What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please help with HijackThis log

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
After cleaning a bunch of mess from a friend's computer, here's what is left. Please advise. Thanks for your assistance.


Logfile of HijackThis v1.99.1
Scan saved at 9:02:15 PM, on 8/13/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Diskeeper\DkService.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\bin\jusched.exe
C:\dfndrff_7.exe
C:\WINNT\system32\cvn0.exe
C:\kybrdff_7.exe
C:\WINNT\system32\wfxqhv.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\n9nyb.exe
C:\WINNT\system32\ghynf.exe
C:\Program Files\CMS Peripherals\BounceBack Professional\BBLauncher.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {930E233B-8F29-4110-86FA-D72682838E99} - C:\Program Files\Windows NT\mebopi.dll (file missing)
O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINNT\system32\xeymi.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [defender] C:\\dfndrff_7.exe
O4 - HKLM\..\Run: [ad8rIU3s] C:\WINNT\system32\cvn0.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_7.exe
O4 - HKLM\..\Run: [k6mmN5IOU] "C:\WINNT\system32\wfxqhv.exe"
O4 - HKLM\..\Run: [ACTX1] C:\WINNT\v1201.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: BounceBack Launcher.lnk = C:\Program Files\CMS Peripherals\BounceBack Professional\BBLauncher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\npjpi150_02.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1144376935531
O16 - DPF: {886DDE35-E955-11D0-A707-000000881958} - http://69.56.176.75/webplugin.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/contr…ate/sdkinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = lvf.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = lvf.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = lvf.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = lvf.local
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINNT\system32\xeymi.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Diskeeper\DkService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: FAH@C:+Program Files+FoldingHome+FAH502-Console.exe - Unknown owner - C:\Program Files\FoldingHome\FAH502-Console.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #2
Welcome to the fourum, lot's of junk in this log and I suggest you keep the computer offline as much as possible, this junk will attract more. This fix will work if the directions are foillowed exactly.

Thanks to Metallica and any others who helpwed with this fix.

1. Please download Ewido Anti-Malware
  • Install ewido anti-malware
  • Launch ewido, there should be an icon on your desktop, double-click it.
  • The program will now open to the main screen.
  • When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.

    You will need to update ewido to the latest definition files.
    • On the left hand side of the main screen click update.
    • Then click on Start Update.
  • The update will start and a progress bar will show the updates being installed.
    (the status bar at the bottom will display ("Update successful")
  • Exit Ewido, do not run the scan yet!
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

2. Please download Brute Force Uninstaller to your desktop.
  • Right click the BFU folder on your desktop, and choose Extract All
  • Click "Next"
  • In the box to choose where to extract the files to,
  • Click "Browse"
  • Click on the + sign next to "My Computer"
  • Click on "Local Disk (C:) or whatever your primary drive is
  • Click "Make New Folder"
  • Type in BFU
  • Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".
3. RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:\BFU).

Do not do anything with these yet!

Reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping F8 until a menu appears. Highlight Safe Mode and hit enter.

4. Once in Safe Mode, Open Ewido:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • You will be prompted to clean the first infection.
  • Select "Perform action on all infections", then proceed.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop or a location where you can find it easily.
Close ewido anti-malware.

5. Then, please go to Start > My Computer and navigate to the C:\BFU folder.
  • Start the Brute Force Uninstaller by doubleclicking BFU.exe
  • Behind the scriptline to execute field click the folder icon [external image: Posted Image] and select alcanshorty.bfu
  • Press Execute and let the program do it’s job. (You ought to see a progress bar if you did this correctly.)
  • Wait for the complete script execution box to pop up and press OK.
  • Press exit to terminate the BFU program.
Reboot into normal windows and post the contents of Ewido text report that you saved and a new HiJackThis log.

We will have more to do.

