What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

search results redirecting and constant script error popups

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
OTL logfile created on: 5/17/2011 10:09:13 PM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

494.00 Mb Total Physical Memory | 323.00 Mb Available Physical Memory | 65.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 744 1488 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 60.39 Gb Free Space | 81.03% Space Free | Partition Type: NTFS
Drive D: | 7.72 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive J: | 232.88 Gb Total Space | 153.29 Gb Free Space | 65.82% Space Free | Partition Type: NTFS

Computer Name: YOUR-E752847052 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (NMSAccessU) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (catchme) – File not found
DRV - (PnkBstrK) – C:\WINDOWS\system32\drivers\PnkBstrK.sys ()
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (nvata) – C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWBS2) – C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (mxnic) – C:\WINDOWS\system32\drivers\mxnic.sys (Macronix International Co., Ltd. )


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


[2011/03/10 22:55:23 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions

O1 HOSTS File: ([2011/05/17 20:23:51 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/26 14:04:39 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/09/09 22:14:07 | 000,000,047 | RH– | M] () - D:\autorun.inf – [ UDF ]
O32 - AutoRun File - [2008/02/22 17:21:47 | 000,000,000 | -H-D | M] - J:\Autorun – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/17 20:57:11 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/05/17 20:29:01 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/05/17 20:13:15 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/05/17 20:09:37 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/05/17 20:09:37 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/05/17 20:09:37 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/05/17 20:09:37 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/05/17 20:07:22 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/05/17 20:06:52 | 000,000,000 | —D | C] – C:\Qoobox
[2011/05/17 18:24:50 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/05/17 18:20:15 | 000,589,632 | —- | C] (AVAST Software) – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/05/15 16:27:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\World of Warcraft
[2011/05/15 16:27:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Turbine
[2011/05/15 16:26:15 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_42.dll
[2011/05/15 16:26:06 | 000,235,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx11_42.dll
[2011/05/15 16:25:48 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_42.dll
[2011/05/15 13:57:11 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2011/05/15 13:57:10 | 000,978,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc42.dll
[2011/05/15 13:56:42 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2011/05/15 13:56:09 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2011/05/15 13:55:51 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011/05/15 13:43:55 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aclayers.dll
[2011/05/15 13:41:29 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2011/05/15 13:39:41 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2011/05/15 13:09:09 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Owner\IECompatCache
[2011/05/15 10:23:28 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/05/15 10:23:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\HiJackThis
[2011/05/15 09:58:58 | 000,222,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2011/05/15 09:56:03 | 000,000,000 | —D | C] – C:\Program Files\Windows Defender
[2011/05/11 21:02:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/05/11 21:00:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PC Tools
[2011/05/11 20:26:40 | 000,000,000 | —D | C] – C:\Config.Msi
[2011/05/11 19:20:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RegCure
[2011/05/11 19:18:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\WinZip
[2011/05/11 19:18:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\WinZip
[2011/05/11 19:17:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/05/11 19:17:41 | 000,000,000 | —D | C] – C:\Program Files\WinZip
[2011/05/11 15:16:58 | 016,409,960 | —- | C] (Safer Networking Limited ) – C:\Documents and Settings\Owner\My Documents\spybotsd162.exe
[2011/05/11 01:45:06 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2011/05/11 01:45:05 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2011/05/10 22:22:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG10
