What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Slow system [Solved]

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have several systems that have had issues with slowness that started last week.

The systems will have short periods of 5-10 seconds where they respond normally but return to slow responsiveness for 2-5 minutes and then cycle again.

I ran Superantispyware, which caught a Vundo file in the windows system32 folder, but no reg entries referencing it. It also found 101 of the typical tracking cookies.

Endpoint Security (an enterprise Panda varient) caught nothing

Avast finds nothing

Malewarebytes found nothing

I ran procman and am seeing a ton of Buffer Overflows
Date & Time: 12/1/2011 3:08:25 AM
Event Class: Registry
Operation: RegQueryValue
Result: BUFFER OVERFLOW
Path: HKLM\SECURITY\Policy\SecDesc\(Default)
TID: 584
Duration: 0.0000075
Length: 12

I did a search on this and got some indicators that this could be Vundo related as well. I am working on this system remotely just so we are on the same page.

Here is the Hijack this log:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:59:02 AM, on 12/1/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17103)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\N-able Technologies\NRM\RSMWinService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\tlntsvr.exe
C:\Program Files\N-able Technologies\Windows Agent\bin\AgentMaint.exe
C:\Program Files\N-able Technologies\Windows Agent\bin\agent.exe
C:\Program Files\IIS Express\iisexpress.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Pitney Bowes\PC Meter Connect\mailstationAssistant.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\rdpclip.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O1 - Hosts: 172.20.10.59 m6382 #m6382
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [PC Meter Connect] C:\Program Files\Pitney Bowes\PC Meter Connect\mailstationAssistant.exe minimize
O4 - HKLM\..\Run: [TimeStationPC Services] C:\Program Files\TimeStation PC\pctsclnt.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Remote Support Manager GUI] "C:\Program Files\RemoteSupportManager\rmgui.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://ccxen1.cccancer.local
O15 - Trusted Zone: http://*.mcafee.com (HKLM)
O15 - Trusted Zone: http://betavscan.mcafeeasap.com (HKLM)
O15 - Trusted Zone: http://vs.mcafeeasap.com (HKLM)
O15 - Trusted Zone: http://www.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://*.mcafee.com (HKLM)
O15 - ESC Trusted Zone: http://betavscan.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://vs.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://www.mcafeeasap.com (HKLM)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.6.0.cab
O16 - DPF: {5EF06782-55B2-4DF3-A57A-3FE8F1D2A181} (PPMDForms.Forms) - https://a-app1.advancedmd.com/practicemanag…s/ppmdforms.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1205777644775
O16 - DPF: {6A6E7E91-B6EB-46B5-A545-12B8EDDD261E} (AMDSControls50.XGroupCategory) - https://a-app1.advancedmd.com/practicemanag…scontrols50.cab
O16 - DPF: {9602B3CE-BC91-417D-B4FD-F6538C2ABB3B} (AMDSWSCheck.WSCheck) - http://www.advancedmd.com/ws-test/files/AMDSWSCheck.CAB
O16 - DPF: {B15C3921-CCFA-4403-9E6F-4470839E835E} (Leadtools.XLead) - https://a-app1.advancedmd.com/practicemanag…s/leadtools.cab
O16 - DPF: {CC99A86F-EA5D-414A-8231-7C3F1B10A644} (AMDSAudio.XAudio) - https://a-app1.advancedmd.com/practicemanag…s/amdsaudio.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {EE8CEFA4-1F91-11D4-B31E-00C04F1D37E6} (PPMDVBDownload.XShowReady) - http://www.advancedmd.com/ws-test/files/PPMDVBDownload.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cccancer.local
O17 - HKLM\Software\..\Telephony: DomainName = cccancer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cccancer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cccancer.local
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINNT\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINNT\System32\browseui.dll
O23 - Service: getPlus® Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: RSMWebServer - Unknown owner - C:\Program Files\N-able Technologies\NRM\RSMWinService.exe
O23 - Service: uvnc_service - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe
O23 - Service: Windows Agent Maintenance Service - N-able Technologies - C:\Program Files\N-able Technologies\Windows Agent\bin\AgentMaint.exe
O23 - Service: Windows Agent Service - N-able Technologies - C:\Program Files\N-able Technologies\Windows Agent\bin\agent.exe
O23 - Service: winrdp_service - WCCS - C:\Program Files\N-able Technologies\NRM\UltraVNCServer\winrdp.exe