Thanks…pskelley
TomCoyote forum
Expert Member
Post #3
Thanks for the response, pskelley. Boy, if you think it has lots of junk now, you should have seen it when I started! :o

I've performed the steps you requested. ewido update was done manually, since because of the extent of infection I don't want to put that machine online at all if I can avoid it.

ewido log:

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 11:29:29 AM 8/19/2006

+ Scan result:



C:\Program Files\Міcrosoft.NET\msiexec.exe -> Adware.ClickSpring : Cleaned with backup (quarantined).
C:\WINNT\unstall.exe -> Adware.MediaMotor : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\WinDmy.dllyrnaxcdi -> Adware.Mirar : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\D4E31.tmp/zqskw.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
C:\WINNT\system32\iqqr.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
C:\WINNT\system32\n9nyb.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
C:\WINNT\system32n9nyb.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\n9nyb.exenedchols -> Adware.Suggestor : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\zqskw.execuocgyhg -> Adware.Suggestor : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\Arc11.tmp\blstoolbarsetup.exe/uninstall.exe -> Adware.VMN : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\uninstall.exe -> Adware.VMN : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\WhSurvey.exejbmjystz -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\webhdll.dlljbympmgh -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\webhdll.dllkoupwrsq -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\whSurvey.exeapbvdmxr -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\whagent.exefqyncpqw -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\whiehlpr.dlltlriubub -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\whinstaller.exelstvruwx -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\whinstaller.exerrktpoga -> Adware.WebHancer : Cleaned with backup (quarantined).
C:\fym9bvo.exe -> Downloader.Agent.ala : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\cln2.tmp -> Downloader.Dyfuca.ey : Cleaned with backup (quarantined).
C:\WINNT\optimize.exe -> Downloader.Dyfuca.ey : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\mebopi.dll.exeeeahmddw -> Downloader.Small.ajc : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\mebopi.dllphahaltc -> Downloader.Small.ctp : Cleaned with backup (quarantined).
C:\WINNT\amm06.ocx -> Downloader.VB.bo : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\v1201.exekbafutjq -> Hijacker.Small : Cleaned with backup (quarantined).
C:\WinAntiVirus Pro 2006\Quarantine\v1201[1].exezsprnoae -> Hijacker.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Application Data\winantiviruspro2006freeinstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Ignored.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WF8DGJ2J\WinAntiVirusPro2006FreeInstall[1].cab/UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Ignored.
C:\Documents and Settings\Administrator\Cookies\admin@heavycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\admin@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\admin@solmeliahotels.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Kevia\Cookies\kevia@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\elopez\Cookies\elopez@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\WINNT\CSC\d3\800001F2 -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\admin@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\WINNT\CSC\d6\800000CD -> TrackingCookie.Adserver : Cleaned.
C:\WINNT\CSC\d5\800001C4 -> TrackingCookie.Adservingcentral : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Adtrak : Cleaned.
C:\WINNT\CSC\d2\80000121 -> TrackingCookie.Advertising : Cleaned.
C:\WINNT\CSC\d3\80000122 -> TrackingCookie.Advertising : Cleaned.
C:\WINNT\CSC\d7\800000DE -> TrackingCookie.Advertising : Cleaned.
C:\WINNT\CSC\d8\800001EF -> TrackingCookie.Advertising : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@advertising[2].txtmfzhtkhj -> TrackingCookie.Advertising : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\[removed][1].txtrqpwtufc -> TrackingCookie.Advertising : Cleaned.
C:\WINNT\CSC\d6\800001D5 -> TrackingCookie.Atdmt : Cleaned.
C:\WINNT\CSC\d4\800001F3 -> TrackingCookie.Bluestreak : Cleaned.
C:\WINNT\CSC\d7\800000C6 -> TrackingCookie.Bluestreak : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@bluestreak[2].txtiebfhuem -> TrackingCookie.Bluestreak : Cleaned.
C:\WINNT\CSC\d5\800002E4 -> TrackingCookie.Burstbeacon : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@casalemedia[2].txtdgxcftca -> TrackingCookie.Casalemedia : Cleaned.
C:\WINNT\CSC\d1\800001D0 -> TrackingCookie.Centrport : Cleaned.
C:\WINNT\CSC\d5\800001D4 -> TrackingCookie.Coremetrics : Cleaned.
C:\Documents and Settings\Administrator\Cookies\admin@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\WINNT\CSC\d4\800001C3 -> TrackingCookie.Doubleclick : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@doubleclick[1].txtlhwduhyo -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned.
C:\Documents and Settings\elopez\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\WINNT\CSC\d5\80000214 -> TrackingCookie.Fastclick : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@fastclick[2].txtaacvpdgx -> TrackingCookie.Fastclick : Cleaned.
C:\WINNT\CSC\d1\800001E0 -> TrackingCookie.Gator : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@hitbox[1].txtdgigfvha -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\elopez\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\elopez\Cookies\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\WINNT\CSC\d4\800001DB -> TrackingCookie.Mediaplex : Cleaned.
C:\WINNT\CSC\d4\800001E3 -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\WINNT\CSC\d1\80000110 -> TrackingCookie.Overture : Cleaned.
C:\WINNT\CSC\d6\80000245 -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\elopez\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@revenue[2].txthrlybvfd -> TrackingCookie.Revenue : Cleaned.
C:\WINNT\CSC\d3\800001E2 -> TrackingCookie.Ru4 : Cleaned.
C:\WINNT\CSC\d5\8000021C -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Searchingbooth : Cleaned.
C:\Documents and Settings\Administrator\Cookies\admin@searchingbooth[2].txt -> TrackingCookie.Searchingbooth : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\elopez\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@statcounter[1].txtwkjrwrfl -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed]-banners[1].txt -> TrackingCookie.Top-banners : Cleaned.
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[removed]-banners[1].txt -> TrackingCookie.Top-banners : Cleaned.
C:\WINNT\CSC\d2\80000211 -> TrackingCookie.Trafficmp : Cleaned.
C:\WINNT\CSC\d3\800000FA -> TrackingCookie.Trafficmp : Cleaned.
C:\WINNT\CSC\d8\80000217 -> TrackingCookie.Trafficmp : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@trafficmp[1].txtwwwrsvjf -> TrackingCookie.Trafficmp : Cleaned.
C:\WINNT\CSC\d3\800001C2 -> TrackingCookie.Tribalfusion : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@tribalfusion[2].txtmehrrmnu -> TrackingCookie.Tribalfusion : Cleaned.
C:\WINNT\CSC\d3\800000CA -> TrackingCookie.Valueclick : Cleaned.
C:\WINNT\CSC\d1\80000248 -> TrackingCookie.X10 : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\elopez\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\WINNT\CSC\d3\800001EA -> TrackingCookie.Zedo : Cleaned.
C:\WinAntiVirus Pro 2006\Quarantine\admin@zedo[1].txtcipmvrkp -> TrackingCookie.Zedo : Cleaned.

::Report end


HijackThis log (after ewido and bfu, and normal restart)

Logfile of HijackThis v1.99.1
Scan saved at 11:43:01 AM, on 8/19/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Diskeeper\DkService.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wuauclt.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\bin\jusched.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\CMS Peripherals\BounceBack Professional\BBLauncher.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {930E233B-8F29-4110-86FA-D72682838E99} - C:\Program Files\Windows NT\mebopi.dll (file missing)
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: BounceBack Launcher.lnk = C:\Program Files\CMS Peripherals\BounceBack Professional\BBLauncher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\npjpi150_02.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1144376935531
O16 - DPF: {886DDE35-E955-11D0-A707-000000881958} - http://69.56.176.75/webplugin.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/contr…ate/sdkinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = lvf.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = lvf.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = lvf.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = lvf.local
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - (no file)
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Diskeeper\DkService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: FAH@C:+Program Files+FoldingHome+FAH502-Console.exe - Unknown owner - C:\Program Files\FoldingHome\FAH502-Console.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


I look forward to your next instructions in the eradication process. Thanks.
Post #4
Thanks to Metallica, that tool cleaned out a lot of junk as did ewido. If you keep the free scanner make sure you dump the junk from that quarantine folder as soon as you are sure nothing needed was removed.

You ignored this junk for some reason? It is Winfixer and some of the worse.
C:\Documents and Settings\Administrator\Application Data\winantiviruspro2006freeinstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Ignored.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WF8DGJ2J\WinAntiVirusPro2006FreeInstall[1].cab/UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Ignored.
Either delete it manually or run ewido again and delete it this time.
See this: http://www.spywarewarrior.com/rogue_anti-spyware.htm
WinAntiVirus 2006 winantivirus.com
winsoftware.com
softwareprofit.com aggressive advertising (1, 2, 3, 4); false positives work as goad to purchase; inappropriate collection of Personally Identifiable Information; same company as WinAntiSpy 2005, WinAntiSpyware 2006, & WinFixer [A: 5-21-05 / U: 6-13-06]
This junk comes along with the Vundo trojan, make sure your Java Program is up to date:
http://forums.spybot.info/showpost.php?p=1…amp;postcount=2


Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {930E233B-8F29-4110-86FA-D72682838E99} - C:\Program Files\Windows NT\mebopi.dll (file missing)
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - (no file)

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

Restart the computer and post a last HJT log, I don't need to see another ewido scan but you do need to take the suggested action. Let me know how the computer is running now.

Thanks…Phil
Post #5
When you refer to "that tool" and "that quarantine folder", I assume you mean bfu? I assure you I changed nothing in the actions that ewido recommended after the scan. The ignore came from ewido. I too was surprised that ewido would detect something, then not recommend getting rid of it, but not wanting to deviate from your instructions I stuck with its recommendation. And yes, as soon as the person for whom I'm doing this told me the circumstances surrounding his purchase of the WinAntiVirus product (with which I was completely unfamiliar), I cringed and explained to him what it probably was. I wasn't completely sure at the time, as he was the first person (among many for whom I've restored munged-up computers) I've encountered with this particular infection, but it was immediately confirmed when I did a quick research. As a novice user, he was completely taken in by that company's tactics, and bit on the purchase. Most likely that will end up being a $40 (and messed up computer) lesson learned. I'll go do your next steps now, and will be back shortly with an update.
Post #6

that tool

actually there are a couple of items at work there.
BFU: http://metallica.geekstogo.com/BFUinstructions.html
BFU works with the script and it will work with many. AlcanShorty is a script written to remove the trash that comes along with the Alcan (p2p) worm, I hope that helps.

that quarantine folder

Is in the ewido program. I make a suggestion in closing that will cover this.

I assure you I changed nothing in the actions that ewido recommended after the scan. The ignore came from ewido. I too was surprised that ewido would detect something, then not recommend getting rid of it, but not wanting to deviate from your instructions I stuck with its recommendation.

I have not run the new version of ewido, but this is the first time I have heard of what you are describing. I was under the impression you could (set it and forget it) or manually take action on each item located??

http://malwarecomplaints.info/viewtopic.ph…0170771b6396880
http://www.malwarecomplaints.info/

Don't know if there is a class action on this item yet?
http://www.google.com/search?sourceid=navc…ixer+complaints

Thanks
Post #7
Just ran ewido again, and the only thing it found was Not-A-Virus.Downloader.Win32.WinFixer.o, which it gave a risk of "low". And while you are correct that you can change the action, the default recommendation for this was (again) "ignore once". I changed the action to quarantine and applied.

Re: how it's running, it's hard to say as I have no baseline, having never used the machine in a good condition. That, and it's a 1.7 GHz Celeron with only 128 Mb RAM, where I'm used to a 3 GHz P4 with 2 Gb RAM. Hopefully I have some extra PC2100 RAM here I can put in his machine to boost it a bit. Anyway, there are no obvious problems or suspicious (to me) processes running.

Here's the latest hjt log. Does it look like we got it all? If so, I'll set him up with av, as, and firewall, and then let him back online. Thanks for all your help.


Logfile of HijackThis v1.99.1
Scan saved at 2:25:22 PM, on 8/19/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINNT\System32\cisvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Diskeeper\DkService.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\bin\jusched.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\CMS Peripherals\BounceBack Professional\BBLauncher.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\bin\jusched.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\BellSouth\hcenter.exe" /starthidden /tgcmdwrapper
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: BounceBack Launcher.lnk = C:\Program Files\CMS Peripherals\BounceBack Professional\BBLauncher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\npjpi150_02.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1144376935531
O16 - DPF: {886DDE35-E955-11D0-A707-000000881958} - http://69.56.176.75/webplugin.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/contr…ate/sdkinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = lvf.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = lvf.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = lvf.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = lvf.local
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Diskeeper\DkService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: FAH@C:+Program Files+FoldingHome+FAH502-Console.exe - Unknown owner - C:\Program Files\FoldingHome\FAH502-Console.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #8
Thanks for the feedback, as far as I can see from here, everything looks fine. Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

ewido is a great program but it does use some resources. Once the trial is over you can update and use the scanner for as long as you wish, but unless you purchase it you should turn it off completely so it does not run unless you start it manually.

System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
http://service1.symantec.com/SUPPORT/tsgen…src=sec_doc_nam

Thanks…pskelley
TomCoyote forum
Expert Member
If you are reading this information…thank a teacher,
If you are reading it in English…thank a soldier.
Post #9
I definitely noticed the ewido resource usage. While waitnig for your reply I did find a 256 Mb stick to add to his 128 Mb, so that should help things a bit. I'll go clean out any System Restore backups that are saved. Thanks again for your time and effort. You folks are the best, and it's good to know you can be turned to when the infestations are beyond my own ability to resolve with certainty. Have a great weekend! Bob
Post #10
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI