What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Rubotted reports possible kraken bobax

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Yesterday Rubotted popped up with a possible kraken bobax infection. Not surprisingly none of my other anti-malware programs has found anything. I don't know if the warning is real or a false positive. HijackThis log follows:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:23:43 PM, on 5/6/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\CachemanXP\CachemanXP.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\MiserWare\GranolaPMManager\GranolaManager.exe
C:\Program Files\NetBalancer\SeriousBit.NetBalancer.Service.exe
C:\WINDOWS\system32\plnt.exe
C:\Program Files\Macrium\Reflect\ReflectService.exe
C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sandboxie\SbieSvc.exe
C:\WINDOWS\System32\SnoopFreeSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Zipinstalled\USBDLM\USBDLM\USBDLM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
C:\Program Files\Winpopup LAN Messenger\WinPopup.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\SnoopFreeUI.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\My Lockbox\mylbx.exe
C:\Program Files\Western Digital\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\Trend Micro\RUBotted\RUBottedGUI.exe
C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe
C:\Zipinstalled\Kalender\Kalender.exe
C:\Program Files\NetBalancer\SeriousBit.NetBalancer.Tray.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\NetMeter\NetMeter.exe
C:\Program Files\MiserWare\Granola\granola.exe
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\Program Files\Codessentials\Yadis\Yadis.exe
C:\Zipinstalled\UnlockerPortable\UnlockerPortable.exe
C:\Zipinstalled\PStart\PStart.exe
C:\Program Files\PrintKey2000\Printkey2000.exe
C:\Pilot\HOTSYNC.EXE
C:\Program Files\YCIII\YankClip.exe
C:\Zipinstalled\glint\glint.exe
C:\Program Files\PowerPro\powerpro.exe
C:\Zipinstalled\Taskbar Activate\TaskbarActivate.exe
C:\Zipinstalled\MJ Registry Watcher\MJRegWatcher\RegWatcher.exe
C:\Program Files\FileBX\FileBX.exe
C:\Program Files\WizMouse\WizMouse.exe
C:\Zipinstalled\tinySpell\tinySpell\tinySpellp.exe
C:\Zipinstalled\MJ Registry Watcher\MJRegWatcher\arwwdwin.exe
C:\Zipinstalled\CrystalDiskInfo\DiskInfo.exe
C:\Zipinstalled\AutoHotkey\AutoHotkey.exe
C:\Program Files\Titlebar Date-Time\TBDT.exe
C:\Zipinstalled\PureText\PureText.exe
C:\Zipinstalled\HideDesk\HideDesk.exe
C:\Zipinstalled\KeePass-2\KeePass.exe
C:\Program Files\Alternative Flash Player Auto-Updater\Alternative Flash Player Auto-Updater.exe
C:\Program Files\Tray Wizard\TWizard.exe
C:\Pilot\Palm.exe
C:\Program Files\zabkat\xplorer2_lite\xplorer2_lite.exe
C:\PROGRA~1\COPERN~1\DESKTO~1.EXE
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Program Files\Everything\Everything.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Zipinstalled\NotesHolder\NotesHolder.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\cmd.exe
C:\Zipinstalled\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BBE59AF5-EE22-4A3A-AB26-3F774D1B4216} - C:\PROGRA~1\FOLDER~1\FOLDER~1.DLL
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Explorer Breadcrumbs Helper Class - {DB5FC78C-0D12-448B-A0B0-DB0F0E6B67DB} - C:\Program Files\Explorer Breadcrumbs\BCToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: PrivBar - {300BC64A-BF32-4cc8-8917-91148CEFE700} - C:\Pathfiles\PrivBar.dll
O3 - Toolbar: Copernic Desktop Search 2 - {968631B6-4729-440D-9BF4-251F5593EC9A} - C:\Program Files\Copernic Desktop Search 2\DesktopSearchBand203000018.dll
O3 - Toolbar: QT TabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - mscoree.dll (file missing)
O3 - Toolbar: QT Tab Standard Buttons - {D2BF470E-ED1C-487F-A666-2BD8835EB6CE} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
O4 - HKLM\..\Run: [Winpopup LAN Messenger] "C:\Program Files\Winpopup LAN Messenger\WinPopup.exe" RUNALL
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe /a
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files\Western Digital\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [Trend Micro RUBotted V2.0 Beta] C:\Program Files\Trend Micro\RUBotted\RUBottedGUI.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - Global Startup: Xecutor.lnk = C:\Program Files\Xecutor\Xecutor.exe
O8 - Extra context menu item: Clip with Sunrise XP - C:\Pilot\Sunrise XP\msie\clip.html
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
O9 - Extra 'Tools' menuitem: &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.secunia.com
O15 - Trusted Zone: http://security.symantec.com
O15 - Trusted Zone: http://download.windowsupdate.com
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CachemanXP (CachemanXPService) - Outertech - C:\Program Files\CachemanXP\CachemanXP.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Granola PM Manager - Unknown owner - C:\Program Files\MiserWare\GranolaPMManager\GranolaManager.exe
O23 - Service: PLClient - Unknown owner - C:\WINDOWS\system32\plnt.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - C:\Program Files\Macrium\Reflect\ReflectService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Trend Micro RUBotted Service (RUBotSrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: Secunia PSI Agent - Secunia - C:\Program Files\Secunia\PSI\PSIA.exe
O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: ToolTipFixer - NeoSmart Technologies - C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
O23 - Service: USBDLM - Uwe Sieber - www.uwe-sieber.de - C:\Zipinstalled\USBDLM\USBDLM\USBDLM.exe

