What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Virtumonde, Metajuan Removal

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Clark, Here is the new Combofix.txt. I will work on ESET now. ComboFix.txt:

ComboFix 09-03-01.01 - John 2009-03-03 20:11:28.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.989 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\downloaded\ComboFix.exe
Command switches used :: c:\documents and settings\John\Desktop\CFScript3.txt
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated)
FW: PC Tools Firewall Plus *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\gadagore.dll.tmp
c:\windows\system32\kiwasuge.dll.tmp
c:\windows\system32\rahobofo.dll.tmp
c:\windows\system32\sizulase.dll.tmp

.
((((((((((((((((((((((((( Files Created from 2009-02-04 to 2009-03-04 )))))))))))))))))))))))))))))))
.

2009-03-03 02:04 . 2009-03-03 02:04 410,984 –a—— c:\windows\system32\deploytk.dll
2009-03-03 02:04 . 2009-03-03 02:04 73,728 –a—— c:\windows\system32\javacpl.cpl
2009-03-01 22:39 . 2009-03-01 22:39 d——– c:\program files\SDHelper (Spybot - Search & Destroy)
2009-03-01 22:39 . 2009-03-01 22:39 d——– c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-03-01 22:39 . 2009-03-01 22:39 d——– c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-03-01 17:25 . 2009-03-01 21:23 d——– C:\32788R22FWJFW.3.tmp
2009-03-01 17:15 . 2009-03-01 21:23 d——– C:\32788R22FWJFW.2.tmp
2009-03-01 17:03 . 2009-03-01 21:23 d——– C:\32788R22FWJFW.1.tmp
2009-03-01 17:01 . 2009-03-01 21:23 d——– C:\32788R22FWJFW.0.tmp
2009-02-28 14:07 . 2009-02-28 14:07 250 –a—— c:\windows\gmer.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-04 04:08 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-04 04:08 ——— d—–w c:\program files\Spyware Doctor
2009-03-03 19:42 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-03-03 10:04 ——— d—–w c:\program files\Java
2009-03-02 15:11 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-02 07:02 ——— d—–w c:\program files\Spybot - Search & Destroy
2009-03-02 06:29 ——— d—–w c:\program files\Common Files\Symantec Shared
2009-03-02 06:28 ——— d—–w c:\program files\Norton Security Scan
2009-03-01 04:10 ——— d—–w c:\program files\Canon
2009-02-28 03:35 ——— d—–w c:\program files\Norton SystemWorks
2009-02-24 08:09 51,520 —-a-w c:\windows\system32\drivers\TfFsMon.sys
2009-02-24 08:09 38,208 —-a-w c:\windows\system32\drivers\TfSysMon.sys
2009-02-24 08:09 33,088 —-a-w c:\windows\system32\drivers\TfNetMon.sys
2009-02-24 08:09 12,608 —-a-w c:\windows\system32\drivers\TfKbMon.sys
2009-02-19 04:57 ——— d—–w c:\documents and settings\John\Application Data\Apple Computer
2009-02-19 02:35 ——— d—–w c:\program files\ThreatFire
2009-01-31 23:26 ——— d—–w c:\program files\PhotoScape
2009-01-24 10:27 ——— d—–w c:\documents and settings\Sarah\Application Data\Apple Computer
2009-01-20 08:49 ——— d—–w c:\program files\Google
2009-01-17 01:29 102,664 —-a-w c:\windows\system32\drivers\tmcomm.sys
2007-07-19 08:15 135,680 —-a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2005-01-08 06:55 32 –sha-w c:\windows\{3551838C-E11B-4BE1-BA09-E6A53F2C03DF}.dat
2005-01-08 06:54 32 –sha-w c:\windows\{87A2C44E-4F56-4210-AECC-6D68753A00C0}.dat
2005-01-08 06:55 32 –sha-w c:\windows\{EA0E0525-2803-4A7A-B83A-3535E4189C2F}.dat
2005-01-08 06:55 32 –sha-w c:\windows\system32\{26A73A93-5F18-41A5-9D5F-02B7E3DA050E}.dat
2005-01-08 06:55 32 –sha-w c:\windows\system32\{A6514358-8F0E-4966-9561-BF4AABC84A1C}.dat
2005-01-08 06:54 32 –sha-w c:\windows\system32\{B2EE205E-E40F-46CC-A541-32355393B995}.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{49115F90-0737-0C77-D410-29823043948A}"= "c:\windows\system32\msdxm.ocx" [2004-08-03 844314]

