis into its own folder yet but will do so. I seem to have even more unwanted entries in my HijackThis log as you can see. The dll file you talked about has disappeared and not replaced by anything as far as I can see.


Logfile of HijackThis v1.97.7
Scan saved at 11:00:38 AM, on 21/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Kylie\Local Settings\Temp\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmyrequest.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmyrequest.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmyrequest.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmyrequest.com/hp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmyrequest.com/sp.php
O1 - Hosts: 64.237.45.18 ad.doubleclick.net
O1 - Hosts: 64.237.45.18 aff.weatherbug.com
O1 - Hosts: 64.237.45.18 www.burstnet.com
O1 - Hosts: 64.237.45.18 oz.valueclick.com
O1 - Hosts: 64.237.45.18 a.tribalfusion.com
O1 - Hosts: 64.237.45.18 servedby.advertising.com
O1 - Hosts: 64.237.45.18 my.search
O1 - Hosts: 64.237.45.18 pagead2.googlesyndication.com
O1 - Hosts: 209.87.155.230 date.com
O1 - Hosts: 209.87.155.230 dating.com
O1 - Hosts: 209.87.155.230 freedating.com
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msss] C:\WINDOWS\System32\msss.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [f18wvzjj5b] C:\Program Files\Symantec\84yzr6eyto.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macr...director/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.tre...all/Xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...7977.9865393518
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw15fd.law15....ex/HMAtchmt.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab


What should I do now ? It looks like I didn't complete the dllfix thing properly but I can't see how to do it.

#4 Suzuko2

Suzuko2

    Member

  • New Member
  • Pip
  • 1 posts

Posted 20 June 2004 - 09:01 PM

I found this at zerosrealm.com: "Warning: As of yesterday (June 17, 2004), the DLLFix was pulled by Shadowwar. All mirrors that hosted the DLLFix will remain down until Shadowwar releases a new, more stable version."

#5 PerplexedKylie

PerplexedKylie

    Member

  • Full Member
  • Pip
  • 28 posts

Posted 21 June 2004 - 01:51 AM

Oh. Does that mean the problem can't be fixed until someone comes up with a new remedy ???

#6 PerplexedKylie

PerplexedKylie

    Member

  • Full Member
  • Pip
  • 28 posts

Posted 22 June 2004 - 05:46 AM

I have looked around and the dllfix.exe file is not downloadable anywhere.

Does that mean that this trojan is free to replicate all around the world until the file is available again ?

Does anybody have any idea where I might be able to get this file ???

#7 PerplexedKylie

PerplexedKylie

    Member

  • Full Member
  • Pip
  • 28 posts

Posted 22 June 2004 - 09:39 AM

I'm not sure if what I just did is correct or not ....

I was trying to fix my problem myself without the dllfix.exe file and I thought I'd look at what's causing toppop.exe running at startup. I hit Start/Run and typed msconfig and looked at the startup thingies. There was one called 84yzr6eyto which looked odd, so I unchecked it. It lives in the folder C:\program files\symantec so I suppose it looks like it's part of Norton Antivirus ?

After I rebooted all the funny web favorites disappeared and my homepage is staying the way it's supposed to be. When I run cwshredder it doesn't see anything wrong. The only problem is that on booting, WindowsXP shows me a panel saying that I changed my System Configuration and it'll keep warning me about it every login unless I change it back. To experiment, I did change it back and got the trojan again.

Can anyone tell me if I'm doing something wrong in temporarily leaving things like this until the dllfix.exe file becomes available again to remove the trojan ???

#8 dave38

dave38

    Devout Murphyite!

  • Emeritus
  • PipPipPipPipPip
  • 8,508 posts

Posted 22 June 2004 - 02:26 PM

I don't think you need Dllfix for this one.

The message you are getting is from msconfig itself, warning that you have changed something. If the file is removed permanently, there will be no need ot run msconfig, so no error message!

Have Hijack This fix all of the following by placing a check in the appropriate boxes and hitting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmyrequest.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmyrequest.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmyrequest.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmyrequest.com/hp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmyrequest.com/sp.php
O1 - Hosts: 64.237.45.18 ad.doubleclick.net
O1 - Hosts: 64.237.45.18 aff.weatherbug.com
O1 - Hosts: 64.237.45.18 www.burstnet.com
O1 - Hosts: 64.237.45.18 oz.valueclick.com
O1 - Hosts: 64.237.45.18 a.tribalfusion.com
O1 - Hosts: 64.237.45.18 servedby.advertising.com
O1 - Hosts: 64.237.45.18 my.search
O1 - Hosts: 64.237.45.18 pagead2.googlesyndication.com
O1 - Hosts: 209.87.155.230 date.com
O1 - Hosts: 209.87.155.230 dating.com
O1 - Hosts: 209.87.155.230 freedating.com

O4 - HKLM\..\Run: [msss] C:\WINDOWS\System32\msss.exe
O4 - HKLM\..\Run: [f18wvzjj5b] C:\Program Files\Symantec\84yzr6eyto.exe

Reboot and delete

files
C:\WINDOWS\System32\msss.exe
C:\Program Files\Symantec\84yzr6eyto.exe

These may be hidden files. See HERE for how to show hidden files.

Please post a followup Hijack this log, and say if your problems persist.
Be wary of strong drink. It may make you shoot at tax collectors, and miss!
Please support SWI forum

#9 syquest15

syquest15

    Member

  • Full Member
  • Pip
  • 3 posts

Posted 22 June 2004 - 09:05 PM

addd moderator thanks for replying i had a family emergency. i apologize for starting to help and not finishing, but you feel free to take it from here:)

#10 PerplexedKylie

PerplexedKylie

    Member

  • Full Member
  • Pip
  • 28 posts

Posted 23 June 2004 - 09:38 AM

Thank you Dave. I think you might have solved this for me. And thanks too, Syquest, I appreciate your help too and I hope all is ok in your family. I got rid of the items Dave listed if I saw any of them. I deleted the msss.exe item from registry but it didn't seem to exist as a file. I deleted the 84yzr6eyto.exe registry & file. I ran CWShredder & Adaware and all was clean.

Here's what my log looks like now.

Logfile of HijackThis v1.97.7
Scan saved at 12:17:33 AM, on 24/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Documents and Settings\Kylie\Local Settings\Temp\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.9\THGuard.exe"
O4 - HKLM\..\Run: [winmain] winmain.exe
O4 - HKLM\..\Run: [win32app] C:\WINDOWS\System32\winpup32.exe
O4 - HKLM\..\Run: [MSMGT] C:\WINDOWS\MSMGT.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [System Soap Pro] C:\PROGRA~1\SYSTEM~1\soap.exe min
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macr...director/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://housecall.tre...all/Xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...7977.9865393518
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw15fd.law15....ex/HMAtchmt.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab


Does all this look ok to you guys now ? Anything else to delete ? Some of these lines look like I don't need them.... e.g.

O4 - HKLM\..\Run: [MSMGT] C:\WINDOWS\MSMGT.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [System Soap Pro] C:\PROGRA~1\SYSTEM~1\soap.exe min
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnote...ad/mnviewer.cab

I have no idea what these do. Would it be safe to delete these items from the registry ?


re:
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe

This one looks like that awful Gator adware but I don't see any GMT.exe file anywhere and WinExplorer reveals no such folders. Should I delete it ?

I propose uninstalling HijackThis (how ?) and thereby getting it out of the temp folder. Then I will reinstall it under its own folder. Sound ok ?

Many thanks again for all your help. I appreciate it.
Kylie




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button