–
End of file - 11263 bytes
Post #2
Hi Andthewolf,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

That is a fairly common false positive from Rubotted…. but let's stir things around a little bit and see what we can find.

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
Post #3
Thank you, Tomk, The DDS.txt report follows and attach.txt is attached. Process log is one of the running processes you will find. I know about it and run it all the time for diagnostic purposes. By the way, DDS.scr ended with a Windows Script Host error message: 'Can't find script engine "VBSCRIPT" for script "C:\Documents and Settings\[myusername]\Local Settings\Temp\MSGP.PIF" Is that to be expected? . DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 12:55:01.20 on Sun 05/08/2011 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_25 . ============== Running Processes =============== . C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\CachemanXP\CachemanXP.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\Program Files\FolderSize\FolderSizeSvc.exe C:\Program Files\MiserWare\GranolaPMManager\GranolaManager.exe C:\Program Files\NetBalancer\SeriousBit.NetBalancer.Service.exe C:\WINDOWS\system32\plnt.exe C:\Program Files\Macrium\Reflect\ReflectService.exe C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe C:\Program Files\Sandboxie\SbieSvc.exe C:\WINDOWS\System32\SnoopFreeSvc.exe C:\Program Files\ThreatFire\TFService.exe C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe C:\WINDOWS\system32\wdfmgr.exe C:\Zipinstalled\USBDLM\USBDLM\USBDLM.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\Logi_MwX.Exe C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE C:\Program Files\Winpopup LAN Messenger\WinPopup.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\SnoopFreeUI.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\My Lockbox\mylbx.exe C:\Program Files\Western Digital\USB 3.0 Host Controller Driver\Application\nusb3mon.exe C:\Program Files\ThreatFire\TFTray.exe C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe C:\Zipinstalled\Kalender\Kalender.exe C:\Program Files\NetBalancer\SeriousBit.NetBalancer.Tray.exe C:\Program Files\SpeedFan\speedfan.exe C:\Program Files\NetMeter\NetMeter.exe C:\Program Files\MiserWare\Granola\granola.exe C:\Program Files\TrueCrypt\TrueCrypt.exe C:\Program Files\Codessentials\Yadis\Yadis.exe C:\Zipinstalled\UnlockerPortable\UnlockerPortable.exe C:\Zipinstalled\PStart\PStart.exe C:\Program Files\PrintKey2000\Printkey2000.exe C:\Pilot\HOTSYNC.EXE C:\Program Files\YCIII\YankClip.exe C:\Zipinstalled\glint\glint.exe C:\Program Files\PowerPro\powerpro.exe C:\Zipinstalled\CrystalDiskInfo\DiskInfo.exe C:\Zipinstalled\Taskbar Activate\TaskbarActivate.exe C:\Zipinstalled\MJ Registry Watcher\MJRegWatcher\RegWatcher.exe C:\Program Files\FileBX\FileBX.exe C:\Program Files\WizMouse\WizMouse.exe C:\Zipinstalled\tinySpell\tinySpell\tinySpellp.exe C:\Program Files\Mozilla Thunderbird\thunderbird.exe C:\Zipinstalled\AutoHotkey\AutoHotkey.exe C:\Program Files\Titlebar Date-Time\TBDT.exe C:\Zipinstalled\PureText\PureText.exe C:\Zipinstalled\NotesHolder\NotesHolder.exe C:\Zipinstalled\HideDesk\HideDesk.exe C:\Zipinstalled\KeePass-2\KeePass.exe C:\Program Files\Alternative Flash Player Auto-Updater\Alternative Flash Player Auto-Updater.exe C:\Zipinstalled\MJ Registry Watcher\MJRegWatcher\arwwdwin.exe C:\Program Files\Tray Wizard\TWizard.exe C:\Program Files\Trend Micro\RUBotted\RUBottedGUI.exe C:\Pilot\Palm.exe C:\Program Files\zabkat\xplorer2_lite\xplorer2_lite.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\Install\dds.scr C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\System32\svchost.exe -k eapsvcs C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\System32\svchost.exe -k dot3svc C:\WINDOWS\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = about:blank BHO: KeyScramblerBHO Class: {2b9f5787-88a5-4945-90e7-c4b18563bc5e} - c:\program files\keyscrambler\KeyScramblerIE.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: : {bbe59af5-ee22-4a3a-ab26-3f774d1b4216} - c:\progra~1\folder~1\FOLDER~1.DLL BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dll BHO: Explorer Breadcrumbs Helper Class: {db5fc78c-0d12-448b-a0b0-db0f0e6b67db} - c:\program files\explorer breadcrumbs\BCToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: PrivBar: {300bc64a-bf32-4cc8-8917-91148cefe700} - c:\pathfiles\PrivBar.dll TB: Copernic Desktop Search 2: {968631b6-4729-440d-9bf4-251f5593ec9a} - c:\program files\copernic desktop search 2\DesktopSearchBand203000018.dll TB: QT TabBar: {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - mscoree.dll TB: QT Tab Standard Buttons: {d2bf470e-ed1c-487f-a666-2bd8835eb6ce} - mscoree.dll TB: Explorer Breadcrumbs: {a3eb65ec-d9b4-4dc1-88af-0c7a21ebe5f9} - c:\program files\explorer breadcrumbs\BCToolbar.dll EB: Copernic Desktop Search 2: {968631b6-4729-440d-9bf4-251f5593ec9a} - c:\program files\copernic desktop search 2\DesktopSearchBand203000018.dll EB: Copernic Desktop Search 2: {9c3fca1f-99e3-48f2-a7f4-dd3931b2f99a} - c:\program files\copernic desktop search 2\DesktopSearchBand203000018.dll EB: &Folder Box: {3f5a62e2-51f2-11d3-a075-cc7364cae42b} - c:\progra~1\folder~1\FOLDER~1.DLL mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [COMODO Firewall Pro] "c:\program files\comodo\firewall\CPF.exe" /background mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe" mRun: [Logitech Utility] Logi_MwX.Exe mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon mRun: [IJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.EXE mRun: [Winpopup LAN Messenger] "c:\program files\winpopup lan messenger\WinPopup.exe" RUNALL mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [SnoopFreeUI] SnoopFreeUI.exe mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [mylbx] c:\program files\my lockbox\mylbx.exe /a mRun: [NUSB3MON] "c:\program files\western digital\usb 3.0 host controller driver\application\nusb3mon.exe" mRun: [ThreatFire] c:\program files\threatfire\TFTray.exe mRun: [Trend Micro RUBotted V2.0 Beta] c:\program files\trend micro\rubotted\RUBottedGUI.exe mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" uPolicies-explorer: NoActiveDesktop = 01000000 uPolicies-explorer: NoSMMyPictures = 01000000 IE: Clip with Sunrise XP - c:\pilot\sunrise xp\msie\clip.html IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm IE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htm IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - {B745F984-EF2E-40D6-A9AC-D8CED7230E61} - c:\program files\keyscrambler\KeyScramblerIE.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: microsoft.com\*.update Trusted Zone: microsoft.com\update Trusted Zone: secunia.com Trusted Zone: symantec.com\security Trusted Zone: windowsupdate.com\download DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL LSA: Authentication Packages = msv1_0 pmasext IFEO: taskmgr.exe - "c:\zipinstalled\nirlauncher\sysinternals\PROCEXP.EXE" Hosts: 127.0.0.1 www.spywareinfo.com . ================= FIREFOX =================== . FF - ProfilePath - c:\docume~1\psmith\applic~1\mozilla\firefox\profiles\xlyen703.default\ FF - prefs.js: browser.startup.homepage - hxxp://finance.yahoo.com/quotes/fagix%2cfmagx%2cfosfx%2cfpurx%2ctwcix%2ctwcux%2cvfiax%2cvwelx%2calu%2cpfe%2cso/view/v1 FF - component: c:\documents and settings\psmith\application data\mozilla\firefox\profiles\xlyen703.default\extensions\{0b457caa-602d-484a-8fe7-c1d894a011ba}\platform\winnt_x86-msvc\components\SSSLauncher.dll FF - component: c:\documents and settings\psmith\application data\mozilla\firefox\profiles\xlyen703.default\extensions\[removed]\components\isadmin.dll FF - component: c:\documents and settings\psmith\application data\mozilla\firefox\profiles\xlyen703.default\extensions\[removed]\components\KeyScramblerIE.dll FF - component: c:\program files\free download manager\firefox\extension\components\vmsfdmff.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll FF - plugin: c:\program files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll FF - plugin: c:\program files\pdf-xchange viewer\pdf viewer\npPDFXCviewNPPlugin.dll FF - plugin: c:\program files\pdf-xchange viewer\pdf viewer\npqtplugin.dll FF - plugin: c:\program files\pdf-xchange viewer\pdf viewer\npqtplugin2.dll FF - plugin: c:\program files\pdf-xchange viewer\pdf viewer\npqtplugin3.dll FF - plugin: c:\program files\pdf-xchange viewer\pdf viewer\npqtplugin4.dll FF - plugin: c:\program files\pdf-xchange viewer\pdf viewer\npqtplugin5.dll FF - plugin: c:\program files\pdf-xchange viewer\pdf viewer\npqtplugin6.dll FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} FF - Ext: Link Alert: [removed] - %profile%\extensions\[removed] FF - Ext: Forecastfox Weather: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} - %profile%\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} FF - Ext: ColorfulTabs: {0545b830-f0aa-4d7e-8820-50a4629a56fe} - %profile%\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} FF - Ext: Netcraft Anti-Phishing Toolbar: {0e10f3d7-07f6-4f12-97b9-9b27e07139a5} - %profile%\extensions\{0e10f3d7-07f6-4f12-97b9-9b27e07139a5} FF - Ext: Unhide Passwords: {2e17e2b2-b8d4-4a67-8d7b-fafa6cc9d1d0} - %profile%\extensions\{2e17e2b2-b8d4-4a67-8d7b-fafa6cc9d1d0} FF - Ext: ScrapBook: {53A03D43-5363-4669-8190-99061B2DEBA5} - %profile%\extensions\{53A03D43-5363-4669-8190-99061B2DEBA5} FF - Ext: Searchbar Autosizer: {655397ca-4766-496b-b7a8-3a5b176ee4c2} - %profile%\extensions\{655397ca-4766-496b-b7a8-3a5b176ee4c2} FF - Ext: File Title: {861c8868-e3dc-4dcb-ba2e-866901fc2be8} - %profile%\extensions\{861c8868-e3dc-4dcb-ba2e-866901fc2be8} FF - Ext: View Cookies: {8F6A6FD9-0619-459f-B9D0-81DE065D4E21} - %profile%\extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21} FF - Ext: User Agent Switcher: {e968fc70-8f95-4ab9-9e79-304de2a71ee1} - %profile%\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1} FF - Ext: Download Manager Tweak: {F8A55C97-3DB6-4961-A81D-0DE0080E53CB} - %profile%\extensions\{F8A55C97-3DB6-4961-A81D-0DE0080E53CB} FF - Ext: Open link in…: {ff81e780-5cc0-11d9-9669-0800200c9a66} - %profile%\extensions\{ff81e780-5cc0-11d9-9669-0800200c9a66} FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} FF - Ext: FEBE: {4BBDD651-70CF-4821-84F8-2B918CF89CA3} - %profile%\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} FF - Ext: Locator: {05f6a7ea-896b-11da-8bde-f66bad1e3fff} - %profile%\extensions\{05f6a7ea-896b-11da-8bde-f66bad1e3fff} FF - Ext: UnMHT: {f759ca51-3a91-4dd1-ae78-9db5eee9ebf0} - %profile%\extensions\{f759ca51-3a91-4dd1-ae78-9db5eee9ebf0} FF - Ext: LinkExtend: {cf47767d-5f3a-4e32-9fce-5d79565c9702} - %profile%\extensions\{cf47767d-5f3a-4e32-9fce-5d79565c9702} FF - Ext: KeyScrambler: [removed] - %profile%\extensions\[removed] FF - Ext: IsAdmin: [removed] - %profile%\extensions\[removed] FF - Ext: FastestFox: [removed] - %profile%\extensions\[removed] FF - Ext: Hostname in Titlebar: bughunter2@hostnameintitlebar - %profile%\extensions\bughunter2@hostnameintitlebar FF - Ext: FireShot: {0b457cAA-602d-484a-8fe7-c1d894a011ba} - %profile%\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} FF - Ext: FireGestures: [removed] - %profile%\extensions\[removed] FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} FF - Ext: Hyperwords: {9A752782-D706-479b-98F8-3F66BF921692} - %profile%\extensions\{9A752782-D706-479b-98F8-3F66BF921692} FF - Ext: BetterPrivacy: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3} - %profile%\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3} FF - Ext: InvisibleHand: [removed] - %profile%\extensions\[removed] FF - Ext: Tab Utilities: [removed] - %profile%\extensions\[removed] FF - Ext: Force-TLS: [removed] - %profile%\extensions\[removed] FF - Ext: PictureFox: [removed] - %profile%\extensions\[removed] FF - Ext: Read It Later: [removed] - %profile%\extensions\[removed] FF - Ext: Linkification: {35106bca-6c78-48c7-ac28-56df30b51d2a} - %profile%\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a} FF - Ext: Web2PDF converter: {e8f509f0-b677-11de-8a39-0800200c9a66} - %profile%\extensions\{e8f509f0-b677-11de-8a39-0800200c9a66} FF - Ext: Fasterfox Lite: FasterFox_Lite@BigRedBrent - %profile%\extensions\FasterFox_Lite@BigRedBrent FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} FF - Ext: Sunrise XP: [removed] - c:\pilot\sunrise xp\firefox . —- FIREFOX POLICIES —- // reuse active windows: FF - user.js: advanced.system.supportDDEExec - true . // This one makes a huge difference. Last value in milliseconds (default