[HKEY_CLASSES_ROOT\clsid\{49115f90-0737-0c77-d410-29823043948a}]
[HKEY_CLASSES_ROOT\AMtoolbar.AMtoolbar.1]
[HKEY_CLASSES_ROOT\AMtoolbar.AMtoolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-02 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"cdloader"="c:\documents and settings\John\Application Data\mjusbsp\cdloader2.exe" [2008-06-12 50520]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\K-Lite Codec Pack\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-02-02 263440]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2008-12-11 2652056]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-03 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
EPSON Status Monitor 3 Environment Check(2).lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2005-03-19 135680]
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Engine\ymetray.exe [2007-10-03 54512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.l3fhg"= mp3fhg.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DA]
–a—— 2006-02-01 17:13 147456 c:\program files\DesktopAssistant\DA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2008-04-13 16:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OmniPage]
–a—— 1998-10-12 18:13 44032 c:\program files\Caere\OmniPagePro90\OPware32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
–a—— 2002-05-29 01:59 520192 c:\program files\Logitech\iTouch\iTouch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\UnrealTournament\\System\\UnrealTournament.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Engine\\YahooMusicEngine.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Documents and Settings\\John\\Application Data\\mjusbsp\\magicJack.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\ati2evxx.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=

R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [2005-01-07 97920]
R0 SiWinAcc;SiWinAcc;c:\windows\system32\drivers\SiWinAcc.sys [2005-01-07 10240]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2008-12-30 51520]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2008-12-30 38208]
R1 pctfw2;pctfw2;c:\windows\system32\drivers\pctfw2.sys [2008-12-26 160792]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]
R2 NProtectService;Norton Unerase Protection;c:\program files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE [2005-01-07 135168]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]
R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service –> c:\program files\ThreatFire\TFService.exe service [?]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-10-22 24652]
R3 fixustor;fixustor;c:\windows\system32\drivers\fixustor.sys [2005-09-27 6016]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2008-12-30 33088]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-12-26 356920]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-02-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-28 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job
- c:\program files\Norton SystemWorks\OBC.exe [2002-08-29 00:53]

2009-03-04 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 13:21]

2009-02-26 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 13:21]

2009-03-04 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-12-14 12:24]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.5.0_06\bin\jusched.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
LSP: c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
FF - ProfilePath - c:\documents and settings\John\Application Data\Mozilla\Firefox\Profiles\5bjqi4gh. UserJohn\
FF - prefs.js: browser.search.selectedEngine - The Free Dictionary
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin.dll
FF - plugin: c:\program files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: c:\program files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: c:\program files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: c:\program files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin6.dll
FF - plugin: c:\program files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint_.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-03 20:15:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-746137067-1004336348-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9C164EFA-1C12-479F-9E57-FFADFECE0F4C}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Count"=dword:0000013d
"Time"=hex:d9,07,02,00,06,00,0e,00,13,00,12,00,03,00,c8,01
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1280)
c:\windows\system32\Ati2evxx.dll
c:\program files\ThreatFire\TFWAH.dll
c:\program files\ThreatFire\TFNI.dll

- - - - - - - > 'lsass.exe'(1344)
c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
c:\program files\ThreatFire\TFWAH.dll
.
Completion time: 2009-03-03 20:17:53
ComboFix-quarantined-files.txt 2009-03-04 04:17:50
ComboFix2.txt 2009-03-03 09:01:04
ComboFix3.txt 2009-03-02 05:55:30