[2011/05/10 22:15:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/05/10 22:10:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2011/05/10 21:36:58 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/10 21:36:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/10 21:36:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/05/10 21:36:54 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/10 21:28:22 | 000,000,000 | R–D | C] – C:\Documents and Settings\Owner\Recent
[2011/05/10 21:27:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/05/10 21:05:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/05/09 17:37:45 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/17 20:45:21 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/05/17 20:24:09 | 000,192,954 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2011/05/17 20:23:51 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/05/17 20:23:29 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/17 20:13:20 | 000,000,316 | RHS- | M] () – C:\boot.ini
[2011/05/17 20:03:10 | 004,350,161 | R— | M] () – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/05/17 18:18:10 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/17 18:15:24 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/05/17 18:14:46 | 000,589,632 | —- | M] (AVAST Software) – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/05/15 16:22:36 | 000,441,652 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/05/15 16:22:36 | 000,071,526 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/05/15 16:17:50 | 000,112,584 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/05/15 15:16:30 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/05/15 10:23:43 | 000,002,447 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HiJackThis.lnk
[2011/05/11 21:03:29 | 000,596,970 | —- | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/05/11 20:59:59 | 000,512,992 | —- | M] () – C:\Documents and Settings\Owner\My Documents\sdsetup_aff[1].exe
[2011/05/11 19:22:18 | 000,000,910 | —- | M] () – C:\Documents and Settings\Owner\Desktop\The Lord of the Rings Online.lnk
[2011/05/11 19:22:18 | 000,000,627 | —- | M] () – C:\Documents and Settings\Owner\Desktop\World Of Warcraft Cataclysm.lnk
[2011/05/11 19:22:18 | 000,000,606 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Dark Crusade.lnk
[2011/05/11 19:18:30 | 000,001,732 | —- | M] () – C:\Documents and Settings\Owner\My Documents\WinZip.lnk
[2011/05/11 17:36:05 | 000,000,100 | —- | M] () – C:\WINDOWS\wininit.ini
[2011/05/11 15:18:09 | 000,000,933 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk
[2011/05/11 15:14:20 | 016,409,960 | —- | M] (Safer Networking Limited ) – C:\Documents and Settings\Owner\My Documents\spybotsd162.exe
[2011/05/11 13:16:52 | 000,000,667 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shortcut to iexplore.lnk
[2011/05/10 21:36:58 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/10 21:32:38 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/05/10 21:22:32 | 001,006,778 | —- | M] () – C:\Documents and Settings\Owner\Desktop\rkill.com
[2011/05/10 20:00:04 | 000,000,000 | —- | M] () – C:\WINDOWS\Jkegomu.bin
[2011/05/09 17:56:04 | 000,000,152 | —- | M] () – C:\Documents and Settings\All Users\Application Data\~17555236
[2011/05/09 17:55:58 | 000,000,160 | —- | M] () – C:\Documents and Settings\All Users\Application Data\~17555236r
[2011/05/09 17:49:26 | 000,000,336 | —- | M] () – C:\Documents and Settings\All Users\Application Data\17555236
[2011/05/09 17:41:35 | 000,000,120 | —- | M] () – C:\WINDOWS\Hhiwuyubozidi.dat
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/17 20:13:20 | 000,000,199 | —- | C] () – C:\Boot.bak
[2011/05/17 20:13:17 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/05/17 20:12:08 | 000,000,330 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/05/17 20:09:37 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/05/17 20:09:37 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/05/17 20:09:37 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/05/17 20:09:37 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/05/17 20:09:37 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/05/17 20:06:15 | 004,350,161 | R— | C] () – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/05/15 10:23:28 | 000,002,447 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HiJackThis.lnk
[2011/05/15 09:56:13 | 000,000,955 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Defender.lnk
[2011/05/11 21:03:19 | 000,596,970 | —- | C] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/05/11 21:00:06 | 000,512,992 | —- | C] () – C:\Documents and Settings\Owner\My Documents\sdsetup_aff[1].exe
[2011/05/11 19:18:30 | 000,001,732 | —- | C] () – C:\Documents and Settings\Owner\My Documents\WinZip.lnk
[2011/05/11 17:36:05 | 000,000,100 | —- | C] () – C:\WINDOWS\wininit.ini
[2011/05/11 15:18:09 | 000,000,933 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk
[2011/05/11 15:17:09 | 001,006,778 | —- | C] () – C:\Documents and Settings\Owner\Desktop\rkill.com
[2011/05/11 13:16:52 | 000,000,667 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Shortcut to iexplore.lnk
[2011/05/10 21:36:58 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/10 20:19:01 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/05/09 17:55:58 | 000,000,160 | —- | C] () – C:\Documents and Settings\All Users\Application Data\~17555236r
[2011/05/09 17:55:57 | 000,000,152 | —- | C] () – C:\Documents and Settings\All Users\Application Data\~17555236
[2011/05/09 17:49:26 | 000,000,336 | —- | C] () – C:\Documents and Settings\All Users\Application Data\17555236
[2011/05/09 17:41:35 | 000,000,120 | —- | C] () – C:\WINDOWS\Hhiwuyubozidi.dat
[2011/05/09 17:41:35 | 000,000,000 | —- | C] () – C:\WINDOWS\Jkegomu.bin
[2011/01/09 16:07:46 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2010/03/21 12:56:13 | 000,003,584 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/04 18:51:13 | 000,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2009/10/27 12:04:33 | 000,139,456 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/10/27 12:04:32 | 000,138,056 | —- | C] () – C:\Documents and Settings\Owner\Application Data\PnkBstrK.sys
[2009/10/27 12:04:06 | 000,190,160 | —- | C] () – C:\WINDOWS\System32\PnkBstrB.exe
[2009/10/27 12:03:58 | 002,395,944 | —- | C] () – C:\WINDOWS\System32\pbsvc_heroes.exe
[2009/10/27 12:03:58 | 000,075,064 | —- | C] () – C:\WINDOWS\System32\PnkBstrA.exe
[2009/09/28 12:24:32 | 000,178,176 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/09/28 12:24:32 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2009/09/28 12:24:30 | 000,881,664 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/09/28 12:24:30 | 000,205,824 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/09/28 12:24:29 | 000,085,504 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/09/28 12:19:36 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2009/09/26 17:57:04 | 000,000,060 | —- | C] () – C:\WINDOWS\System32\SYSDRV.DAT
[2009/09/26 17:51:01 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2009/09/26 17:50:48 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2009/09/26 17:50:47 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2009/09/26 17:50:44 | 000,005,151 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2009/09/26 17:50:39 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2009/09/26 17:50:33 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2009/09/26 17:50:05 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2009/09/26 17:50:04 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2009/09/26 17:48:57 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2009/09/26 17:48:28 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2009/09/26 16:10:55 | 000,004,984 | —- | C] () – C:\WINDOWS\System32\drivers\nvphy.bin
[2009/09/26 15:33:50 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\ChCfg.exe
[2009/09/26 15:33:12 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2009/04/27 00:13:36 | 000,000,314 | —- | C] () – C:\WINDOWS\primopdf.ini
[2005/09/18 08:32:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2005/09/18 08:32:00 | 001,657,376 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2005/09/18 08:32:00 | 001,503,232 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2005/09/18 08:32:00 | 001,346,080 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2005/09/18 08:32:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2005/09/18 08:32:00 | 000,573,440 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2005/09/18 08:32:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2005/09/18 08:32:00 | 000,449,056 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2005/09/18 08:32:00 | 000,436,768 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2005/09/18 08:32:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2004/08/27 06:50:59 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/27 05:54:47 | 000,516,096 | —- | C] () – C:\WINDOWS\System32\HotlineClient.exe
[2004/08/26 14:07:50 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/26 14:01:37 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/26 12:12:43 | 000,000,465 | —- | C] () – C:\WINDOWS\System32\emver.ini
[2004/08/26 12:12:43 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/08/26 12:12:10 | 000,441,652 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/26 12:12:10 | 000,071,526 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/26 06:54:56 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/26 06:54:01 | 000,112,584 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >



So far, so good. It's running better than it has in months, there have been no script error popups or website redirects, and was able to log onto World of Warcraft with no problem as well.
Post #17
COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    File:: 
C:\WINDOWS\Hhiwuyubozidi.dat
C:\WINDOWS\Jkegomu.bin

DirLook::
C:\Documents and Settings\All Users\Application Data\17555236
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #18
ComboFix 11-05-17.02 - Owner 05/18/2011 9:48.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.494.206 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
.
FILE ::
"c:\windows\Hhiwuyubozidi.dat"
"c:\windows\Jkegomu.bin"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Hhiwuyubozidi.dat
c:\windows\Jkegomu.bin
.
.
((((((((((((((((((((((((( Files Created from 2011-04-18 to 2011-05-18 )))))))))))))))))))))))))))))))
.
.
2011-05-18 00:57 . 2011-05-18 00:57 ——– d—–w- c:\program files\ESET
2011-05-18 00:44 . 2011-04-18 13:15 7071056 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{EFD9C54E-1A5E-4313-92D0-FAEB1197568A}\mpengine.dll
2011-05-15 20:26 . 2009-09-04 21:29 1974616 —-a-w- c:\windows\system32\D3DCompiler_42.dll
2011-05-15 20:26 . 2009-09-04 21:29 235344 —-a-w- c:\windows\system32\d3dx11_42.dll
2011-05-15 20:25 . 2009-09-04 21:29 453456 —-a-w- c:\windows\system32\d3dx10_42.dll
2011-05-15 17:57 . 2010-09-18 06:53 953856 -c—-w- c:\windows\system32\dllcache\mfc40u.dll
2011-05-15 17:57 . 2011-02-08 13:33 978944 -c—-w- c:\windows\system32\dllcache\mfc42.dll
2011-05-15 17:56 . 2010-08-23 16:12 617472 -c—-w- c:\windows\system32\dllcache\comctl32.dll
2011-05-15 17:56 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe
2011-05-15 17:55 . 2010-11-02 15:17 40960 -c—-w- c:\windows\system32\dllcache\ndproxy.sys
2011-05-15 17:43 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2011-05-15 17:41 . 2010-06-18 13:36 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe
2011-05-15 17:39 . 2010-10-11 14:59 45568 -c—-w- c:\windows\system32\dllcache\wab.exe
2011-05-15 17:09 . 2011-05-15 17:09 ——– d-sh–w- c:\documents and settings\Owner\IECompatCache
2011-05-15 14:23 . 2011-05-15 14:23 388096 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-15 14:23 . 2011-05-15 14:23 ——– d—–w- c:\program files\Trend Micro
2011-05-15 13:59 . 2011-04-18 13:15 7071056 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-05-15 13:58 . 2011-02-02 22:11 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-05-15 13:56 . 2011-05-15 13:56 ——– d—–w- c:\program files\Windows Defender
2011-05-12 01:10 . 2011-05-12 01:10 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2011-05-12 01:02 . 2011-05-12 01:29 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-05-12 01:00 . 2011-05-12 01:27 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2011-05-11 23:20 . 2011-05-11 23:25 ——– d—–w- c:\documents and settings\All Users\Application Data\RegCure
2011-05-11 23:18 . 2011-05-11 23:18 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\WinZip
2011-05-11 23:17 . 2011-05-11 23:18 ——– d—–w- c:\documents and settings\All Users\Application Data\WinZip
2011-05-11 05:45 . 2009-08-06 23:23 215920 —-a-w- c:\windows\system32\muweb.dll
2011-05-11 05:45 . 2009-08-06 23:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2011-05-11 02:22 . 2011-05-11 02:22 ——– d—–w- c:\documents and settings\Owner\Application Data\AVG10
2011-05-11 02:15 . 2011-05-18 00:04 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG10
2011-05-11 02:10 . 2011-05-11 02:10 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2011-05-11 01:36 . 2010-12-20 22:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-11 01:36 . 2011-05-11 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-05-11 01:36 . 2011-05-11 01:36 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-05-11 01:27 . 2011-05-11 01:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Common Files
2011-05-11 01:05 . 2011-05-18 00:02 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-05-11 00:14 . 2011-05-11 00:25 ——– d—–w- c:\documents and settings\Administrator
2011-05-09 21:37 . 2011-05-09 21:37 ——– d—–w- c:\windows\Sun
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-07 05:33 . 2009-09-26 21:49 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2009-09-26 21:51 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2009-09-26 21:51 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2009-09-26 21:51 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2009-09-26 21:49 43520 ——w- c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2009-09-26 21:49 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2009-09-26 21:49 385024 ——w- c:\windows\system32\html.iec
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\documents and settings\All Users\Application Data\17555236 —-
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"nwiz"="nwiz.exe" [2008-09-18 1657376]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 05:04 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-05-27 01:06 4351216 —-a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-09-28 15:56 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
.
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-18 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-18 09:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-05-18 09:57:02
ComboFix-quarantined-files.txt 2011-05-18 13:56
ComboFix2.txt 2011-05-18 00:28
.
Pre-Run: 64,816,984,064 bytes free
Post-Run: 64,807,989,248 bytes free
.
- - End Of File - - F836BA6D8193A36D25DBAAF1543F915A
Post #19
You appear clean of infections,please do the following.


Reinstall your antivirus,delete ESET,aswmbr and any logs you have



ComboFix - Cleanup
Time for some housekeeping
  • Click Start…select Run from the menu.
  • Copy and paste the following into the text entry box:
    Combofix /Uninstall
  • Click the OK button. (See image below as reference.)
🖼Click to load external image (Posted Image)









Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.








Clean out your temp files.
Download Attribune's ATF Cleaner and save to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.








[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 25 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 25 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u25 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u25-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.











Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI