Solved: HijackThis log

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

gdevilman

Thread Starter
Joined
Sep 15, 2004
Messages
4
I have run AboutBuster, Spybot S&D, cwsshredder, and cwsservices all under safemode. Still getting popups randomly, but homepage is now working. wmplayer.exe was deleted somehow :eek: HijackThis log:

Logfile of HijackThis v1.98.2
Scan saved at 12:28:54 AM, on 9/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\kvhdbgz.exe
C:\WINDOWS\System32\nlhlhelp.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Documents and Settings\Keathley\Application Data\h?h?.exe
C:\WINDOWS\System32\?ttrib.exe
C:\WINDOWS\System32\dmardm.exe
C:\WINDOWS\System32\QwyQa.exe
C:\WINDOWS\System32\UjrU.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Keathley\Desktop\hijackthis\HijackThis.exe

F3 - REG:win.ini: run=C:\WINDOWS\System32\services\wmplayer.exe
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Keathley\Local Settings\Temp\9g.dll (file missing)
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [qddmcn] C:\WINDOWS\System32\kvhdbgz.exe
O4 - HKLM\..\Run: [NMX.exe] C:\documents and settings\keathley\local settings\temp\NMX.exe
O4 - HKLM\..\Run: [QrFq2wzYx.exe] C:\documents and settings\keathley\local settings\temp\QrFq2wzYx.exe
O4 - HKLM\..\Run: [4SJ#8Y745N9X#@] C:\WINDOWS\System32\KdfL6BY.exe
O4 - HKLM\..\Run: [u32Q36j] nlhlhelp.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [Sys29] C:\windows\system32\winggm32.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Dcbl] C:\Documents and Settings\Keathley\Application Data\h?h?.exe
O4 - HKCU\..\Run: [Mlos] C:\WINDOWS\System32\?ttrib.exe
O4 - HKCU\..\Run: [f0t4RWH3i] dmardm.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: v2cab - http://install.searchmiracle.com/cab/v2cab.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...14f9bb93ddd5:061a5725d1c04e478de72640af5cb44d
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...le.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab
O21 - SSODL: SARU - {FF5D8CC8-DE01-4964-89F1-648E43271415} - C:\WINDOWS\System32\mssaru.dll

Thank you guys for your time and help. I know how boring this must get at times looking at same thing over and over.
 

Byteman

Gone but Never Forgotten
Joined
Jan 24, 2002
Messages
17,742
Hi, Please download this Peper trojan remover:

http://www.bleepingcomputer.com/files/peperremover.php

NOTE WELL> for this remover tool to work, you must be online, (have one Internet Explorer window open), let it pass the firewall too. After running it once, reboot, come back online and run it again.



Then> go do an online scan here:

http://housecall.antivirus.com/housecall/start_corp.asp
Put a dot into the AUTOCLEAN button...let it scan the entire computer, minus the floppy drive and CDROM drives...record with exact filenames and locations what it finds, and whether they were cleanable or not, OK?

or here:

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Your work to fix this is not finished...please post a new HJT log after scanning.
 

gdevilman

Thread Starter
Joined
Sep 15, 2004
Messages
4
OK ran peper trojan remover 2 times, one after restarting. I ran the first virus scanner, nothing. Second gave me 26 viruses. 1 it changed the name and couldn't disenfect.
c:\Windows\system32\winggm32.exe trj/startpage.ks

New log file to look at. Thank you byteman for your help, gf computer was "attacked by the horny brothers".