–
End of file - 7895 bytes
Post #2
Combo fix log:

ComboFix 11-12-01.01 - tawnia 12/01/2011 9:48.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.1004 [GMT -6:00]
Running from: c:\documents and settings\[removed]\My Documents\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\brenda\Application Data\Checker.tmp
c:\documents and settings\dani\Application Data\Checker.tmp
c:\documents and settings\Default User\Application Data\Checker.tmp
c:\documents and settings\joet\Application Data\Checker.tmp
c:\winnt\CSC\d6
c:\winnt\help\wmplayer.bak
c:\winnt\system32\usmt\migwiz_a.exe
c:\winnt\Web\default.htt
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_IAS
.
.
((((((((((((((((((((((((( Files Created from 2011-11-01 to 2011-12-01 )))))))))))))))))))))))))))))))
.
.
2011-12-01 07:23 . 2011-12-01 07:23 388096 —-a-r- c:\documents and settings\tawnia\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-01 07:23 . 2011-12-01 15:35 ——– d—–w- c:\program files\Trend Micro
2011-12-01 06:59 . 2011-12-01 06:58 205072 —-a-w- c:\winnt\system32\drivers\tmcomm.sys
2011-12-01 03:51 . 2011-12-01 07:39 ——– d—–w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-12-01 03:51 . 2011-12-01 03:51 ——– d—–w- c:\program files\AVAST Software
2011-11-30 21:28 . 2011-11-30 21:28 ——– d—–w- c:\program files\Citrix
2011-11-24 19:05 . 2011-11-24 19:16 ——– d—–w- c:\documents and settings\Administrator.CCCANCER\Application Data\ICAClient
2011-11-24 18:32 . 2011-11-24 18:33 ——– d—–w- c:\program files\CCleaner
2011-11-24 17:21 . 2011-11-24 17:30 ——– d—–w- c:\documents and settings\Administrator.CCCANCER\Application Data\Download Manager
2011-11-24 17:00 . 2011-11-24 18:46 ——– d-sh–w- c:\documents and settings\Administrator.CCCANCER\UserData
2011-11-23 23:26 . 2010-10-19 20:51 222080 ——w- c:\winnt\system32\MpSigStub.exe
2011-11-23 22:33 . 2011-11-26 01:16 ——– d—–w- c:\winnt\pavtemp
2011-11-23 03:18 . 2011-11-23 03:26 ——– d—–w- c:\documents and settings\Administrator.CCCANCER\Local Settings\Application Data\Citrix
2011-11-22 21:49 . 2011-11-22 21:49 ——– d—–w- c:\documents and settings\joet
2011-11-22 21:34 . 2011-11-30 21:22 ——– d—–w- c:\documents and settings\All Users\Application Data\Citrix
2011-11-22 20:50 . 2011-11-22 20:50 ——– d—–w- c:\documents and settings\iSupport\Application Data\ICAClient
2011-11-22 20:48 . 2011-11-22 21:40 ——– d—–w- c:\documents and settings\iSupport\Local Settings\Application Data\Citrix
2011-11-22 19:58 . 2011-11-30 22:06 ——– d—–w- C:\downloads
2011-11-21 23:02 . 2011-11-21 23:02 ——– d—–w- C:\Log
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-10 14:22 . 2008-12-05 19:10 692736 —-a-w- c:\winnt\system32\inetcomm.dll
2011-09-28 07:06 . 2002-08-29 12:00 599040 —-a-w- c:\winnt\system32\crypt32.dll
2011-09-26 16:41 . 2008-07-30 00:59 611328 —-a-w- c:\winnt\system32\uiautomationcore.dll
2011-09-26 16:41 . 2002-08-29 12:00 220160 —-a-w- c:\winnt\system32\oleacc.dll
2011-09-26 16:41 . 2002-08-29 12:00 20480 —-a-w- c:\winnt\system32\oleaccrc.dll
2011-09-06 13:20 . 2002-08-29 12:00 1858944 —-a-w- c:\winnt\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Meter Connect"="c:\program files\Pitney Bowes\PC Meter Connect\mailstationAssistant.exe" [2010-03-04 3768320]
"Synchronization Manager"="mobsync.exe" [2008-04-14 143360]
"IgfxTray"="c:\winnt\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="c:\winnt\system32\hkcmd.exe" [2005-10-19 126976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Trend Micro RUBotted V2.0 Beta"="c:\program files\Trend Micro\RUBotted\RUBottedGUI.exe" [2010-12-17 1103184]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2008-04-14 214528]