is 250) FF - user.js: nglayout.initialpaint.delay - 0 ============= SERVICES / DRIVERS =============== . R? MEMSWEEP2;MEMSWEEP2 R? PSI;PSI R? PSMounter;Macrium Reflect Image Explorer Service R? PSVolAcc;PSVolAcc R? SASENUM;SASENUM R? Secunia PSI Agent;Secunia PSI Agent S? AntiVirSchedulerService;Avira AntiVir Scheduler S? AntiVirService;Avira AntiVir Guard S? avgio;avgio S? avgntflt;avgntflt S? CachemanXPService;CachemanXP S? CmdAgent;Comodo Application Agent S? FSProFilter;FSPro File Filter S? Granola PM Manager;Granola PM Manager S? hotcore3;hc3ServiceName S? KeyScrambler;KeyScrambler S? Nbdrv;NetBalancer Service S? NetBalancer Windows Service;NetBalancer Windows Service S? NPF;NetGroup Packet Filter Driver S? nusb3hub;NEC Electronics USB 3.0 Hub Driver S? nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver S? PLClient;PLClient S? privman;privman S? pssnap;Paramount Software Snapshot Filter S? ReflectService;Macrium Reflect Image Mounting Service S? RUBotSrv;Trend Micro RUBotted Service S? SASDIFSV;SASDIFSV S? SASKUTIL;SASKUTIL S? SbieDrv;SbieDrv S? SnoopFree;SnoopFree Driver S? SnoopFreeSvc;Snoop Free Service S? TfFsMon;TfFsMon S? TfNetMon;TfNetMon S? TfSysMon;TfSysMon S? ThreatFire;ThreatFire S? ToolTipFixer;ToolTipFixer S? USBDLM;USBDLM S? WinDefend;Windows Defender . =============== Created Last 30 ================ . 2011-05-01 16:10:08 ——– d—–w- c:\docume~1\psmith\locals~1\applic~1\AmazonWatcher 2011-04-29 19:16:32 73728 —-a-w- c:\windows\system32\javacpl.cpl 2011-04-26 18:35:59 ——– d—–w- c:\program files\AmazonWatcher 2011-04-23 20:09:58 ——– d—–w- c:\program files\Cleanup Assistant 2011-04-23 20:09:58 ——– d—–w- c:\docume~1\psmith\applic~1\CleanupAssistant 2011-04-17 17:17:16 ——– d—–w- c:\docume~1\psmith\locals~1\applic~1\DolphinTextEditorMenu 2011-04-17 17:10:14 ——– d—–w- c:\program files\Dolphin Text Editor Menu . ==================== Find3M ==================== . 2011-04-29 19:16:16 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-03-07 05:33:50 692736 —-a-w- c:\windows\system32\inetcomm.dll 2011-03-04 06:37:06 420864 —-a-w- c:\windows\system32\vbscript.dll 2011-03-03 13:21:11 1857920 —-a-w- c:\windows\system32\win32k.sys 2011-02-22 23:06:29 916480 —-a-w- c:\windows\system32\wininet.dll 2011-02-22 23:06:29 43520 —-a-w- c:\windows\system32\licmgr10.dll 2011-02-22 23:06:29 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2011-02-22 11:41:59 385024 —-a-w- c:\windows\system32\html.iec 2011-02-17 14:07:00 2548480 —-a-w- c:\windows\system32\notepad.exe 2011-02-17 14:07:00 2548480 —-a-w- c:\windows\system32\EditPadLite.exe 2011-02-17 14:07:00 2548480 —-a-w- c:\windows\notepad.exe 2011-02-17 14:07:00 2548480 —-a-w- c:\windows\EditPadLite.exe 2011-02-17 12:32:12 5120 —-a-w- c:\windows\system32\xpsp4res.dll 2011-02-15 12:56:39 290432 —-a-w- c:\windows\system32\atmfd.dll 2011-02-09 13:53:52 270848 —-a-w- c:\windows\system32\sbe.dll 2011-02-09 13:53:52 186880 —-a-w- c:\windows\system32\encdec.dll 2011-02-09 02:03:56 974848 —-a-w- c:\windows\system32\mfc42u.dll 2011-02-08 13:33:55 978944 —-a-w- c:\windows\system32\mfc42.dll . ============= FINISH: 12:58:12.81 ===============