Logfile of HijackThis v1.98.2
Scan saved at 4:27:38 PM, on 9/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\kvhdbgz.exe
C:\WINDOWS\System32\nlhlhelp.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Documents and Settings\Keathley\Application Data\h?h?.exe
C:\WINDOWS\System32\dmardm.exe
C:\WINDOWS\System32\m?iexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Keathley\Desktop\hijackthis\HijackThis.exe

F3 - REG:win.ini: run=C:\WINDOWS\System32\services\wmplayer.exe
O2 - BHO: (no name) - {3EF8387F-C04F-70B1-DA51-62550CD8724A} - C:\WINDOWS\System32\vxlr.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Keathley\Local Settings\Temp\9g.dll (file missing)
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [qddmcn] C:\WINDOWS\System32\kvhdbgz.exe
O4 - HKLM\..\Run: [NMX.exe] C:\documents and settings\keathley\local settings\temp\NMX.exe
O4 - HKLM\..\Run: [QrFq2wzYx.exe] C:\documents and settings\keathley\local settings\temp\QrFq2wzYx.exe
O4 - HKLM\..\Run: [u32Q36j] nlhlhelp.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [Sys29] C:\windows\system32\winggm32.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Dcbl] C:\Documents and Settings\Keathley\Application Data\h?h?.exe
O4 - HKCU\..\Run: [f0t4RWH3i] dmardm.exe
O4 - HKCU\..\Run: [Ziozoua] C:\WINDOWS\System32\m?iexec.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: v2cab - http://install.searchmiracle.com/cab/v2cab.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...14f9bb93ddd5:061a5725d1c04e478de72640af5cb44d
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...le.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab
O21 - SSODL: SARU - {FF5D8CC8-DE01-4964-89F1-648E43271415} - C:\WINDOWS\System32\mssaru.dll
 

Byteman

Gone but Never Forgotten
Joined
Jan 24, 2002
Messages
17,742
Hi, Print this out so you have will have them, you will be working in Safe Mode and will not be able to read this site.

Check Add/Remove programs for anything similar to MediaTickets
or EliteBar and uninstall if there.

Check the Tasks/Processes that are running from Normal Mode first, and try End Task on them and see if they will shut down...if you get "file is in use by a program or Windows message, try Safe Mode:

Boot to Safe Mode, press CTRL+ALT+DEL keys press once together, and if any of these below are running as Tasks or Processes, End Task them...the End Task/Process may not take affect for a half minute or so...keep checking for any of them, and get them all shut down.


winggm32.exe
kvhdbgz.exe
nlhlhelp.exe
AutoUpdate.exe
dmardm.exe
QrFq2wzYx.exe
m?iexec.exe
h?h?.exe

Next, run Hijackthis again, and fix all of the following that you see:

Don't miss any of them. Put checks next to each and when all are checkmarked, click Fix Checked....


C:\WINDOWS\System32\kvhdbgz.exe
C:\WINDOWS\System32\nlhlhelp.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe

C:\Documents and Settings\Keathley\Application Data\h?h?.exe
C:\WINDOWS\System32\dmardm.exe
C:\WINDOWS\System32\m?iexec.exe

F3 - REG:win.ini: run=C:\WINDOWS\System32\services\wmplayer.exe
O2 - BHO: (no name) - {3EF8387F-C04F-70B1-DA51-62550CD8724A} - C:\WINDOWS\System32\vxlr.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Keathley\Local Settings\Temp\9g.dll (file missing)

O4 - HKLM\..\Run: [qddmcn] C:\WINDOWS\System32\kvhdbgz.exe
O4 - HKLM\..\Run: [NMX.exe] C:\documents and settings\keathley\local settings\temp\NMX.exe
O4 - HKLM\..\Run: [QrFq2wzYx.exe] C:\documents and settings\keathley\local settings\temp\QrFq2wzYx.exe
O4 - HKLM\..\Run: [u32Q36j] nlhlhelp.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [Sys29] C:\windows\system32\winggm32.exe

O4 - HKCU\..\Run: [Dcbl] C:\Documents and Settings\Keathley\Application Data\h?h?.exe
O4 - HKCU\..\Run: [f0t4RWH3i] dmardm.exe
O4 - HKCU\..\Run: [Ziozoua] C:\WINDOWS\System32\m?iexec.exe


O16 - DPF: v2cab - http://install.searchmiracle.com/cab/v2cab.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...72 640af5cb44d

