Help with removing Trojan: Win32/Fuery.B!cl

[Unforgiven4]

Hello All, 

    Windows defender recently notified me of malware called: Trojan: Win32/Fuery.B!cl. Anti virus was able to quarantine the trojan which I then removed. I very stupidly got this trojan through a torrent download. Now I am a rather paranoid person when it comes to this type of thing so I did a complete factory reset on my windows 10 OS machine to be safe. Although Windows Defender full scan indicates that no malware is present, I am still concerned. Any help with determining for sure if all traces of the malware are gone would be greatly appreciated. Thank you to all! 

[Android8888]

Hello Unforgiven4 and  Forum.

I'm Android 8888 and I'll be helping you with your malware issues. Please ask questions if anything is unclear.

Please follow the instructions below to download and execute a scan on your system with FRST, and provide the two logs in your next reply for my review.

• Download the right version of FRST for your system:
  
  • FRST 32-bit
  • FRST 64-bit
    Note: Only the right version will run on your system, the other will throw an error message. So if you don't know what your system's version is, simply download both of them, and the one that works is the one you should be using.
    
• Move the executable (FRST.exe or FRST64.exe) on your Desktop;
• Right-click on the executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• Accept the disclaimer by clicking on Yes, and FRST will then do a back-up of your Registry which should take a few seconds;
• Make sure the Addition.txt box is checked;
• Click on the Scan button;
  
  Credits: Aura
• On completion, two message box will open, saying that the results were saved to FRST.txt and Addition.txt, then open two Notepad files;
• Please attach both files (FRST.txt and Addition.txt) in your next reply;
  

Thank you.

[Unforgiven4]

Hello Android 8888!

     Thank you for your help with this. I have attached the files as requested.

Addition.txt

FRST.txt

[Android8888]

Hello Unforgiven4.

I did not find any signs of malware at all in the logs. I prepared a fix just to do some tidy up.

Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST64.exe executable is located); DO NOT open that file.
• Right-click on the FRST executable and select Run as Administrator;
• Click on the Fix button;
  
• On completion, a message will come up saying that the fix has been completed and it'll open a log (fixlog.txt) in Notepad;
• Copy and paste its content in your next reply;
  

Next,

Malwarebytes - Scan Mode

• Download and install the free version of Malwarebytes
  Note: It's your choice if you want to enable the free trial of Malwarebytes Premium or not. Enabling it will give you real-time protection from the program, as well as access to all the Premium features.
  Note: If you have Malwarebytes already installed, you don't need to install it again. Simply start from the next bullet point;
• Once Malwarebytes is installed, launch it and let it update his database. You might have to click on the little arrow by Scan Status in the middle right pane for it to do so;
• Once the database update is complete, on the left pane select Settings;
• Select the Protection tab;
• Scroll down to Scan Options and ensure Scan for Rootkits and Scan within Archives are both on and leave all other settings to default.
• Go back to DashBoard and select the blue Scan Now tab;
• Let the scan run, the time required to complete the scan depends of your system and computer specs;
• Once the scan is complete, click on the Saves Results button, and select Copy to clipboard;
• From there, paste the entire content of the clipboard in your next reply;
  

In your next reply please post:
The content of fixlog.txt;
The content of Malwarebytes log.

How is your computer running at this point?

fixlist.txt

[Unforgiven4]

Hello Android 8888!

    Here is the malwarebytes scan log with the settings set as you described in your post:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/18/17
Scan Time: 2:15 PM
Logfile: 
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.75
Update Package Version: 1.0.1533
License: Trial

-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: DESKTOP-73C649I\Meelad

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 393306
Time Elapsed: 6 min, 40 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 2
PUP.Optional.RegHunter, C:\USERS\MEELAD\DOWNLOADS\REGHUNTER-INSTALLER.EXE, No Action By User, [1210], [331752],1.0.1533
PUP.Optional.SpyHunter, C:\USERS\MEELAD\DOWNLOADS\SPYHUNTER-INSTALLER.EXE, No Action By User, [1682], [345850],1.0.1533

Physical Sector: 0
(No malicious items detected)

(end)

*********************************************************************

Here are the contents of the fixlog.txt :

Fix result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
Ran by Meelad (18-03-2017 14:07:19) Run:1
Running from C:\Users\Meelad\Desktop
Loaded Profiles: Meelad (Available Profiles: defaultuser0 & Meelad)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
CreateRestorePoint:
EmptyTemp:

CHR Extension: (Chrome Web Store Payments) - C:\Users\Meelad\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-17]
CHR Extension: (Chrome Media Router) - C:\Users\Meelad\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-17]
2017-03-18 00:59 - 2017-03-18 00:48 - 3518640 _____ (Enigma Software Group USA, LLC.) C:\Users\Meelad\AppData\Local\Temp\EsgInstallerResumeAction_c41ba453d63fb2715ec548fb97cc40cb.exe
2017-03-18 02:12 - 2017-03-18 02:14 - 262587304 _____ () C:\WINDOWS\TEMP\bd_8762.tmp\wub8773.tmp

End
*****************

Processes closed successfully.
Restore point was successfully created.
C:\Users\Meelad\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => moved successfully
C:\Users\Meelad\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm => moved successfully
C:\Users\Meelad\AppData\Local\Temp\EsgInstallerResumeAction_c41ba453d63fb2715ec548fb97cc40cb.exe => moved successfully
C:\WINDOWS\TEMP\bd_8762.tmp\wub8773.tmp => moved successfully

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 5321729 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 10795230 B
Edge => 8782054 B
Chrome => 122041987 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 2438 B
NetworkService => 12816 B
defaultuser0 => 588289 B
Meelad => 33378214 B

RecycleBin => 0 B
EmptyTemp: => 172.5 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 14:08:08 ====

 

 

I hope I have done everything correctly. Thank you very much for your help. Also I wanted to let you know of a few things. I have done numerous scans and such with various programs and I have gotten varying results. I will list what I have done so far with their respective results. This is why I am paranoid as to whether or not the trojan has been removed or not. Some programs say there is no malicious files others say there are!.

Windows Defender Full Scan : Clean

Bitdefender Antivirus: Clean

Malwarebyes (as instructed here) : 2 threats found.

FRST 64 logs (as instructed here) : Clean

Microsoft malicious software removal tool: This is a strange one. As the scan is running, the number of files scanned number is steadily increasing. While the scan is running, it provides a running total of threats found so far. As the scan is running, the program tells me it found 4 (on the first scan) and 7 files (on the second scan). However once the scan fully completes, I get a message saying : Microsoft malicious software removal tool has completed its scan. No threats have been found. Why is it saying there are threats present while the scan is running, but says there are no threats present once the scan finishes.?

Microsoft safety scanner: Clean.

 

Thank you again for your help!

[Android8888]

Hello Unforgiven4.
Thank you for the logs and information.

 

8 hours ago, Unforgiven4 said:

I hope I have done everything correctly. Thank you very much for your help.

Yes you did everything correctly and you are very welcome.

The 2 threats detected by Malwarebytes are called Potentially Unwanted Programs (PUP). A PUP is a program that is sometimes added to a System without the user's knowledge or approval. Besides, they are usually bundled with a bunch of crap-ware such as advertisements, install annoying toolbars in your browsers, and slow down your computer. However this type of threats are not in themselves considered malware.

You may also want to read the following articles:
https://blog.malwarebytes.com/malwarebytes-news/2016/10/malwarebytes-gets-tougher-on-pups/

https://support.malwarebytes.com/customer/portal/articles/1834873-what-are-pup-detections-are-they-threats-and-should-they-be-deleted-?b_id=6438

The detected entries (in bold) are located in your downloads folder:

C:\USERS\MEELAD\DOWNLOADS\REGHUNTER-INSTALLER.EXE

C:\USERS\MEELAD\DOWNLOADS\SPYHUNTER-INSTALLER.EXE

If you want to keep them or not it is your choice.

 

Concerning the MSRT, please read here and see if that can help you to understand why this happens.

Now please perform the following scan with ESET Online Scanner.

• Click on this link to open ESET Online Scanner in a new window.
  
  1. Click on the Scan Now button to download the esetonlinescanner_enu.exe file. Save it to your Desktop.
  2. Close all your programs and browsers.
  3. Please disable your antivirus program to avoid potential conflicts, improve the performance and speed up the scan.
  4. Double click on esetonlinescanner_enu.exe to start ESET Online Scanner. It will open a window with the Terms of Use.

• Check mark Download latest version of ESET Online Scanner and click the Accept button.
• Click Yes to accept any security warnings that may appear.
• Under Computer scan settings, check mark Enable detection of potentially unwanted applications.
• Then click Advanced settings and check mark the following options:
  
  • Enable detection of potentially unsafe applications
  • Clean threats automatically
    
• Click the Scan button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, click List Threats.
• Click Export, and save the file to your Desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Click the Back button.
• Click the Finish button.
  

Note: If nothing is found, it will not produce a log.

Please re-enable your antivirus program.

Please post the content of the ESET log (if it produced one).

[Unforgiven4]

Hello Android 8888!

    Thank you again for your help. I have attached the list of results from the ESET Scan. One more thing I wanted to mention to you, when I first was informed by Windows Defender about the Trojan: Win32/Fuery.B!cl malware, I had it removed using windows defender. Due to my intense paranoia, I did a full system restore to factory settings to ensure that no trace of the virus remains on my system. I specifically instructed the reset function to delete all files on the machine and restore to factory settings. After the reset was completed, I was shown a blue screen which said something to the effect that system restore was unable to delete all of your files, some files may remain. This has me worried as the whole idea of the system wipe was to ensure all files that I had acquired onto the system over the years are deleted. I am concerned some trace of the trojan may still be on my system perhaps well hidden somewhere. Thanks again!

ESETScan.txt

[Android8888]

Hello Unforgiven4.

The ESET log looks good now.

Okay, let me see a new set of logs from FRST.

Follow the instructions below to download and execute a scan on your system with FRST, and provide the two logs in your next reply.

• Right-click on the executable and select Run as Administrator;
• Accept the disclaimer by clicking on Yes, and FRST will then search for updates which should take a few seconds;
• Make sure all checkboxes are marked under Whitelist but only the Addition.txt checkbox under Optional Scan.
• Then Click on the Scan button;
• On completion, two message box will open, saying that the results were saved to FRST.txt and Addition.txt, then open two Notepad files;
• Please attach both FRST.txt and Addition.txt in your next reply;
  

Next,

Please download RogueKiller 32/64 Bits Installer (setup.exe) by Tigzy and save it to your Desktop.

• Right click on the file setup.exe and select Run as administrator to install the tool.
• Click Yes to accept any security warnings that may appear.
• Choose the installation language and click OK.
• Checkmark "Install 32 and 64 bits versions" and click Next. Follow the steps to install the tool.
• Now close all programs and browsers.
• Please disconnect any USB or external drives from the computer before you run this scan!
• Right-click on the RogueKiller icon and select Run as administrator.
• Click Yes to accept any security warnings that may appear.
• Click the Scan tab and then click the Start Scan button.
• Wait until the scan has finished. This may take some time consuming.
• Once finished click on Open Report. It will open a new window.
• Click Export TXT to export the report as a text file, give a name to the file such as RKlog.txt and save it to your Desktop.
• Close RogueKiller.
  

Please attach the RKlog.txt to your next reply.

To summarize please attach in your next reply:

The two (FRST.txt and Addition.txt) logs produced by FRST;

The RKlog.txt.

Let me also know how the computer is behaving at this point.

[Unforgiven4]

Hello Android 8888!

    I apologize for my late reply. I have completed the instructions provided and have attached the FRST and RK logs to this reply, In terms of how the computer is behaving, There is nothing out of the ordinary that I can see. I had done a complete factory reset after I removed the trojan when it was first detected by windows defender. There was one incident of the computer doing an involuntary forced restart due to a "blue screen of death" i believe its called. Unfortunately it only happened once and I was unable to write down what the error code or cause of the restart was. My concern is with regards to the capabilities of this particular trojan. I am concerned about a potential keylogger sending my passwords and such to a third party. Also there is concern of the computer being hijacked etc. Furthermore, when I did a complete factory reset, I had done so by requesting that all of my personal files be wiped and only factory files to be loaded on the computer. When the system restore was completed, i was shown a blue screen stating "Windows was unable to remove all of your personal files during this system restore. Some of your previous files may remain on the system." This is not the exact message, but this was the general idea of the message. Thank you again for your assistance!

Addition new.txt

FRST new.txt

RKLog.txt

[Android8888]

Hello Unforgiven4.

Nothing particularly malicious was found in your logs.

Please perform the following fix just to clean up a couple of entries that are not needed.

Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST64.exe executable is located);
• Right-click on the FRST executable and select Run as Administrator;
• Click on the Fix button;
  
  Credits: Aura
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad;
• Please attach the log in your next reply;
  

 

Next,

Close all programs and browsers.
Please disconnect any USB or external drives from the computer before you run this scan!
Re-run RogueKiller.
Note: For Windows Vista, 7, 8 and 10 right-click on the icon and select Run as administrator.
Click the Scan tab and then click the Start Scan button.
Wait until the scan has finished. This may take some time consuming.
When the scan completes:

Checkmark (tick) the following against Registry entries:

[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-2163784777-4274643694-1367317093-1002\Software\OCS -> Found
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-2163784777-4274643694-1367317093-1002\Software\OCS -> Found

Checkmark (tick) the following against Filesystem entries:

[Tr.Gen0][File] C:\Users\Meelad\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe -> Found

Click on Remove Selected button.
Click Export TXT to export the report as a text file, give a name to the file such as RKlog.txt and save it to your Desktop.
Close RogueKiller.
Please attach the RKlog.txt to your next reply.

 

Next,

Please download Sophos Virus Removal Tool and save it to your computer's Desktop.

• Right-click the icon and select Run as administrator.
• Click Yes to accept any security warnings that may appear.
• Click the Next button.
• Select 'I accept the terms in the license agreement', then click Next twice.
• Click the Install button and wait until the installation is complete.
• Click the Finish button. The tool created a shortcut icon on the Desktop of your computer.
• Now, double-click the Sophos Virus Removal Tool shortcut icon to run the tool.
• Click Yes to accept any security warnings that may appear.
• After it updates and a "Start Scanning" button appears in the lower right:
  
  • Disconnect from the Internet or physically unplug your Internet cable connection.
  • Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
  • Temporarily disable your anti-virus and real-time anti-spyware protection.

• Click the "Start Scanning" button in the lower right to start the scan.
• After starting the scan, do not use the computer until the scan has completed.
• When finished, if it detected anything there will be a "Start Clean-up" button, click it and allow it to finish.
• When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.
• If any threats are found click Details, then View Log file (bottom left-hand corner).
• Copy and paste its contents in your next reply and note any errors encountered.
• Close the Notepad document, close the Threat Details screen, then click Start cleanup.
• Click Exit to close the program.
• If no threats were found, please confirm that result.
  

Note: Whenever necessary, the log will be in the following location:

C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log

To summarize please attach:
The fixlog.txt;
The RKlog.txt.
The SVRT log.

fixlist.txt

[Unforgiven4]

Hello Android 8888!

    I have attached the FRST fix log and RKlog txt file.  As for the report generated by the Sophos Virus Removal Tool, there were no threats found. Thank you for your help and I am eager to hear back as to what to do next. 

Fixlog.txt

RKlog.txt

[Android8888]

Hello Unforgiven4.

The fix worked successfully and the RogueKiller log shows no infections, it's completely clean.

At this point I can say that your system appear to be clean and free of malware infections.

Now it's time to clean up the tools that were used in the malware removal process.

Follow the instructions below to download and execute DelFix.

• Download DelFix and move the executable to your Desktop;
• Right-click on DelFix.exe and select Run as Administrator;
• Check the following options :
  
  • Remove disinfection tools (this option will remove the tools used in the cleaning process).
  • Create registry backup (this option will create a backup from the Windows Registry).
  • Purge system restore (this option will remove all previous and possibly infected restore points, and will create a new and clean restore point of your system).
  • Reset system settings (this option will reset any system settings back to default that were changed either by us during cleansing or by malware infection).
    
• Once the options mentionned above are checked, click on Run;
• After DelFix is done running, a log will open. Please copy and paste the entire content of the output log in your next reply;
  

 

What issues or concerns remains with this computer?

[Unforgiven4]

Hello Android 8888!

    I have attached the log from the Del Fix operation. As far as the computers behavior at this point, everything appears normal with only one exception. I am getting random notifications from google chrome while I am browsing sites that I always have in the past asking me "would you like to translate this page to English?". I find this strange as I have always browsed these sites and have never seen this notification before. I am concerned this may have something to do with the capabilities of the Trojan: Win32/Fuery.B!cl virus. My paranoia has subsided a bit since receiving your help. I await further instructions from you. Thank you so much for your help! 

DelFixlog.txt

[Android8888]

Hello Unforgiven4.

Thank you so much for your help!  

You are very welcome!

 

7 hours ago, Unforgiven4 said:

I am concerned this may have something to do with the capabilities of the Trojan: Win32/Fuery.B!cl virus.

Please stop thinking that way. Your computer is malware-free. That I can assure you by now.

The Google Chrome translate notification is not malware related. It is a default option when you reinstall Chrome and you can disable it if you like.

Please read the content of the following link and see if that helps:
How can I turn off the translation offer from Google Chrome?

If all is working well:

To help keep malware off your system below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please consider using these ideas to help secure your computer.

Keep your Windows Operating System up-to-date.

Keep your AntiVirus program up-to-date.

Please note: Many installer offer third-party downloads that are installed automatically when you do not uncheck certain checkboxes. While most of the time not being malicious you usually do not want these on your computer. Be careful during the installation process and you will avoid seeing tons of new unwanted toolbars in your favorite web browser.

Please consider installing and running some of the following programs; they are either free or have free versions of commercial programs:
Keep Malwarebytes Anti-Malware (MBAM) update and perform a regular scan to your system as it will make it harder for malware to reside on your computer.
A tutorial on using MBAM can be found here and a complete guide here

Please Note: Only the paid for version has real time capabilities.
A free non-resident utility to prevent the installation of ActiveX-based malware is JavaCool's SpywareBlaster, available here

Please keep these programs up-to-date and run them whenever you suspect a problem to prevent malware problems. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster can be run with any of them.

Note that there are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure.

A similar category of programs is now called "scareware." Scareware programs are active infections that will pop-up on your computer and tell you that you are infected. If you look closely, it will usually have a name that looks like it might be legitimate, but it is NOT one of the programs you installed. It tells you to click and install it right away. If you click on any part of it, including the 'X' to close it, you may actually help it infect your computer further. Keeping protection updated and running resident protection can help prevent these infections. If it happens anyway, get offline as quickly as you can. Pull the internet connection cable or shut down the computer if you have to. Contact someone to help by using another computer if possible. These programs are also sometimes called 'rogues', but they are different than the older version of rogues mentioned above.

Another most feared threat at the moment is an infection by a Ransomware. A Ransomware infection is a program that ransoms the data or functionality of your computer until you perform an action. This action is typically to pay a ransom in the form of Bitcoins or another payment method. I advise you to read more info on this terrible threat here and here.

Please keep your programs and Internet browsers in particular up to date. Vulnerabilities are often exploited in order to install malware on your PC.

Run a program like Personal Software Inspector (PSI) or FileHippo Update Checker to see what programs need to be updated.

Be careful with flash drives, as they can spread infections. See this post on USB/flash drive safety.

Stay away from P2P software; even with a clean P2P program, their networks are often riddled with malware.

Don't click on attachments or links in e-mail, and read your e-mail in text-only mode for the highest safety.

Don't click on links received in instant message programs.

A HOSTS file will prevent Internet Explorer from communicating with sites known to be associated with adware or spyware. A good regularly updated HOST file is MVPS HOSTS File, available here

For much more useful and complete information, please read the following links to fully understand PC Security and Best Practices:
So how did I get infected in the first place
Answers to common security questions - Best Practices

Hopefully these steps will help to keep you error and malware free. If you run into more difficulty, we will certainly do what we can to help.

Happy surfing and stay safe.

Android8888

Edited March 21, 2017 by Android8888
To add thanks.

[Unforgiven4]

Hello Android 8888!

    Thank you very much for all of your help with this over the last few days. Regarding all of the information which was posted and uploaded (all the various logs etc) is it okay for them to be publicly viewable on this forum? Should see if i can take the logs down? 

[Android8888]

11 hours ago, Unforgiven4 said:

Thank you very much for all of your help with this over the last few days.

You are very welcome!

All information provided by the logs is generic to the Operating System, so no personal information about the user or his location is displayed. Therefore, it is completely safe to keep logs posted here in the forum and I particularly do not see any reason to remove them, as I have already mentioned, they do not strictly compromise the security of the computer or the user's personal data in any way.

Is it okay to you? Can I close this topic?

[Unforgiven4]

Thank you again Android888, you have been so very helpful. Yes everything is okay, we can go ahead and close the topic.

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!