WINLOGON.exe Program Error when running Ad-Aware [Solved]

Comments

• skywalker45 Bloomington, IN. USA

  September 2006 edited September 2006

  Hi sagesunrise! The error you're receiving is usually related to a device driver dependency, but I'm not sure how this works with Windows 2000. One thing you should do is disable Spybot S & D tea timer before doing any scans with Ad-Aware. Try that first. Then please run a Panda Active Scan from my signature below. The scan will generate a log. Post back that log file and a fresh Hijack This log with your next reply. Also let me know if disabling the Tea Timer in Spybot helped with the Ad-Aware scan. Once I get this information I'll be better able to assist you.
  

  0
• sagesunrise

  September 2006 edited September 2006

  skywaler45, you're awesome! Thanks for your offer to help. First I'd like to point out that the WINLOGON.EXE program error seems to be prompted when Ad-Aware tries to scan the C:/WINNT/System32/winmm.dll file. Here is the Panda Active Scan log followed by an updated HiJack This log:
  
  
  Incident Status Location
  
  Adware:adware/favoriteman Not disinfected c:\winnt\downloaded program files\ATPartners.inf
  Potentially unwanted tool:application/funweb Not disinfected c:\winnt\downloaded program files\f3initialsetup1.0.0.6.inf
  Adware:adware/ncase Not disinfected c:\winnt\system32\msbb321.dll
  Spyware:spyware/betterinet Not disinfected c:\winnt\inf\biini.inf
  Adware:adware/sidesearch Not disinfected C:\Documents and Settings\home\Application Data\Lycos
  Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\home\Cookies\home@drivecleaner[1].txt
  Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\home\Cookies\home@stats.drivecleaner[2].txt
  Adware:Adware/SAHAgent Not disinfected C:\WINNT\inf\bi4.inf
  Adware:Adware/Transponder Not disinfected C:\WINNT\inf\polmx2.inf
  ________________________________________________________________
  Logfile of HijackThis v1.99.1
  Scan saved at 5:41:39 PM, on 9/9/2006
  Platform: Windows 2000 SP4 (WinNT 5.00.2195)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINNT\System32\smss.exe
  C:\WINNT\system32\winlogon.exe
  C:\WINNT\system32\services.exe
  C:\WINNT\system32\lsass.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\system32\spoolsv.exe
  C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\WINNT\System32\svchost.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
  C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
  C:\WINNT\system32\HPZipm12.exe
  C:\WINNT\system32\regsvc.exe
  C:\WINNT\system32\MSTask.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\WINNT\Explorer.EXE
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\Program Files\Common Files\Symantec Shared\SymTray.exe
  C:\WINNT\System32\WBEM\WinMgmt.exe
  C:\WINNT\system32\mspmspsv.exe
  C:\WINNT\system32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINNT\system32\ltmsg.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINNT\system32\RunDLL32.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\WINNT\system32\stisvc.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\WINNT\system32\wuauclt.exe
  C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
  C:\Program Files\Norton Personal Firewall\ccEmFlSv.exe
  C:\Program Files\HiJack_This\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://webct.wsu.edu/webct/entryPage.dowebct
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
  O2 - BHO: (no name) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {656EC4B7-072B-4698-B504-2A414C1F0037} - (no file)
  O2 - BHO: Norton Personal Firewall 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
  O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
  O2 - BHO: (no name) - {cb7c82b4-3dca-47bb-97db-2c90329bda8a} - C:\WINNT\system32\apclen.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton Personal Firewall 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
  O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
  O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
  O4 - HKLM\..\Run: [QuickFinder Scheduler] c:\Corel\Office7\Shared\QFinder7\QFSCHED.EXE
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb03.exe
  O4 - HKLM\..\Run: [USSShReg] C:\PROGRA~1\ULEADP~1\SSaver\Ussshreg.exe /r
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtray.exe SetReg
  O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
  O4 - HKLM\..\RunOnce: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtrdr.exe
  O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
  O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
  O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
  O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
  O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
  O16 - DPF: ChatSpace Full Java Client 4.0.0.320 -
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
  O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
  O16 - DPF: {31564D57-0000-0010-8000-00AA00389B71} -
  O16 - DPF: {32564D57-0000-0010-8000-00AA00389B71} -
  O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -
  O16 - DPF: {6DA10734-25FD-4350-A8FF-B5A6DBB49680} (WAFUploader Class) - https://www.web-a-file.com/webafileuploader.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} -
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} -
  O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} -
  O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} -
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
  O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} -
  O20 - Winlogon Notify: apclen - C:\WINNT\SYSTEM32\apclen.dll
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
  O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
  O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  _____________________________________________________________

  0
• skywalker45 Bloomington, IN. USA

  September 2006 edited September 2006

  Hi Sagesunrise! Sorry it took some time for me to get back with you. Methinks I have some bad news. I believe, though I'm not certain, that this entry:
  
  O20 - Winlogon Notify: apclen - C:\WINNT\SYSTEM32\apclen.dll
  
  is a rootkit of some kind. I've been unable to find any information on it after doing some research. At this point I think it might be prudent to back up your personal files and do a repair install of the operating system. These rootkits are nasties and even harder to totally kill. We could try a few things but I'm not sure they'll work. Let me know what you'd like to try. If you want to do a repair install you'll need your install CD. Let me know how you'd like to proceed.

  0
• sagesunrise

  September 2006 edited September 2006

  skywalker45, again, thank you. I am not ready to throw in the towel quite yet. Have done some manual registry edits in an effort to overthrow the virus. I am getting closer. I do appreciate your insight. Thanks again.
  Sage

  0
• skywalker45 Bloomington, IN. USA

  September 2006 edited September 2006

  No problem. If you need some assistance in trying to root it out (no pun intended) please let me know.

  0
• sagesunrise

  September 2006 edited September 2006

  skywalker, I have gotten closer. Haven't broke my computer yet! I was able to remove the apclen.dll file and delete about 5 occurrances of it from the registry. On reboot, it put one occurrance back. Will try ad-aware and see if it will run, otherwise, I will be attacking this apclen (also a suspicious one is rasap.dll - not rasap32.dll) file every time I boot up my pc. If nothing else, I can create a batch file possibly to remove it from the registry on boot up. Never done this before, but I am sure it is possible. Any thoughts on that?

  0
• skywalker45 Bloomington, IN. USA

  September 2006 edited September 2006

  You could use Killbox to delete the file on reboot. You can also make a new registry file similar to a batch file that will replace the infected keys. What keys are you finding rasap.dll in? (full path please) also the apclen file (registry locations)?
  
  It's a little tricky business but it can be done. My guess is that rasap.dll is spawning apclen.dll. It could be that this is a protected form of the Vundo trojan which the Vundo Fix will not work for until we can get rid of rasap.dll.
  
  Can you tell me where the file rasap.dll is located on the machine (full path to the file)? That could teach us a lot about what it is we're dealing with.

  0
• sagesunrise

  September 2006 edited September 2006

  skywalker45,
  I am not ignoring you and wanted to get back to you before I answer your question. I had a nice post that I submitted in response to the locations of the rasap and apclen in the registry, but the post never went through and I did not save it
  
  So, hang tight and I will try to get a post in response to the locations up here soon - using memory. That way if another user has a similar issue, you can reference my experience.
  
  Thanks much, and for the record, Ad-aware is able to successfully run now! So, I was able to resolve the hacker issue which is pretty cool!
  
  Sage

  0
• skywalker45 Bloomington, IN. USA

  September 2006 edited September 2006

  Good. Keep me posted.
  
  Skywalker

  0
• sagesunrise

  September 2006 edited September 2006

  The apclen.dll reference was in a key beginning with:
  
  {cb7c82b4-3dca-47bb-97db-2c90329bda8a}-
  I believe this was located in the
  
  HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Browser Helper
  
  Objects string
  
  
  The rasap.dll file is actually called rasap2k.dll and there was a folder within the registry called "RASAP2K" living right next to the RASAPI32 folder within HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Tracing
  
  I do not remember where exactly in the registry lived the callout strings to both the apclen.dll and the rasap2k.dll files. However, a search revealed them and they were quickly deleted. If I recall correctly, there were about 3 callouts for the apclen.dll within the registry. Today, both files are not within my registry and Ad-Aware is scanning properly. My spyware/adware/virus tools are all kept updated almost daily now, and I have not had a problem since.
  
  I hope this information proves useful to others. The main symptom of all of this was that my computer was taking an EXTREMELY long time to load windows. If this is happening to you, you can pretty much bet that you have malicious software spying on you.

  0
• skywalker45 Bloomington, IN. USA

  September 2006 edited September 2006

  Good job Sage! I can't say what type or the origin of these files but I researched them and found very little. I have no doubt that it's safe to say they were malicious. Could you please post another Hijack This log just to be safe.

  0
• sagesunrise

  September 2006 edited September 2006

  Logfile of HijackThis v1.99.1
  Scan saved at 7:28:34 PM, on 9/21/2006
  Platform: Windows 2000 SP4 (WinNT 5.00.2195)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINNT\System32\smss.exe
  C:\WINNT\system32\winlogon.exe
  C:\WINNT\system32\services.exe
  C:\WINNT\system32\lsass.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\system32\spoolsv.exe
  C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\WINNT\System32\svchost.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
  C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
  C:\WINNT\system32\regsvc.exe
  C:\WINNT\system32\MSTask.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
  C:\Program Files\Common Files\Symantec Shared\SymTray.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINNT\System32\WBEM\WinMgmt.exe
  C:\WINNT\system32\mspmspsv.exe
  C:\WINNT\system32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINNT\system32\ltmsg.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINNT\system32\RunDLL32.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINNT\system32\stisvc.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
  C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
  C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\WINNT\System32\svchost.exe
  C:\WINNT\explorer.exe
  C:\Documents and Settings\home\Start Menu\Programs\Accessories\System Tools\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
  O2 - BHO: (no name) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {656EC4B7-072B-4698-B504-2A414C1F0037} - (no file)
  O2 - BHO: Norton Personal Firewall 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
  O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
  O2 - BHO: (no name) - {cb7c82b4-3dca-47bb-97db-2c90329bda8a} - (no file)
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton Personal Firewall 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
  O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
  O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
  O4 - HKLM\..\Run: [QuickFinder Scheduler] c:\Corel\Office7\Shared\QFinder7\QFSCHED.EXE
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb03.exe
  O4 - HKLM\..\Run: [USSShReg] C:\PROGRA~1\ULEADP~1\SSaver\Ussshreg.exe /r
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtray.exe SetReg
  O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\RunOnce: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtrdr.exe
  O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
  O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
  O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
  O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O16 - DPF: ChatSpace Full Java Client 4.0.0.320 -
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
  O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
  O16 - DPF: {31564D57-0000-0010-8000-00AA00389B71} -
  O16 - DPF: {32564D57-0000-0010-8000-00AA00389B71} -
  O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} -
  O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} -
  O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} -
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
  O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} (ASPRO Installer Class) - http://acs.pandasoftware.com/activescanpro/as5/asproinst.cab
  O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} -
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
  O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
  O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  0
• skywalker45 Bloomington, IN. USA

  September 2006 edited September 2006

  You did a great job here sage. Congrats! Just a couple more things. Run Hijack This again and put a check (tick) next to the following entries:
  
  O2 - BHO: (no name) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
  O2 - BHO: (no name) - {656EC4B7-072B-4698-B504-2A414C1F0037} - (no file)
  O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
  O2 - BHO: (no name) - {cb7c82b4-3dca-47bb-97db-2c90329bda8a} - (no file)
  
  Close all other browsers/windows and click Fix Checked. Close Hijack This. Reboot the PC and post another log. If these don't come back we'll call you clean.
  

  0
• sagesunrise

  September 2006 edited September 2006

  I was pretty curious about those "no file BHO's" as well. Removed them and here is a fresh hijackthis log:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 5:42:33 AM, on 9/26/2006
  Platform: Windows 2000 SP4 (WinNT 5.00.2195)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINNT\System32\smss.exe
  C:\WINNT\system32\winlogon.exe
  C:\WINNT\system32\services.exe
  C:\WINNT\system32\lsass.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\system32\spoolsv.exe
  C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\WINNT\System32\svchost.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
  C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
  C:\WINNT\system32\regsvc.exe
  C:\WINNT\Explorer.EXE
  C:\WINNT\system32\MSTask.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
  C:\Program Files\Common Files\Symantec Shared\SymTray.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINNT\System32\WBEM\WinMgmt.exe
  C:\WINNT\system32\mspmspsv.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINNT\system32\ltmsg.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINNT\system32\RunDLL32.exe
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
  C:\WINNT\system32\stisvc.exe
  C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
  C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Documents and Settings\home\Start Menu\Programs\Accessories\System Tools\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: Norton Personal Firewall 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton Personal Firewall 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
  O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
  O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
  O4 - HKLM\..\Run: [QuickFinder Scheduler] c:\Corel\Office7\Shared\QFinder7\QFSCHED.EXE
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb03.exe
  O4 - HKLM\..\Run: [USSShReg] C:\PROGRA~1\ULEADP~1\SSaver\Ussshreg.exe /r
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtray.exe SetReg
  O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\RunOnce: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtrdr.exe
  O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
  O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
  O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
  O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O16 - DPF: ChatSpace Full Java Client 4.0.0.320 -
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
  O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
  O16 - DPF: {31564D57-0000-0010-8000-00AA00389B71} -
  O16 - DPF: {32564D57-0000-0010-8000-00AA00389B71} -
  O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} -
  O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} -
  O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} -
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
  O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} (ASPRO Installer Class) - http://acs.pandasoftware.com/activescanpro/as5/asproinst.cab
  O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} -
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ccPwdSvc.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
  O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
  O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  
  
  Thanks again, Skywalker45. You rock!
  Sage

  0
• skywalker45 Bloomington, IN. USA

  September 2006 edited September 2006

  Looks good Sage. Is there anything else I can help you with?

  0
• sagesunrise

  September 2006 edited September 2006

  You have been just awesome. Thanks for all of your expertise. I hope I have helped you as well by providing a situation that you may encounter in the future.
  
  Sage

  0
• skywalker45 Bloomington, IN. USA

  September 2006 edited September 2006

  Yes you have helped me and you're very welcome for what I could pass along to you. This is a learning community and your post was very informative. I'll close this thread now. If you need any more assistance please post a new thread.
  

  0