O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab

O21 - SSODL: SARU - {FF5D8CC8-DE01-4964-89F1-648E43271415} - C:\WINDOWS\System32\mssaru.dll

NEXT: Open Windows Explorer:

flrman1 said:
Because XP will not always show you hidden files and folders by default, Go to Start > Search and under "More advanced search options".
Make sure there is a check by "Search System Folders" and "Search hidden files and folders" and "Search system subfolders"

Next click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Next navigate to the C:\Documents and Settings\administrator\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
These Temp folders may be under your username in Documents and Settings...might not say "administrator", just delete the temp files contents themselves, not the whole folder....

((YOU will have to do the temp and Temp Internet Files deletion for EACH user profile- )) If you see them in Windows Explorer, so the same deletion for those users...just the temp files, Internet Files, etc.



Now, find and delete these FILES at the end of the lines:

C:\WINDOWS\System32\mssaru.dll
C:\WINDOWS\System32\kvhdbgz.exe
C:\WINDOWS\System32\nlhlhelp.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\dmardm.exe
C:\WINDOWS\System32\m?iexec.exe
C:\Documents and Settings\Keathley\Application Data\h?h?.exe
C:\WINDOWS\System32\vxlr.dll
C:\WINDOWS\System32\services\wmplayer.exe---this is a malware, not you Media Player, so delete it...just the FILE wmplayer.exe

C:\windows\system32\winggm32.exe----if this one resists, I have some directions for it later on, using HJT to "delete on Reboot"


Delete the
C:\Program Files\AutoUpdate----->folder


If you got an in use message for ANY files you were told to delete, Hijackthis has a setting to delete them on reboot. Open HJT again, and when it finishes the scan, click "Config" button, on next screen select the Misc Tools tab, and you will see the Delete upon Reboot button, hit that and browse to the file (follow the path to each file that gave you any message...when you find one, click Open and it will be added to files to delete upon Reboot.)

Now restart the system, get here and download AdAware SE personal edition (free) update it as per directions below and set settings and run a full scan:

LDTate said:
Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode tick Perform full system scan.

Next deselect Search for negligible risk entries.

Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)
AdAware may tell you that it needs to reboot to fix some things, do that.

Update and run SpyBot again,.


Post a new HJT log. Scan again at Panda online scan or try this one:

http://onlinecheck.emsisoft.com/en/

Let me know what they find.
 

gdevilman

Thread Starter
Joined
Sep 15, 2004
Messages
4
1 virus found virus:Trj/Startpage.ks
Location: c:\windows\system32\bkmsf32.dat
Disinfected.
Ran emsisoft all ports closed
Could not remove C:\Windows\System32\dmardm.exe in safemode.
adaware removed 280 files.

Logfile of HijackThis v1.98.2
Scan saved at 1:25:54 PM, on 9/18/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Keathley\Desktop\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
 

Byteman

Gone but Never Forgotten
Joined
Jan 24, 2002
Messages
17,742
Hi, Good work! Log looks good now. As some things can return, keep any eye out. Scan with Panda online once in a while. Update your installed antivirus of course.
AdAware has very frequent updates, SpyBot somewhat less often.
That one file seems to have left town, so you should be OK. Perhaps, if you still see it in System32 folder, you could try renaming it...right clicking and selecting Delete seems to make things worse, so you can try highlighting it and may be able to click the Delete key...

Another way to rename or delete, would be from the command prompt.
After a day or so goes by, and after some further scans, restarts, etc you may mark your thread Solved if you want.
There is a Thread Tools button at the top of the page> I can't mark it solved but you can, if some time goes by and nothing else "appears"---check with Hijackthis, you have the list of items in the thread that we worked on...if anything pops up in a scan by anything, do not hesitate to post a new HJT log!
 

gdevilman

Thread Starter
Joined
Sep 15, 2004
Messages
4
Thanks for the help Byteman. The computer is now passworded and her bros can't get on it anymore.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top