Vundo + MS Juan headache

[whiz]

Hi,

I recently was infected with the Vundo Trojan and Malwarebytes was successfully able to remove all the traces on the first run. However both the Trojan and MS Juan keep coming back as either registry key entries or different files.

Currently i experience intermediate slowdown, windows paging keeps growing until it is maxed out, pop ups and the malware/trojan entries even after successful deletion.

I have attached the log files for hijackthis and mbam below

HIJACKTHIS (I have replaced certain folder/file names with XXXX to preserve confidentiality)

---------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:39:49 PM, on 3/10/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\Iron Mountain\Connected BackupPC\AgentService.exe

C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe

C:\Program Files\Network ICE\BlackICE\blackd.exe

C:\PROGRA~1\CYBERG~1\cgasvc.exe

C:\PROGRA~1\CYBERG~1\cgagent.exe

C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

c:\winnt\system32\domtimec.exe

C:\WINNT\system32\PMService.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Fiberlink\Mobile Access Services\FLUtilsSvc.exe

C:\Program Files\Tivoli\lcf\bin\w32-ix86\mrt\lcfd.exe

C:\Program Files\Rational\ClearCase\bin\lockmgr.exe

C:\Program Files\McAfee\DLP\Agent\fcags.exe

C:\Program Files\McAfee\Common Framework\FrameworkService.exe

C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

C:\Program Files\McAfee\DLP\Agent\fcagswd.exe

C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

C:\WINNT\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Fiberlink\Mobile Access Services\ServiceMgr.exe

C:\Program Files\Common Files\SupportSoft\bin\sprtlisten.exe

C:\Program Files\SupportSoft\65sp6\bin\sprtsvc.exe

C:\WINNT\system32\StacSV.exe

C:\WINNT\system32\svchost.exe

C:\Program Files\SupportSoft\65sp6\bin\tgsrvc.exe

C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\WINNT\system32\cccredmgr.exe

C:\Program Files\McAfee\DLP\Agent\fcag.exe

C:\Program Files\McAfee\DLP\Agent\FCAGT.EXE

C:\WINNT\Explorer.EXE

C:\Program Files\Fiberlink\Mobile Access Services\e360sysTray.exe

C:\WINNT\system32\igfxpers.exe

C:\Program Files\Apoint\Apoint.exe

C:\WINNT\stsystra.exe

C:\WINNT\system32\igfxsrvc.exe

C:\PROGRA~1\Dell\QuickSet\quickset.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Apoint\ApMsgFwd.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\PROGRA~1\CYBERG~1\cgahelp.exe

C:\Program Files\Apoint\HidFind.exe

C:\PROGRA~1\CYBERG~1\cgav.exe

C:\Program Files\Apoint\Apntex.exe

C:\winnt\system32\wscript.exe

C:\Program Files\McAfee\Common Framework\udaterui.exe

C:\Program Files\SupportSoft\65sp6\bin\sprtcmd.exe

C:\PROGRA~1\SUPPOR~1\65sp6\bin\ghdirupd.EXE

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\Program Files\Razer\DeathAdder\razerhid.exe

C:\Program Files\Iron Mountain\Connected BackupPC\Agent.exe

C:\Program Files\pdfforge Toolbar\SearchSettings.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe

C:\WINNT\system32\ctfmon.exe

C:\Program Files\Microsoft Office Communicator\Communicator.exe

C:\Program Files\Razer\DeathAdder\razerofa.exe

C:\Program Files\SSH Communications Security\SSH Tectia\SSH Tectia AUX\Support binaries\ssh-broker-gui.exe

C:\WINNT\System32\svchost.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.yahoo.com/search/options

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =

R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll

O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_15\bin\ssv.dll

O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll

O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll

O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll

O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll

O4 - HKLM\..\Run: [Persistence] "C:\WINNT\system32\igfxpers.exe"

O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"

O4 - HKLM\..\Run: [sigmatelSysTrayApp] "C:\WINNT\stsystra.exe"

O4 - HKLM\..\Run: [Dell QuickSet] "C:\PROGRA~1\Dell\QuickSet\quickset.exe"

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [CgaHelper] "C:\PROGRA~1\CYBERG~1\cgahelp.exe" -check

O4 - HKLM\..\Run: [CgaViewer] "C:\PROGRA~1\CYBERG~1\cgav.exe" -check

O4 - HKLM\..\Run: [userstate] "c:\winnt\system32\wscript.exe" "c:\program files\XXXX\userstate\VPNmonitor.vbs"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [EPA_EZ_GPO_Tool] "C:\WINNT\system32\EZ_GPO_Tool.exe"

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [supportSoft65sp6] "C:\Program Files\SupportSoft\65sp6\bin\sprtcmd.exe" /P SupportSoft65sp6

O4 - HKLM\..\Run: [GetHelp Directory Update] "C:\PROGRA~1\SUPPOR~1\65sp6\bin\ghdirupd.EXE" /DB PROD

O4 - HKLM\..\Run: [swdisUsrPCN.B001C2355CBD6] "C:\PROGRA~1\Tivoli\lcf\dat\1\cache\lib\w32-ix86\wdusrpcn.exe" "C:\Program Files\Tivoli\swdis\1\wdusrpcn.envB001C2355CBD6"

O4 - HKLM\..\Run: [synchronization Manager] "%SystemRoot%\system32\mobsync.exe" /logon

O4 - HKLM\..\Run: [DeathAdder] "C:\Program Files\Razer\DeathAdder\razerhid.exe"

O4 - HKLM\..\Run: [AgentUiRunKey] "C:\Program Files\Iron Mountain\Connected BackupPC\Agent.exe" -ni -sss -e http://localhost:16386/

O4 - HKLM\..\Run: [searchSettings] "C:\Program Files\pdfforge Toolbar\SearchSettings.exe"

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [Ad-Watch] "C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe"

O4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe" /startintray

O4 - HKCU\..\Run: [FR] "C:\WINNT\system32\wscript.exe" "C:\Program Files\XXXX\Utilities\Folder Redirection\FRLaunch.vbs"

O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINNT\system32\ctfmon.exe"

O4 - HKCU\..\Run: [COMMUNICATOR] "C:\Program Files\Microsoft Office Communicator\Communicator.exe"

O4 - HKUS\S-1-5-19\..\Run: [FR] wscript "C:\Program Files\XXXX\Utilities\Folder Redirection\FRLaunch.vbs" (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [kepusevate] Rundll32.exe "C:\WINNT\system32\diposeli.dll",s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [Office setup] C:\Program Files\Microsoft Office\Office12\startup.exe /s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [Netmeeting setup] C:\Program Files\NetMeeting\startup.exe /s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [bAC_ShellSettings] "C:\Program Files\XXXX\Utilities\ShellSettings.exe" (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [Visio Setup] C:\Program Files\Microsoft Office\Visio11\visio.exe /s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [FR] wscript "C:\Program Files\XXXX\Utilities\Folder Redirection\FRLaunch.vbs" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [Office setup] C:\Program Files\Microsoft Office\Office12\startup.exe /s (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [FR] wscript "C:\Program Files\XXXX\Utilities\Folder Redirection\FRLaunch.vbs" (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [Office setup] C:\Program Files\Microsoft Office\Office12\startup.exe /s (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [FR] wscript "C:\Program Files\XXXX\Utilities\Folder Redirection\FRLaunch.vbs" (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [Office setup] C:\Program Files\Microsoft Office\Office12\startup.exe /s (User 'Default user')

O4 - Global Startup: SSH Tectia Broker.lnk = C:\Program Files\SSH Communications Security\SSH Tectia\SSH Tectia AUX\Support binaries\ssh-broker-gui.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: *.bankofamerica.com

O15 - Trusted Zone: *.efidelity.com

O15 - Trusted Zone: *.knowledgenet.com

O15 - Trusted Zone: *.skire.com

O15 - Trusted Zone: *.bankofamerica.com (HKLM)

O15 - Trusted Zone: *.knowledgenet.com (HKLM)

O16 - DPF: {B2FC031D-8C74-46AE-8042-BCF4FC03C1EF} (Loader Class v4) - http://cr2cltiis33e.bankofamerica.com/qcbin/Spider91.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nc.bankofamerica.com

O17 - HKLM\Software\..\Telephony: DomainName = nc.bankofamerica.com

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nc.bankofamerica.com

O20 - AppInit_DLLs: c:\winnt\system32\befologo.dll zqocwu.dll c:\winnt\system32\humalodo.dll ygaxpe.dll bfyash.dll c:\winnt\system32\nogilini.dll boyooj.dll,

O20 - Winlogon Notify: ccnotify - C:\WINNT\SYSTEM32\ccnotify.dll

O20 - Winlogon Notify: FCAGWL - C:\WINNT\SYSTEM32\fcagwl.dll

O20 - Winlogon Notify: FLWLEvents - C:\Program Files\Fiberlink\Mobile Access Services\FiberlinkNetProv.dll

O23 - Service: AgentService - Iron Mountain Incorporated - C:\Program Files\Iron Mountain\Connected BackupPC\AgentService.exe

O23 - Service: Atria Location Broker (Albd) - IBM Corporation - C:\Program Files\Rational\ClearCase\bin\albd_server.exe

O23 - Service: XXXX - Network Monitor - Unknown owner - C:\Program Files\XXXX\BankofAmericaNetworkMonitor\BNM.exe

O23 - Service: Extend360 Enforcement Agent (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe

O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\Network ICE\BlackICE\blackd.exe

O23 - Service: Rational Cred Manager (cccredmgr) - IBM Corporation - C:\WINNT\system32\cccredmgr.exe

O23 - Service: CyberGatekeeper Agent (CGAgent) - InfoExpress - C:\PROGRA~1\CYBERG~1\cgasvc.exe

O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

O23 - Service: Domain Time Client - Greyware Automation Products, Inc. - c:\winnt\system32\domtimec.exe

O23 - Service: Energy Star EZ GPO Power Management Configuration Tool (EPA_GPO_PMService) - TerraNovum - C:\WINNT\system32\PMService.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: System Connect Util Service (FLUtilsSvc) - Fiberlink Communications Corp. - C:\Program Files\Fiberlink\Mobile Access Services\FLUtilsSvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: Tivoli Endpoint (lcfd) - Unknown owner - C:\Program Files\Tivoli\lcf\bin\w32-ix86\mrt\lcfd.exe

O23 - Service: IBM Rational Lock Manager (LockMgr) - IBM Corporation - C:\Program Files\Rational\ClearCase\bin\lockmgr.exe

O23 - Service: McAfee DLP Agent Service (McAfeeDLPAgentService) - McAfee Inc. - C:\Program Files\McAfee\DLP\Agent\fcags.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\Network ICE\BlackICE\RapApp.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Extend360 Agent (ServiceMgr) - Fiberlink Communications Corp. - C:\Program Files\Fiberlink\Mobile Access Services\ServiceMgr.exe

O23 - Service: SupportSoft Listener Service (sprtlisten) - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\sprtlisten.exe

O23 - Service: SupportSoft Sprocket Service (supportsoft65sp6) (sprtsvc_supportsoft65sp6) - SupportSoft, Inc. - C:\Program Files\SupportSoft\65sp6\bin\sprtsvc.exe

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINNT\system32\StacSV.exe

O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe

O23 - Service: SupportSoft Repair Service (supportsoft65sp6) (tgsrvc_supportsoft65sp6) - SupportSoft, Inc. - C:\Program Files\SupportSoft\65sp6\bin\tgsrvc.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe

O23 - Service: XXXX - Workstation Update (WKSTUPD) - XXXX - C:\Program Files\XXXX\WkstUpd\WkstUpd.exe

O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe

--

End of file - 15582 bytes

MBAM

-------

Malwarebytes' Anti-Malware 1.34

Database version: 1831

Windows 5.1.2600 Service Pack 2

3/10/2009 5:49:48 PM

mbam-log-2009-03-10 (17-49-48).txt

Scan type: Quick Scan

Objects scanned: 80147

Time elapsed: 2 minute(s), 39 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Can you help here? Let me know if you require additional information. Hope i have followed the 'HJT Post Instructions' properly.

Thanks for your help in advance

Regards

whiz

[AdvancedSetup]

STEP 01

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

ComboFix.exe

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Click
  Yes
  to allow ComboFix to continue scanning for malware.
  
  
• When the tool is finished, it will produce a report for you.
  
  
• Please post the
  C:\ComboFix.txt
  along with a
  new HijackThis log
  so we may continue cleaning the system.
  
  

STEP 02

Please create a BOOTLOG
• Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
  
• Select "Enable Boot Logging" option and press enter.
  
• Windows prompts you to select a Windows Installation (even if there is only one windows installation)
  
• This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows

[whiz]

I appreciate your help! I would try out these steps and get back to you shortly.

Regards,

whiz

[AdvancedSetup]

Please post a status update on this.

[AdvancedSetup]

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.