Pre-Run: 10,575,179,776 bytes free
Post-Run: 11,130,687,488 bytes free

218 — E O F — 2008-11-19 11:00:45
Post #17
ESET LOG: Clark here is the ESET report: # version=4 # OnlineScanner.ocx=1.0.0.635 # OnlineScannerDLLA.dll=1, 0, 0, 79 # OnlineScannerDLLW.dll=1, 0, 0, 78 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3906 (20090303) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=6fc1854b48c77f4db8341998e4d69e8f # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2009-03-04 05:16:52 # local_time=2009-03-03 09:16:52 (-0800, Pacific Standard Time) # country="United States" # osver=5.1.2600 NT Service Pack 3 # scanned=210085 # found=6 # scan_time=2311 C:\Qoobox\Quarantine\[4]-[removed] Win32/Adware.Virtumonde application 2035055D83D55F42C067417167CF5ADF C:\Qoobox\Quarantine\[4]-[removed] »ZIP »jepazeje.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 C:\Qoobox\Quarantine\C\WINDOWS\system32\getovojo.dll.vir Win32/Adware.Virtumonde.NDN application 373917CA70F7D4687FA90A2E7017EB28 C:\Qoobox\Quarantine\C\WINDOWS\system32\nutedemu.dll.vir Win32/Adware.Virtumonde application CD1A0709562296EBB9A80E3F61B1E34A C:\Qoobox\Quarantine\C\WINDOWS\system32\tepasafo.dll.vir Win32/Adware.Virtumonde application 7D56067D68140A6889839E7EF5AD03CF C:\Qoobox\Quarantine\C\WINDOWS\system32\zihurake.dll.vir Win32/Adware.Virtumonde.NDN application 214714E1035F469A07F300C0F82A606A :wacko:
Post #18
Clark, The computer still acts as if there are issues that consume large percentages of CPU resources, lock-ups that require rebooting, scans by the security software prorams are always busy finding and quarantining numerous "infection" files. If I leave the machine logged-on to the internet for long without activity it will freeze up or slow way down. I usually reboot to get out of it. The performance is slow and quirky overall.
Post #19
The only thing showing up in the logs are in the quarantine folder for ComboFix which we will take care of later.

scans by the security software prorams are always busy finding and quarantining numerous "infection" files.

Can you give me the locations of where your security programs are finding these infections please?
Post #20
Clark, PCTools Spyware Doctor with Antivirus is a newer installation that performed numerous scans and found numerous infections. Its firewall component is Threatfire, it became quite active after installation. Some files were quarantined others were "denied". Virtumonde was one of the "high risk" infections that Spywaredoctor consistently found. At the same time, I also have "SpyBot search and destroy" This program seems to find many of the same "infections" and either quarantines or destroys depending on the settings of which I am not really clear on howto optimally set up or co-ordinate with other security software. Perhaps they are battling each other. Eventually, these initial steps I took to rid the computer of these bugs seemed counter productive. Certainly, I needed a higher level of expertise. Now you are helping me understand much more about how some of these issues are addressed as well as cleansing some malicious files. It seemed like things ran better after ComboFix ran those two times. Anyway, Spybot runs more in the background while Spywaredoctor and Threatfire are more actively on top. Earlier tonight I noticed SpywareDoctor would not open completely, the machine was running sluggishly. I said, Enough! I uninstalled Spywaredoctor then re-installed it. Now it runs much better. The machine itself seems to be running much better also. I am curious to know which programs you prefer or recommend for security purposes. How does one choose the right settings amongst the many that are offered. As of the latest scans, Virtumonde doesen't show up. I am not noticing the pop-ups that often had a relationship to the subject of the page I was viewing. Still, I am wary that this may only be temporary. What kinds of problems have you noticed in the diagnostics you had me run?
Post #21
From what I am seeing the logs are clean and we only need to do some finally cleaning of the tools we used. Before giving the all clean I had wanted to make sure the system was running better ;)

Go to [external image: Posted Image] -> Run -> copy/paste in the following single line command & click OK


combofix /u



[external image: Posted Image]

This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

————————————–

Here are some additional utilities that will further enhance your safety.
  • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

  • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

  • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.

    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.
Post #22
Clark, I have applied your recommendations and read the suggested articles. Additionally, I made a contribution to ComboFix. Thank You and thanks to the forum for providing such an effective service and means to educate with support for effective resolution of computing issues. For Now, :adios:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI