FBI Moneypak - Safe Mode not safe.

lukeguild · March 30, 2013

Hello,

My laptop was infected by an FBI Moneypak virus early today, I usually can get around these with a system restore and virus clean, but this one isn't allowing me to enter safe mode - and my system recovery restores are failing. I noticed that you've been instructing to grab a couple logs from the FRST tool, so I took the liberty to save some time and grab those (I realize this violates your warning to not d/l software unless directed to do so, sorry). Hopefully you can help me out here:

LOG #1 - FRST.txt


Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 13-03-2013 (ATTENTION: FRST version is 17 days old)

Ran by SYSTEM at 30-03-2013 18:06:21
Running from H:\
Windows 7 Home Premium   (X64) OS Language: English(US)
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10775584 2010-05-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3  [2040352 2010-05-31] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] %ProgramFiles%\Apoint\Apoint.exe [212480 2010-05-31] (Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [952768 2010-03-24] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [38840 2009-12-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [640440 2009-12-21] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [36272 2010-04-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SmartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup [89080 2010-07-15] (Sony Electronics Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" [673136 2010-05-31] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [600928 2010-06-01] (Sony Corporation)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421160 2011-06-07] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)
HKU\Lucas Guild\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-11-11] (Google Inc.)
HKU\Lucas Guild\...\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe" [495616 2007-09-02] ()
HKU\Lucas Guild\...\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3077528 2011-09-16] ()
HKU\Lucas Guild\...\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe -update activex [231888 2010-11-11] (Adobe Systems, Inc.)
HKU\Lucas Guild\...\Winlogon: [Shell] explorer.exe,C:\Users\Lucas Guild\AppData\Roaming\skype.dat
HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [296960 2009-07-13] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Lucas Guild\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

==================== Services (Whitelisted) ===================

3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [399432 2012-09-29] (Malwarebytes Corporation)
2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [676936 2012-09-29] (Malwarebytes Corporation)
2 NIS; "C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\18.5.0.125\diMaster.dll" /prefetch:1 [262584 2010-12-02] (Symantec Corporation)
2 Oasis2Service; "C:\Program Files (x86)\DDNi\Oasis2Service 1.0\Oasis2Service.exe" [47616 2011-03-14] ()
2 SampleCollector; "C:\Program Files\Sony\VAIO Care\VCPerfService.exe" "/service" "/sstates" "/sampleinterval=2000" "/procinterval=5" "/dllinterval=120" "/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1" "/counter=\Network Interface(*)\Bytes Total/sec:1" "/expandcounter=\Processor Information(*)\Processor Frequency:1" "/expandcounter=\Processor(*)\% Idle Time:1" "/expandcounter=\Processor(*)\% C1 Time:1" "/expandcounter=\Processor(*)\% C2 Time:1" "/expandcounter=\Processor(*)\% C3 Time:1" "/expandcounter=\Processor(*)\% Processor Time:1" "/directory=inteldata" [252416 2010-05-25] (Sony Corporation)
2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
3 VUAgent; "C:\Program Files\Sony\VAIO Update 5\VUAgent.exe" [1250160 2010-05-31] (Sony Corporation)

==================== Drivers (Whitelisted) =====================

3 ArcSoftKsUFilter; C:\Windows\System32\Drivers\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\BASHDefs\20101123.003\BHDrvx64.sys [953904 2010-11-23] (Symantec Corporation)
1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-12-25] (Symantec Corporation)
1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\IPSDefs\20101227.001\IDSvia64.sys [476792 2010-11-08] (Symantec Corporation)
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [25928 2012-09-29] (Malwarebytes Corporation)
3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\VirusDefs\20101227.034\ENG64.SYS [117880 2010-12-25] (Symantec Corporation)
3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\VirusDefs\20101227.034\EX64.SYS [1791096 2010-12-25] (Symantec Corporation)
3 SRTSP; C:\Windows\System32\Drivers\NISx64\1205000.07D\SRTSP64.SYS [735864 2010-11-22] (Symantec Corporation)
1 SRTSPX; C:\Windows\system32\drivers\NISx64\1205000.07D\SRTSPX64.SYS [40568 2010-11-22] (Symantec Corporation)
0 SymDS; C:\Windows\System32\drivers\NISx64\1205000.07D\SYMDS64.SYS [450608 2010-10-20] (Symantec Corporation)
0 SymEFA; C:\Windows\System32\drivers\NISx64\1205000.07D\SYMEFA64.SYS [802864 2010-11-17] (Symantec Corporation)
3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174640 2010-12-26] (Symantec Corporation)
1 SymIRON; C:\Windows\system32\drivers\NISx64\1205000.07D\Ironx64.SYS [171128 2010-11-15] (Symantec Corporation)
1 SymNetS; C:\Windows\System32\Drivers\NISx64\1205000.07D\SYMNETS.SYS [382072 2010-11-30] (Symantec Corporation)
2 MSSQL$DDNI;  [x]

==================== NetSvcs (Whitelisted) ====================


==================== One Month Created Files and Folders ========

2013-03-30 18:06 - 2013-03-30 18:06 - 00000000 ____D C:\FRST
2013-03-30 10:57 - 2013-03-30 10:57 - 00000000 ____D C:\ProgramData\ldpnm
2013-03-14 23:01 - 2013-03-30 17:35 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-03-09 15:02 - 2013-03-09 15:02 - 00000000 ____D C:\ProgramData\APN
2013-03-03 11:58 - 2013-03-03 11:58 - 00026928 ____A C:\Users\Public\Documents\Mail%20Count%20Calculator%20-%20updated%20August%202012(1)2.xlsx

==================== One Month Modified Files and Folders =======

2013-03-30 18:06 - 2013-03-30 18:06 - 00000000 ____D C:\FRST
2013-03-30 17:42 - 2011-09-17 07:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-03-30 17:42 - 2011-09-16 13:55 - 00000000 ____D C:\ProgramData\PMB Files
2013-03-30 17:42 - 2011-02-23 15:06 - 00000000 ____D C:\Users\Lucas Guild\AppData\Roaming\Dev-Cpp
2013-03-30 17:42 - 2010-12-25 07:24 - 00000000 ____D C:\Users\Lucas Guild\AppData\Roaming\uTorrent
2013-03-30 17:42 - 2010-12-16 06:03 - 00000000 ____D C:\users\Lucas Guild
2013-03-30 17:42 - 2010-11-11 21:38 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-03-30 17:42 - 2010-11-11 20:48 - 00000000 ____D C:\users\boinc_master
2013-03-30 17:42 - 2010-11-11 20:15 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-03-30 17:42 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-03-30 17:42 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\AppCompat
2013-03-30 17:42 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-03-30 17:41 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
2013-03-30 17:39 - 2011-02-23 15:17 - 00000000 ____D C:\Users\Lucas Guild\AppData\Roaming\SoftGrid Client
2013-03-30 17:35 - 2013-03-14 23:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-03-30 12:13 - 2011-09-16 13:55 - 00000000 ____D C:\Users\Lucas Guild\AppData\Local\PMB Files
2013-03-30 11:07 - 2010-12-25 17:41 - 00000000 ____D C:\Users\Lucas Guild\AppData\Local\Deployment
2013-03-30 10:57 - 2013-03-30 10:57 - 00000000 ____D C:\ProgramData\ldpnm
2013-03-10 15:47 - 2012-12-14 18:04 - 00000000 ____D C:\Users\Lucas Guild\AppData\Local\CrashDumps
2013-03-09 15:02 - 2013-03-09 15:02 - 00000000 ____D C:\ProgramData\APN
2013-03-03 11:58 - 2013-03-03 11:58 - 00026928 ____A C:\Users\Public\Documents\Mail%20Count%20Calculator%20-%20updated%20August%202012(1)2.xlsx

==================== Known DLLs (Whitelisted) =================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-01-15 00:01:18
Restore point made on: 2013-01-16 00:01:11
Restore point made on: 2013-02-04 15:43:57
Restore point made on: 2013-02-13 00:00:37
Restore point made on: 2013-03-14 23:00:31
Restore point made on: 2013-03-19 23:00:37

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 3950.1 MB
Available physical RAM: 3349.15 MB
Total Pagefile: 3948.25 MB
Available Pagefile: 3339.55 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:451.64 GB) (Free:374.5 GB) NTFS
2 Drive e: (Recovery) (Fixed) (Total:14.03 GB) (Free:0.76 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive f: (OFFICE14) (CDROM) (Total:1.29 GB) (Free:0 GB) UDF
4 Drive g: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
5 Drive h: () (Removable) (Total:1.91 GB) (Free:1.81 GB) FAT
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
7 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

  Disk ###  Status		 Size	 Free	 Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0	Online		  465 GB	  0 B		
  Disk 1	Online		 1953 MB	  0 B		

Partitions of Disk 0:
===============

Disk ID: 0062F5A2

  Partition ###  Type			  Size	 Offset
  -------------  ----------------  -------  -------
  Partition 1	Recovery			14 GB  1024 KB
  Partition 2	Primary			100 MB	14 GB
  Partition 3	Primary			451 GB	14 GB

==================================================================================

Disk: 0
Partition 1
Type  : 27
Hidden: Yes
Active: No

  Volume ###  Ltr  Label		Fs	 Type		Size	 Status	 Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 4	 E   Recovery	 NTFS   Partition	 14 GB  Healthy	Hidden  

=========================================================

Disk: 0
Partition 2
Type  : 07
Hidden: No
Active: Yes

  Volume ###  Ltr  Label		Fs	 Type		Size	 Status	 Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2	 Y   System Rese  NTFS   Partition	100 MB  Healthy			

=========================================================

Disk: 0
Partition 3
Type  : 07
Hidden: No
Active: No

  Volume ###  Ltr  Label		Fs	 Type		Size	 Status	 Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3	 C				NTFS   Partition	451 GB  Healthy			

=========================================================

Partitions of Disk 1:
===============

Disk ID: 00000000

  Partition ###  Type			  Size	 Offset
  -------------  ----------------  -------  -------
  Partition 1	Primary		   1952 MB   122 KB

==================================================================================

Disk: 1
Partition 1
Type  : 06
Hidden: No
Active: No

  Volume ###  Ltr  Label		Fs	 Type		Size	 Status	 Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 5	 H				FAT	Removable   1952 MB  Healthy			

=========================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 0062F5A2

Partition 1:
=========
Hex: 0020210027FEFFFF0008000000D0C001
Active: NO
Type: 27
Size: 14 GB

Partition 2:
=========
Hex: 80FEFFFF07FEFFFF00D8C00100200300
Active: YES
Type: 07 (NTFS)
Size: 100 MB

Partition 3:
=========
Hex: 00FEFFFF07FEFFFF00F8C30130607438
Active: NO
Type: 07 (NTFS)
Size: 452 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 00000000

Partition 1:
=========
Hex: 00033900063FFFDFF50000000B073D00
Active: NO
Type: 06
Size: 2 GB


Last Boot: 2013-03-14 23:49

==================== End Of Log =============================

Log #2 - Search.txt



Farbar Recovery Scan Tool (x64) Version: 13-03-2013
Ran by SYSTEM at 2013-03-30 18:07:58
Running from H:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

====== End Of Search ======

Thanks, Luke

gringo_pr · March 30, 2013

Hello lukeguild

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt

 
HKU\Lucas Guild\...\Winlogon: [Shell] explorer.exe,C:\Users\Lucas Guild\AppData\Roaming\skype.dat
HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [296960 2009-07-13] (Microsoft Corporation)

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST again like we did before but this time press the Fix button just once and wait.

The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.

Also boot the computer into normal mode and let me know how things are looking.

Gringo

lukeguild · March 31, 2013

fixlog.txt


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2013
Ran by SYSTEM at 2013-03-30 21:42:54 Run:1
Running from H:\

==============================================

HKEY_USERS\Lucas Guild\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\*Restore Value deleted successfully.

==== End of Fixlog ====

Computer Startup

Everything seems to be running smoothly - and more importantly my desktop is clear of the Moneypak overlay.

PS

Thanks so much for your timely assistance gringo - you've been awesome

gringo_pr · March 31, 2013

Hello lukeguild

These are the programs I would like you to run next, if you have any problems with these just skip it and move on to the next one.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

lukeguild · April 1, 2013

Hey Gringo -

I'm still actively working on this, I just don't have access to the laptop until tomorrow. Thanks for your patience.

I'll be sure to update here on my progress.

gringo_pr · April 1, 2013

no problem and thank you for letting me know

gringo

gringo_pr · April 3, 2013

Greetings

I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time.

Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools

Gringo

lukeguild · April 3, 2013

Neither

I'll be working on it this afternoon, I'll keep you updated.

Thanks Gringo

gringo_pr · April 4, 2013

OK I will be around

gringo

gringo_pr · April 6, 2013

Greetings

I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time.

Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools

Gringo

gringo_pr · April 10, 2013

Hello

48 Hour bump

It has been more than 48 hours since my last post.

do you still need help with this?
do you need more time?
are you having problems following my instructions?
if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

Maurice Naggar · April 15, 2013

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

FBI Moneypak - Safe Mode not safe.

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information