"tscuninstall"="c:\winnt\system32\tscupgrd.exe" [2004-08-04 44544]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-424383381-894916208-272903384-1125\Scripts\Logon\0\0]
"Script"=login.vbs
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-424383381-894916208-272903384-1131\Scripts\Logon\0\0]
"Script"=login.vbs
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-424383381-894916208-272903384-1352\Scripts\Logon\0\0]
"Script"=login.vbs
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-424383381-894916208-272903384-500\Scripts\Logon\0\0]
"Script"=login.vbs
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ConnectionCenter
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TPSrv"=2 (0x2)
"PskSvc"=2 (0x2)
"PsImSvc"=2 (0x2)
"PSHost"=2 (0x2)
"PMShellSrv"=2 (0x2)
"PavSrv"=2 (0x2)
"PavReport"=3 (0x3)
"PavFnSvr"=2 (0x2)
"Panda Software Controller"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"59152:UDP"= 59152:UDP:SonicWALL Anti-Virus Compliance Port 59152
"59153:UDP"= 59153:UDP:SonicWALL Anti-Virus Compliance Port 59153
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R2 RSMWebServer;RSMWebServer;c:\program files\N-able Technologies\NRM\RSMWinService.exe [10/11/2011 12:27 PM 19968]
R2 Windows Agent Maintenance Service;Windows Agent Maintenance Service;c:\program files\N-able Technologies\Windows Agent\bin\AgentMaint.exe [8/18/2011 6:21 PM 28672]
R2 Windows Agent Service;Windows Agent Service;c:\program files\N-able Technologies\Windows Agent\bin\agent.exe [8/18/2011 6:21 PM 204800]
R3 DM150Drv;DM150Drv;c:\winnt\system32\drivers\DM150Drv.sys [6/3/2010 12:22 PM 20600]
R3 uvnc_service;uvnc_service;c:\program files\UltraVNC\winvnc.exe [3/14/2011 3:40 PM 1830856]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\winnt\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 12:16 PM 130384]
S2 RUBotSrv;Trend Micro RUBotted Service;c:\program files\Trend Micro\RUBotted\RUBotSrv.exe [12/1/2011 9:35 AM 439632]
S3 DAmirr;DAmirr;c:\winnt\system32\DRIVERS\DAmirr.sys –> c:\winnt\system32\DRIVERS\DAmirr.sys [?]
S3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\drivers\usbhub20.sys [3/17/2008 12:34 PM 49776]
S3 winrdp_service;winrdp_service;c:\program files\N-able Technologies\NRM\UltraVNCServer\winrdp.exe [10/11/2011 12:27 PM 1642496]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\winnt\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 12:16 PM 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: advancedmd.com
Trusted Zone: cccancer.local\ccxen1
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 172.20.6.2 172.25.4.2 172.25.4.3
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-TimeStationPC Services - c:\program files\TimeStation PC\pctsclnt.exe
HKLM-Run-Remote Support Manager GUI - c:\program files\RemoteSupportManager\rmgui.exe
SafeBoot-sglfb.sys
SafeBoot-tga.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-01 10:09
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Micro Focus]
@Denied: (C D) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(460)
c:\winnt\system32\l3codecx.acm
.
- - - - - - - > 'explorer.exe'(3200)
c:\winnt\system32\WININET.dll
c:\winnt\system32\ieframe.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\IIS Express\iisexpress.exe
c:\winnt\system32\rdpclip.exe
c:\winnt\System32\tlntsvr.exe
.
**************************************************************************
.
Completion time: 2011-12-01 10:13:45 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-01 16:13
.
Pre-Run: 19,594,767,360 bytes free
Post-Run: 23,251,719,168 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - D85C83A618815D79609D06D738DCB574
Post #3 last edited
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

I apologize for the delay in response. As you can see we are very busy here. Does this by chance happen to be a company/business computer?

I noticed that you ran ComboFix? Were you told at another forum to run that or did you do it on your own? If you did do it on your own, I would ask that you not do that until instructed to do so again as it could render your system unbootable if used incorrectly. :wacko:
———–

Please download DDS from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
———-

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
    Vista and Windows 7 users right click the icon and choose "Run as administrator".
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post both of the logs created by DDS and the log created by aswMBR.exe and let me know about whether or not this is a corporate/business computer. :)
Post #4
. DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 7.0.5730.13 Run by [removed] at 23:36:04 on 2011-12-07 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.999 [GMT -6:00] . . ============== Running Processes =============== . C:\WINNT\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINNT\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINNT\system32\spoolsv.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINNT\System32\svchost.exe -k HPZ12 C:\WINNT\System32\svchost.exe -k HPZ12 C:\Program Files\Pitney Bowes\PC Meter Connect\mailstationAssistant.exe C:\WINNT\system32\hkcmd.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe C:\WINNT\System32\svchost.exe -k imgsvc C:\Program Files\N-able Technologies\Windows Agent\bin\AgentMaint.exe C:\Program Files\N-able Technologies\Windows Agent\bin\agent.exe C:\WINNT\System32\svchost.exe -k HTTPFilter C:\WINNT\System32\tlntsvr.exe C:\Program Files\N-able Technologies\NRM\RSMWinService.exe C:\Program Files\IIS Express\iisexpress.exe C:\Program Files\UltraVNC\WinVNC.exe C:\WINNT\explorer.exe C:\WINNT\system32\rdpclip.exe C:\WINNT\system32\rundll32.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe mRun: [PC Meter Connect] c:\program files\pitney bowes\pc meter connect\mailstationAssistant.exe minimize mRun: [Synchronization Manager] mobsync.exe /logon mRun: [IgfxTray] c:\winnt\system32\igfxtray.exe mRun: [HotKeysCmds] c:\winnt\system32\hkcmd.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [Trend Micro RUBotted V2.0 Beta] c:\program files\trend micro\rubotted\RUBottedGUI.exe dRunOnce: [^SetupICWDesktop] c:\program files\internet explorer\connection wizard\icwconn1.exe /desktop dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL Trusted Zone: advancedmd.com Trusted Zone: cccancer.local\ccxen1 Trusted Zone: //about.htm/ Trusted Zone: //Exclude.htm/ Trusted Zone: //LanguageSelection.htm/ Trusted Zone: //Message.htm/ Trusted Zone: //MyAgttryCmd.htm/ Trusted Zone: //MyAgttryNag.htm/ Trusted Zone: //MyNotification.htm/ Trusted Zone: //NOCLessUpdate.htm/ Trusted Zone: //quarantine.htm/ Trusted Zone: //ScanNow.htm/ Trusted Zone: //strings.vbs/ Trusted Zone: //Template.htm/ Trusted Zone: //Update.htm/ Trusted Zone: //VirFound.htm/ Trusted Zone: mcafee.com\* Trusted Zone: mcafeeasap.com\betavscan Trusted Zone: mcafeeasap.com\vs Trusted Zone: mcafeeasap.com\www DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.0.cab DPF: {5EF06782-55B2-4DF3-A57A-3FE8F1D2A181} - hxxps://a-app1.advancedmd.com/practicemanager/ppmdcontrols/ppmdforms.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205777644775 DPF: {6A6E7E91-B6EB-46B5-A545-12B8EDDD261E} - hxxps://a-app1.advancedmd.com/practicemanager/ppmdcontrols/amdscontrols50.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {9602B3CE-BC91-417D-B4FD-F6538C2ABB3B} - hxxp://www.advancedmd.com/ws-test/files/AMDSWSCheck.CAB DPF: {B15C3921-CCFA-4403-9E6F-4470839E835E} - hxxps://a-app1.advancedmd.com/practicemanager/ppmdcontrols/leadtools.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CC99A86F-EA5D-414A-8231-7C3F1B10A644} - hxxps://a-app1.advancedmd.com/practicemanager/ppmdcontrols/amdsaudio.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {EE8CEFA4-1F91-11D4-B31E-00C04F1D37E6} - hxxp://www.advancedmd.com/ws-test/files/PPMDVBDownload.CAB TCP: DhcpNameServer = 172.20.6.2 172.25.4.2 172.25.4.3 TCP: Interfaces\{4C6CFCA8-6122-48E1-A560-B452037A6890} : DhcpNameServer = 172.20.6.2 172.25.4.2 172.25.4.3 Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll . ============= SERVICES / DRIVERS =============== . R1 mfehidk;McAfee Inc. mfehidk;c:\winnt\system32\drivers\mfehidk.sys [2008-3-17 214664] R2 NPF;NetGroup Packet Filter Driver;c:\winnt\system32\drivers\npf.sys [2009-10-20 50704] R2 RSMWebServer;RSMWebServer;c:\program files\n-able technologies\nrm\RSMWinService.exe [2011-12-6 64000] R2 RUBotSrv;Trend Micro RUBotted Service;c:\program files\trend micro\rubotted\RUBotSrv.exe [2011-12-1 439632] R2 Windows Agent Maintenance Service;Windows Agent Maintenance Service;c:\program files\n-able technologies\windows agent\bin\AgentMaint.exe [2011-8-18 28672] R2 Windows Agent Service;Windows Agent Service;c:\program files\n-able technologies\windows agent\bin\agent.exe [2011-8-18 204800] R3 DM150Drv;DM150Drv;c:\winnt\system32\drivers\DM150Drv.sys [2010-6-3 20600] R3 uvnc_service;uvnc_service;c:\program files\ultravnc\winvnc.exe [2011-3-14 1830856] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\winnt\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 DAmirr;DAmirr;c:\winnt\system32\drivers\damirr.sys –> c:\winnt\system32\drivers\DAmirr.sys [?] S3 MfeAVFK;McAfee Inc. MfeAVFK;c:\winnt\system32\drivers\mfeavfk.sys [2008-3-17 79816] S3 MfeBOPK;McAfee Inc. MfeBOPK;c:\winnt\system32\drivers\mfebopk.sys [2008-3-17 35272] S3 MfeRKDK;McAfee Inc. MfeRKDK;c:\winnt\system32\drivers\mferkdk.sys [2008-5-14 34248] S3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\drivers\usbhub20.sys [2008-3-17 49776] S3 winrdp_service;winrdp_service;c:\program files\n-able technologies\nrm\ultravncserver\winrdp.exe [2011-12-6 1642496] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\winnt\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2011-12-06 22:56:51 23040 -c–a-w- c:\winnt\system32\dllcache\xrxwbtmp.dll 2011-12-06 22:56:51 116224 -c–a-w- c:\winnt\system32\dllcache\xrxwiadr.dll 2011-12-06 22:56:50 27648 -c–a-w- c:\winnt\system32\dllcache\xrxftplt.exe 2011-12-06 22:56:50 18944 -c–a-w- c:\winnt\system32\dllcache\xrxscnui.dll 2011-12-06 22:56:49 4608 -c–a-w- c:\winnt\system32\dllcache\xrxflnch.exe 2011-12-06 22:56:29 99865 -c–a-w- c:\winnt\system32\dllcache\xlog.exe 2011-12-06 22:56:25 16970 -c–a-w- c:\winnt\system32\dllcache\xem336n5.sys 2011-12-06 22:56:24 19455 -c–a-w- c:\winnt\system32\dllcache\wvchntxx.sys 2011-12-06 22:56:20 12063 -c–a-w- c:\winnt\system32\dllcache\wsiintxx.sys 2011-12-06 22:56:19 8192 -c–a-w- c:\winnt\system32\dllcache\wshirda.dll 2011-12-06 22:56:01 8832 -c–a-w- c:\winnt\system32\dllcache\wmiacpi.sys 2011-12-06 22:56:00 154624 -c–a-w- c:\winnt\system32\dllcache\wlluc48.sys 2011-12-06 22:54:59 42496 -c–a-w- c:\winnt\system32\dllcache\tp4res.dll 2011-12-06 22:53:57 91294 -c–a-w- c:\winnt\system32\dllcache\skfpwin.sys 2011-12-06 22:52:57 49024 -c–a-w- c:\winnt\system32\dllcache\ql1280.sys 2011-12-06 22:51:58 87040 -c–a-w- c:\winnt\system32\dllcache\nm6wdm.sys 2011-12-06 22:50:59 320384 -c–a-w- c:\winnt\system32\dllcache\mgaum.sys 2011-12-06 22:49:59 28160 -c–a-w- c:\winnt\system32\dllcache\irmon.dll 2011-12-06 22:48:59 73279 -c–a-w- c:\winnt\system32\dllcache\hsf_spkp.sys 2011-12-06 22:47:59 595647 -c–a-w- c:\winnt\system32\dllcache\es56cvmp.sys 2011-12-06 22:46:59 14720 -c–a-w- c:\winnt\system32\dllcache\dac960nt.sys 2011-12-06 22:45:59 314752 -c–a-w- c:\winnt\system32\dllcache\camdro21.sys 2011-12-06 22:44:59 38912 -c–a-w- c:\winnt\system32\dllcache\avc.sys 2011-12-06 22:43:44 66048 -c–a-w- c:\winnt\system32\dllcache\s3legacy.dll 2011-12-01 17:22:18 ——– d—–w- C:\wmidiag 2011-12-01 16:29:04 ——– d—–w- c:\program files\WinPcap 2011-12-01 16:19:04 ——– d—–w- c:\documents and settings\all users\application data\Trend Micro 2011-12-01 15:45:57 ——– d-sha-r- C:\cmdcons 2011-12-01 15:41:24 98816 —-a-w- c:\winnt\sed.exe 2011-12-01 15:41:24 518144 —-a-w- c:\winnt\SWREG.exe 2011-12-01 15:41:24 256000 —-a-w- c:\winnt\PEV.exe 2011-12-01 15:41:24 208896 —-a-w- c:\winnt\MBR.exe 2011-12-01 15:40:09 ——– d—–w- C:\ComboFix 2011-12-01 07:23:28 388096 —-a-r- c:\documents and settings\tawnia\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2011-12-01 07:23:26 ——– d—–w- c:\program files\Trend Micro 2011-12-01 06:59:00 205072 —-a-w- c:\winnt\system32\drivers\tmcomm.sys 2011-12-01 03:51:50 ——– d—–w- c:\program files\AVAST Software 2011-12-01 03:51:50 ——– d—–w- c:\documents and settings\all users\application data\AVAST Software 2011-11-30 21:28:59 ——– d—–w- c:\program files\Citrix 2011-11-24 18:32:59 ——– d—–w- c:\program files\CCleaner 2011-11-23 23:26:37 222080 ——w- c:\winnt\system32\MpSigStub.exe 2011-11-23 22:33:12 ——– d—–w- c:\winnt\pavtemp 2011-11-22 21:34:47 ——– d—–w- c:\documents and settings\all users\application data\Citrix 2011-11-22 19:58:08 ——– d—–w- C:\downloads 2011-11-21 23:02:55 ——– d—–w- C:\Log . ==================== Find3M ==================== . 2011-10-10 14:22:41 692736 —-a-w- c:\winnt\system32\inetcomm.dll 2011-09-28 07:06:50 599040 —-a-w- c:\winnt\system32\crypt32.dll 2011-09-26 16:41:20 611328 —-a-w- c:\winnt\system32\uiautomationcore.dll 2011-09-26 16:41:20 220160 —-a-w- c:\winnt\system32\oleacc.dll 2011-09-26 16:41:14 20480 —-a-w- c:\winnt\system32\oleaccrc.dll . ============= FINISH: 23:41:48.51 ===============

Attachments:

  • [attachment removed: Attach.zip]
Post #6 last edited
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-12-08 00:16:52 —————————– 00:16:52.838 OS Version: Windows 5.1.2600 Service Pack 3 00:16:52.838 Number of processors: 1 586 0x207 00:16:52.838 ComputerName: NWT-OFF001 UserName: tawnia 00:16:53.385 Initialize success 00:18:18.495 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 00:18:18.495 Disk 0 Vendor: WDC_WD400JB-00JJC0 05.01C05 Size: 38166MB BusType: 3 00:18:20.510 Disk 0 MBR read successfully 00:18:20.510 Disk 0 MBR scan 00:18:20.510 Disk 0 Windows XP default MBR code 00:18:20.510 Disk 0 scanning sectors +78156225 00:18:20.573 Disk 0 scanning C:\WINNT\system32\drivers 00:18:30.698 Service scanning 00:18:32.995 Modules scanning 00:18:37.276 Disk 0 trace - called modules: 00:18:37.307 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS 00:18:37.307 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x898cbab8] 00:18:37.307 3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x898b3d98] 00:18:37.307 Scan finished successfully 00:19:07.714 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\tawnia\Desktop\MBR.dat" 00:19:07.729 The log file has been saved successfully to "C:\Documents and Settings\tawnia\Desktop\aswMBR.txt"

Attachments:

Post #7
Hi BuddaManX,

As per our Terms of Use:

We offer free computer help and tech support for home and personal use. We are not here to support others that work for profit, or to support/replace your company's IT department.


  • There may be restrictions and modifications installed on such machines that could be damaged or altered by the actions we take to remove Malware.
  • Any infection could jump terminals in a computer network.
  • There may also be legal issues regarding any loss of business data that I do not wish to deal with.
  • Some people who come here use their computers for work, and the computers may contain the patient records of a physician or the financial records of an accountant's clients or credit card and bank account information of their employer's customers.
  • There may be tremendous risks and legal liability for such users for not fully securing the computer. We will not know this unless we ask. We do not want to be accidentally putting those we help in vulnerable positions for law suits.
  • Business factors outweigh technical factors in making the reformat and reinstall decision. Sometimes friends give missing CDs or lack of expertise as a reason for not doing a reformat and reinstall.
  • The cost of replacing missing Windows XP and MS Office CDs and getting an Microsoft Certified Systems Engineer to come in for 3 hours to do the reinstall and apply all the critical updates, is trivial compared with the potential cost of a multi-million dollar lawsuit for breach of trust if confidential client or patient information is disclosed.

I think that it would be in the best interest of you and any of your clients that you have this taken to your IT department. I appreciate the understanding. :)
Post #8
I appreciate your position. I am part of the IT department, so the buck stops here. We have had 4 technicians looking at these issues and between us we have 70+ years of tech support experience and none of us have seen this. We have between a 12 - 18 PCs that have slowed to a crawl with no appearant reason for it. It feels like an infection but there are no normal indicators. Everything we have scanned with has come back clean, and believe me that we have run almost everything under the sun, including Avast!, Panda, Housecall, Adaware, Spybot, SuperAntispyware, bit defender and over a dozen other scan products. We are at a loss at this point becasue we do not know and cannot tell where the infection (if it is one) is coming from or how it is spreading. Any hints would be tremendously appreciated. If you can recommend a class or course that covers these things that would be appreciated as well
Post #9
Hi BuddaManX, I am glad you understand our position here. Seeing as how this is a computer used for business, the best and most responsible action would be to format the system and reinstall using the backup image that I am sure you have. Business computers will have confidential information about both the company and its clients that I am sure you do not want compromised.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI