Jump to content

MS Juan infection


Recommended Posts

Guys, I am trying to get better at this and fix myself from learning from these forums. This one has me stumped. I ran Spybot, Malware Bytes, Combofix, then HiJackthis. What happens is when IE is open it has random pop ups with different content. games, fling.com, etc.....

Here are the logs, can you see anything because I just can't figure this one out. thanks!

Malwarebytes' Anti-Malware 1.20

Database version: 937

Windows 5.0.2195 Service Pack 4

10:13:01 PM 7/10/2008

mbam-log-7-10-2008 (22-13-01).txt

Scan type: Quick Scan

Objects scanned: 38589

Time elapsed: 10 minute(s), 11 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

**************************************************************8

ComboFix 08-07-10.1 - Ron 07/10/2008 22:16:29.1 - NTFSx86

Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.169 [GMT -5:00]

Running from: C:\temp\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINNT\Downloaded Program Files\Quarantine

C:\WINNT\system32\qkpvnmgo.ini

C:\WINNT\Web\default.htt

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_CLBDRIVER

-------\Service_clbdriver

((((((((((((((((((((((((( Files Created from 2008-06-11 to 2008-07-11 )))))))))))))))))))))))))))))))

.

2008-07-10 22:13 . 08-07-10 22:13 <DIR> d-------- C:\Program Files\Trend Micro

2008-07-10 22:12 . 08-07-10 22:12 <DIR> d-------- C:\Program Files\Foxit Software

2008-07-10 22:04 . 08-07-10 22:04 2,609,572 --a------ C:\temp\ComboFix.exe

2008-07-10 21:55 . 08-07-10 21:55 <DIR> d-------- C:\Program Files\CCleaner

2008-07-10 16:28 . 08-07-10 16:28 <DIR> d-------- C:\WINNT\winsxs

2008-07-10 16:28 . 08-07-10 16:28 <DIR> d-------- C:\WINNT\PCHEALTH

2008-07-10 16:20 . 08-07-10 16:24 <DIR> d-------- C:\WINNT\system32\URTTemp

2008-07-10 16:17 . 08-07-10 16:17 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy

2008-07-10 16:14 . 08-07-10 16:14 15,083,520 --a------ C:\temp\spybotsd160.exe

2008-07-10 16:14 . 08-07-10 22:01 812,344 --a------ C:\temp\HJTInstall.exe

2008-07-10 15:43 . 08-07-10 15:43 2,919,360 --a------ C:\temp\ccsetup209.exe

2008-07-10 14:29 . 08-07-10 14:29 <DIR> d-------- C:\VundoFix Backups

2008-07-10 14:27 . 08-07-10 14:27 96,978 --a------ C:\temp\VirtumundoBeGone.exe

2008-07-10 14:26 . 08-07-10 14:27 119,808 --a------ C:\temp\VundoFix.exe

2008-07-10 12:56 . 08-07-10 12:56 116,352 --a------ C:\WINNT\system32\wrstvb.dll

2008-07-10 12:56 . 08-07-10 12:56 116,352 --a------ C:\WINNT\system32\hdwgpebu.dll

2008-07-10 12:27 . 08-07-10 12:27 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware

2008-07-10 12:27 . 08-07-10 12:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-07-10 12:27 . 08-07-10 12:27 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes

2008-07-10 12:27 . 08-07-07 17:35 34,296 --a------ C:\WINNT\system32\drivers\mbamcatchme.sys

2008-07-10 12:27 . 08-07-07 17:35 17,144 --a------ C:\WINNT\system32\drivers\mbam.sys

2008-07-10 12:26 . 08-07-10 12:26 1,774,048 --a------ C:\temp\mbam-setup.exe

2008-07-10 11:43 . 99-10-04 15:04 13,744 --a------ C:\WINNT\system32\drivers\kbdhid.sys

2008-07-10 06:09 . 08-07-10 22:04 <DIR> d-------- C:\temp

2008-07-10 06:09 . 08-07-10 06:13 22,311,160 --a------ C:\temp\antivir_workstation_winu_en_h.exe

2008-07-10 05:35 . 08-07-10 05:45 <DIR> d-------- C:\avg7upd

2008-07-07 05:54 . 99-12-07 07:00 4,080 --a------ C:\WINNT\system32\beep.sys

2008-06-25 04:41 . 08-06-25 04:41 137,488 --a--c--- C:\WINNT\system32\dllcache\dnsapi.dll

2008-06-25 04:41 . 08-06-25 04:41 105,744 --a------ C:\WINNT\system32\msafd.dll

2008-06-25 04:41 . 08-06-25 04:41 105,744 --a--c--- C:\WINNT\system32\dllcache\msafd.dll

2008-06-25 04:41 . 08-06-25 04:41 64,784 --a------ C:\WINNT\system32\mswsock.dll

2008-06-25 04:41 . 08-06-25 04:41 64,784 -----c--- C:\WINNT\system32\dllcache\mswsock.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-07-11 02:56 --------- d---a-w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-06-18 10:05 320,528 ----a-w C:\WINNT\system32\drivers\tcpip.sys

2008-06-04 14:10 880,560 ----a-w C:\WINNT\system32\drivers\vetefile.sys

2008-06-04 14:10 108,368 ----a-w C:\WINNT\system32\drivers\veteboot.sys

2008-06-01 11:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft

2008-05-22 22:20 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-05-01 03:16 1,222,656 ----a-w C:\WINNT\system32\quartz.dll

2008-04-18 13:55 575,488 ----a-w C:\WINNT\system32\WININET.DLL

2001-06-16 22:00 271 ---h--w C:\Program Files\desktop.ini

2001-06-16 22:00 21,952 ---h--w C:\Program Files\folder.htt

1999-12-07 12:00 32,528 ----a-w C:\WINNT\inf\wbfirdma.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6528fdca-267c-4562-99a5-48ff84dad667}]

08-07-10 12:56 116352 --a------ C:\WINNT\system32\wrstvb.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"EPSON Stylus Photo R380 Series"="C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBOA.EXE" [06-05-29 04:00 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.EXE" [02-02-04 22:32 53248]

"CAVRID"="C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe" [07-05-02 18:17 230928]

"cctray"="C:\Program Files\CA\eTrust Internet Security Suite\cctray\cctray.exe" [07-08-28 06:34 177416]

"Synchronization Manager"="mobsync.exe" [03-06-19 14:05 111376 C:\WINNT\system32\mobsync.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 14:05 186640]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [2006-05-18 21:39:30 241664]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "C:\Eudora\EuShlExt.dll" [06-08-17 15:57 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"= mmdrv.dll

R3 3cpciadi;3Com Windows Modem Driver PCI ADI;C:\WINNT\system32\DRIVERS\3cpciadi.sys [99-11-01 11:42 ]

*Newly Created Service* - IPNAT

*Newly Created Service* - RASAUTO

*Newly Created Service* - SHAREDACCESS

.

Contents of the 'Scheduled Tasks' folder

"2007-07-28 02:38:38 C:\WINNT\Tasks\Disk Cleanup.job"

- C:\WINNT\system32\cleanmgr.exe

"2008-07-11 02:54:16 C:\WINNT\Tasks\Symantec NetDetect.job"

- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-10 22:23:50

Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-07-10 22:29:59 - machine was rebooted

ComboFix-quarantined-files.txt 2008-07-11 03:27:57

Pre-Run: 9,820,192,768 bytes free

Post-Run: 9,776,918,528 bytes free

112 --- E O F --- 2008-06-10 23:12:25

*****************************************************************************8

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:35:13 PM, on 7/10/2008

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\stisvc.exe

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\system32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe

C:\Program Files\CA\eTrust Internet Security Suite\cctray\cctray.exe

C:\Program Files\FinePixViewer\QuickDCF.exe

C:\WINNT\explorer.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: {766dad48-ff84-5a99-2654-c762acdf8256} - {6528fdca-267c-4562-99a5-48ff84dad667} - C:\WINNT\system32\wrstvb.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"

O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\eTrust Internet Security Suite\cctray\cctray.exe"

O4 - HKCU\..\Run: [EPSON Stylus Photo R380 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBOA.EXE /FU "C:\WINNT\TEMP\E_S20C.tmp" /EF "HKCU"

O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')

O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O15 - Trusted Zone: http://www.pandasecurity.com

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1127478852342

O17 - HKLM\System\CCS\Services\Tcpip\..\{F704B33C-EEAC-4966-845D-C796989A6991}: Domain = domain.invalid

O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\ccprovsp.exe

O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe

--

End of file - 3737 bytes

Link to post
Share on other sites

ccarbo you have been here enough times you should know by now, you do not run tools like Combofix without being asked.

Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: {766dad48-ff84-5a99-2654-c762acdf8256} - {6528fdca-267c-4562-99a5-48ff84dad667} - C:\WINNT\system32\wrstvb.dll

Click on Fix Checked when finished and exit HijackThis.

Update MBAM run a quick scan and post the log and a new HJT log.

Link to post
Share on other sites

sorry, but everything I read people were running it to fix it. anyway, here are the logs. MAMB just keeps finding the MSJuan entries.

Malwarebytes' Anti-Malware 1.20

Database version: 937

Windows 5.0.2195 Service Pack 4

5:30:05 PM 7/11/2008

mbam-log-7-11-2008 (17-30-05).txt

Scan type: Quick Scan

Objects scanned: 38417

Time elapsed: 4 minute(s), 53 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

*****************************************************8

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:21:14 PM, on 7/11/2008

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\stisvc.exe

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\system32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\Explorer.EXE

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe

C:\Program Files\CA\eTrust Internet Security Suite\cctray\cctray.exe

C:\Program Files\FinePixViewer\QuickDCF.exe

C:\Program Files\internet explorer\iexplore.exe

C:\WINNT\system32\svchost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: {766dad48-ff84-5a99-2654-c762acdf8256} - {6528fdca-267c-4562-99a5-48ff84dad667} - C:\WINNT\system32\wrstvb.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"

O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\eTrust Internet Security Suite\cctray\cctray.exe"

O4 - HKCU\..\Run: [EPSON Stylus Photo R380 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBOA.EXE /FU "C:\WINNT\TEMP\E_S20C.tmp" /EF "HKCU"

O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')

O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O15 - Trusted Zone: http://www.pandasecurity.com

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1127478852342

O17 - HKLM\System\CCS\Services\Tcpip\..\{F704B33C-EEAC-4966-845D-C796989A6991}: Domain = domain.invalid

O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\ccprovsp.exe

O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe

--

End of file - 3816 bytes

ccarbo you have been here enough times you should know by now, you do not run tools like Combofix without being asked.

Close all programs leaving only HijackThis running. Place a check against each of the following, making sure you get them all and not any others by mistake:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: {766dad48-ff84-5a99-2654-c762acdf8256} - {6528fdca-267c-4562-99a5-48ff84dad667} - C:\WINNT\system32\wrstvb.dll

Click on Fix Checked when finished and exit HijackThis.

Update MBAM run a quick scan and post the log and a new HJT log.

Link to post
Share on other sites

Pretty bold statement to make there Jean. I wish I was making some money doing this...... there is such a thing as being a friend and I happen to be the goto friend. If you don't like to help then don't. I am not going to take money from a friend when they are in need. I told you that I fixed it myself so that is less you have to do ..... isn't that the point?

Did you upload the file? We are not going to continue to fix all these random PC's for you. My suspicion is your making money off our free help and that just wrong. You can go to a school and learn how to do this your self.
Link to post
Share on other sites

You never follow through. I asked for one simple thing, you report you "fixed it". That file would have helped hundreds if not thousands of other users, but this is the point where you almost always jump off and report it's all fixed. Since you don't seem to know how to fix them when you post here, I find it just a tad doubtful that you fixed anything. Follow through is crucial. So is my time.

Link to post
Share on other sites

Pretty bold statement to make there Jean. I wish I was making some money doing this...... there is such a thing as being a friend and I happen to be the goto friend. If you don't like to help then don't. I am not going to take money from a friend when they are in need. I told you that I fixed it myself so that is less you have to do ..... isn't that the point?

Yes bold and backed with fact!! http://www.malwarebytes.org/forums/index.p...post&p=8736

Yeh I would be.. I run a small computer service shop on the side and alot of my issues are spyware and virus problems. This would cut down my time involved to fix this. Hard to bill @ $50/hr and spend 5 hours and charge $250! May as well wipe it clean and start over for $100 to be fair to the customer.

thanks, Rip_Chain

Your done making money from our help.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.