Attachments:

Post #4

By the way, DDS.scr ended with a Windows Script Host error message: 'Can't find script engine "VBSCRIPT" for script "C:\Documents and Settings\[myusername]\Local Settings\Temp\MSGP.PIF" Is that to be expected?

Nope. I don't even know what MSGP.PIF is. :unsure:

I see you have JavaRa installed. You also have some old Java remnants. Please run JavaRa and hhen click Remove Older Versions.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Post #5
Thanks for reminding me about JavaRa, Tomk. I was able to save a list of what ESET found, but that does not look to me like a log, so I'm not sure I did the right thing, or whether I missed a choice somewhere. Anyway the list, which follows: did not turn up anything I don't know about. All it showed were a bunch of programs from my collection of Nirsoft utilities and Anti-Keylogger Tester (AKLT.exe) which to make sure that programs like Keyscrambler do what they claim to. C:\Zipinstalled\Anti-Keylogger Tester\AKLT.exe Win32/Leaktest.AKLT.25 application C:\Zipinstalled\NirLauncher\NirSoft\astlog.exe Win32/PSWTool.AsteriskLogger.104 application C:\Zipinstalled\NirLauncher\NirSoft\awatch.exe a variant of Win32/NirSoft.AdapterWatch.A application C:\Zipinstalled\NirLauncher\NirSoft\chromepass.exe Win32/PSWTool.ChromePass.A application C:\Zipinstalled\NirLauncher\NirSoft\dialupass.exe a variant of Win32/PSWTool.Dialupass.F application C:\Zipinstalled\NirLauncher\NirSoft\iepv.exe a variant of Win32/PSWTool.IEPassView.NAE application C:\Zipinstalled\NirLauncher\NirSoft\lsasecretsview.exe Win32/PSWTool.LsasView application C:\Zipinstalled\NirLauncher\NirSoft\mailpv.exe a variant of Win32/PSWTool.MailPassView.E application C:\Zipinstalled\NirLauncher\NirSoft\mspass.exe a variant of Win32/MPass.A application C:\Zipinstalled\NirLauncher\NirSoft\netpass.exe a variant of Win32/NetPass.AA application C:\Zipinstalled\NirLauncher\NirSoft\operapassview.exe Win32/PSWTool.OperaPassView application C:\Zipinstalled\NirLauncher\NirSoft\passwordfox.exe Win32/PSWTool.PassFox.A application C:\Zipinstalled\NirLauncher\NirSoft\produkey.exe a variant of Win32/PSWTool.ProductKey application C:\Zipinstalled\NirLauncher\NirSoft\pstpassword.exe a variant of Win32/PSWTool.PstPassword.A application C:\Zipinstalled\NirLauncher\NirSoft\rdpv.exe Win32/PSWTool.RDPassView.NAA application C:\Zipinstalled\NirLauncher\NirSoft\sniffpass.exe a variant of Win32/Sniffer.SniffPass.A application C:\Zipinstalled\NirLauncher\NirSoft\vncpassview.exe Win32/PSWTool.VNCPassView.102 application C:\Zipinstalled\NirLauncher\NirSoft\wirelesskeyview.exe a variant of Win32/WirelessKeyView.A application C:\Zipinstalled\NirLauncher\NirSoft\wirelessnetview.exe probably a variant of Win32/PSWTool.WirelessNetView.A application If I have screwed up, let me know and I will try again.
Post #6

If I have screwed up, let me know and I will try again.

You did fine.

If you know about those entries… then I'll assume you know how to use them responsibly.

I'm not finding any malware.

Log looks good :D


You need to create a new Clean restore point:

Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

You may be asked to choose drive. Choose C: At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #7
Thank you, Tomk I'm glad that it seems to be a false positive, but I wonder why RuBotted is suddenly (from what I can see) popping up with kraken bobax warnings on lots of peoples systems. Actually, I have never had any need to use any of the Nirsoft utilities that ESET flagged, though I use others by Nir Sofer. I have them only because I download the Nirsoft utilites as a group, as I do with the Sysinternals utilities. Thanks once again!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI