What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help

51 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi Bob, You advice is clearly thoughtful and well considered. I am taking the day off from this to give myself a break -it's very frustrating. This evening I'll look it iver and decide what to do. Thanks, Mike
Post #17
Hi, I had to get away from my computer for awhile. Then when I returned I started to back up my files. I don't think I was able to backup my Outlook Express correctly. Along the way, I've discovered I don't have access to some of the system settings (I think I mentioned this already). I did play around with some settings. I hope I didn't make it worse.
Post #18
Hi, I had to get away from my computer for awhile. Then when I returned I started to back up my files. I don't think I was able to backup my Outlook Express correctly. Along the way, I've discovered I don't have access to some of the system settings (I think I mentioned this already). I did play around with some settings. I hope I didn't make it worse.
Post #20
Hi Bob, I suppose I should ask. First thing: I did download, install, use and update Avast. But the things I have already mentioned are very frustrating. The 'radio buttons' don't work -so, for example, I couldn't use Jitto virusscan or download a new Java JRE. But it also means there are many other features I can't use or download (ie. Yahoo mail). I find that the 'search' function on my computer is missing. When I open some new webpages, a 'script error' (often superimposed multiple times, so that I have to keep clicking the close button) message comes up. I can't use any form of the 'find' function: I get a message saying a file is missing. I tried using run: sfc /scannow to see whether I had missing files. But when I ran it, it took a few minutes to check (showing a checking bar), but once the bar got finished, it just disappeared and there was no further message. I also cannot restore to an earlier point. The calendar page for Restore is blank. I tried to enter the system programs, but was told I couldn't because I may be using an incompatible version, or because I don't have sufficient privileges. But I am the only one on the computer and I'm pretty sure I am set as administrator. Is there any way to undo this as we go along? Or, if not, what should I do next? Again, I ahve changed a few things so I wonder if you want another log or something else. Best, Mike H
Post #21
We will get to some of the problems you have after we try to destroy this thing.

Just to let you know we may very well do some of these scans twice.
Ready ??



__________________________

Go to this site and download DR.webcureit to your desktop.

Open the program and let it scan and cure what it finds.


__________________________________

Download and scan with SUPERAntiSypware Free for Home Users
  • Double-click SUPERAntiSypware.exe to install and use the default settings for installation.
  • Run SUPERAntiSypware and update the definitions before scanning by selecting "Check for Udates".
  • When done, select "Scan for Harmful Software".
  • There are three scanning options available. Choose "Perform Complete Scan" and click "Next".
  • When done, a Scan Summary will appear with potentially harmful items that were detected. Click "OK".
  • Place a checkmark next to items you wish to remove/quarantine and Click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked to Reboot, please do.
  • After Reboot, double-click on SuperAnti-Spyware icon on your Deskto[
  • Click Preferences, Click the Statistics/Logs Tab.
  • Under Scanner logs, Double-click SuperAnti-Spyware Scan Log.
  • It will open in your default test editor (such as Notepad or WordPad).
  • Please Highlight everything in the Notepad, then right-click and choose copy.
  • In your next reply, please post those results and include a fresh Hijackthis log.
  • Select close to exit the program.

    Note: If you encounter any problems while downloading the updates, manually download and unzip them from http://www.superantispyware.com/definitions.html



    _________________________________
    Please do an online scan with Kaspersky Online Scanner
    Click on Kaspersky Online Scanner
    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    The program will launch and then start to download the latest definition files.
    Once the scanner is installed and the definitions downloaded, click Next.
    Now click on Scan Settings
    In the scan settings make sure that the following are selected:
    Scan using the following Anti-Virus database:

    Extended (If available otherwise Standard)
    Scan Options:
    Scan Archives
    Scan Mail Bases
    Click OK
    Now under select a target to scan select My Computer

    The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.

    Now click on the Save as Text button:

    Save the file to your desktop.

    Copy and paste that information in your next post.



    In your next reply I would like to see:
    • A new HJT log
    • The Kasperskys
    • If dr web creates any sort of log post that also/
Post #22 last edited
Hi Bob,


First, the same problem occurs with Kaspersky as with Jotti and other functions: the radio button doesn't work and the scan doesn't run. After hitting the button, the webpage shows 'done but with errors on page' in the lower left-hand corner. I suppose this is really bad and is compromising our ability to use these virus scanners.

Here is the log from Superantispyware (below that is the Hijack this log):

SUPERAntiSpyware Scan Log
Generated 04/12/2007 at 01:17 AM

Application Version : 3.6.1000

Core Rules Database Version : 3217
Trace Rules Database Version: 1227

Scan type : Complete Scan
Total Scan Time : 00:38:15

Memory items scanned : 452
Memory threats detected : 0
Registry items scanned : 4524
Registry threats detected : 0
File items scanned : 37338
File threats detected : 14

Adware.Tracking Cookie
C:\Documents and Settings\Mike H\Cookies\mike_h@upspiral[1].txt
C:\Documents and Settings\Mike H\Cookies\mike_h@pro-market[1].txt
C:\Documents and Settings\Mike H\Cookies\mike_h@toplist[1].txt
C:\Documents and Settings\Mike H\Cookies\mike_h@indiads[1].txt
C:\Documents and Settings\Mike H\Cookies\[removed][2].txt
C:\Documents and Settings\Mike H\Cookies\[removed][1].txt
C:\Documents and Settings\Mike H\Cookies\[removed][2].txt
C:\Documents and Settings\Mike H\Cookies\[removed][1].txt
C:\Documents and Settings\Mike H\Cookies\[removed][1].txt
C:\Documents and Settings\Mike H\Cookies\mike_h@rambler[1].txt
C:\Documents and Settings\Mike H\Cookies\mike_h@cpvfeed[1].txt
C:\Documents and Settings\Mike H\Cookies\mike_h@advertising[2].txt
C:\Documents and Settings\Mike H\Cookies\mike_h@atdmt[1].txt
C:\Documents and Settings\Mike H\Cookies\mike_h@mediaplex[1].txt

Here is my new Hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 1:24:51 AM, on 4/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: 0 - {A3EC8848-59D5-41B4-CF82-DB69B8462960} - C:\Program Files\Internet Explorer\qucaw.dll (file missing)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Image Transfer.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by112fd.bay112.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1136866715612
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1151131197821
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
Post #23 last edited
Please double-click Killbox.exe to run it.
Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:WINDOWS\system32\vexga3me2.exe
C:\WINDOWS\system32\vexga4m1et4.exe
C:\DOCUMENTS AND SETTINGS\MIKEH\LOCALS SETTINGS\Temp\8.tmp.exe
C:\WINDOWS\system32\qwertybot.exe
C:\WINDOWS\system32\smt.exe


Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).


If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.




Let's check your IE settings and see if we can get an online scan going.
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click on the Security tab
  • Click the Internet icon so it becomes highlighted.
  • Click on Default Level and click Ok
  • Click on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Check that Script ActiveX controls marked safe for scripting is set to Enabled or Prompt
    • Check that Run ActiveX controls and plugins is Enabled
    • Change the Initialise and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • Check that Active Scripting is set to Enabled
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
Open a new IE window and try to run the online scan with Kasperskys.


_________________________________________
  • Create a folder on your desktop called Sysclean.
  • Go to http://www.trendmicro.com/download/dcs.asp and download sysclean package to the folder you made.
  • Go to http://www.trendmicro.com/download/pattern.asp and download the Virus Pattern File (Official Pattern Release) to your desktop.
    This file will be called lptXXX.zip (XXX represents the version number)
  • Unzip lptXXX.zip and you'll get the file lpt$vpn.XXX. Read here how to unzip/extract properly.
  • Move the lpt$vpn.XXX to the Sysclean-folder you created on your desktop.
  • Open the sysclean-folder and doubleclick sysclean.com.
  • Check: "Automatically clean or delete detected files".
  • Click scan.
Open your sysclean-folder and copy and paste the contents of sysclean.log in your next reply.


_______________________________________
Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
  • Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
    • In the Files Created Within group click 30 days
    • In the Files Modified Within group select 30 days
    • In the File String Search group select Non-Microsoft
  • Now click the Run Scan button on the toolbar.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Post those logs for me.
Post #24 last edited
Hi Bob, I did as you asked, but with troublimg results. First, although Killbox.exe worked the first time we used it, it doesn't seem to do so now. I opened the program and tried to copy the clipboard using the "paste from clipboard" function in the file menu. It won't copy the several lines of the clipboard. If I do it manually, it will only copy one line at a time. So the question arises: should I do this with killbox line-by-line rebooting each time? If you so advise, that's fine by me though it will take a few minutes more. I downloaded "Component 'MsComCtl.ocx' to see if that would help, then ran it. But it didn't help. Next, I opened up the internet explorer settings and reset as you advised. After hitting 'default' then checking on the settings you mention, only "Navigate sub-frames across different domains to Prompt " needed to be changed. But I was still unable to use kaspersky I haven't performed the other tasks, thinking these may be important to do first. Mike
Post #25
Please download the OTMoveIt by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:WINDOWS\system32\vexga3me2.exe
    C:\WINDOWS\system32\vexga4m1et4.exe
    C:\DOCUMENTS AND SETTINGS\MIKEH\LOCALS SETTINGS\Temp\8.tmp.exe
    C:\WINDOWS\system32\qwertybot.exe


  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
*If a file or folder cannot be moved immediately, you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine, choose Yes.
  • Close OTMoveIt
**If a reboot was necessary or you needed to Exit before posting the log, you will find a copy of the log at the root of the drive where OTMoveIt is installed, usually at :
C:\_OTMoveIt\MovedFiles\********_******.log
(where "********_******" is the "date_time")



____________________________
OK mike. Lets do this untill we clear this thing.. It's going to mean something a little different to learn but will/should help us get the scans we need. You can uninstall it later if you care to once we get internet explorer fixed. I have choose this browser because it supports active X. Something we need for some of the scans.

Go to this site and download avant browser. Install it using default settings.
  • You may want to make it your default browser for a while. We can change that later. This should keep internet explorer from getting in our way. :angry:
  • Be sure to place a shortcut on the desktop for ease of finding it.
  • Now open the Avant Browser if it hasn't opened itself up and copy this line in the address bar.
    http://forums.tomcoyote.org/index.php?showtopic=78166&st=15
  • Click the little greeen arrow to connect to the site.
That will bring you right back here to continue.
Close internet explorer for now. Try using this browser for a while.


Now using Avant browser try kasperskys again.
If kasperskys still doesn't work just continue on with the fix as if I never asked for that scan.

_________________________________
Please do an online scan with Kaspersky Online Scanner
Click on Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
Scan using the following Anti-Virus database:

Extended (If available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan select My Computer

The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.

Now click on the Save as Text button:

Save the file to your desktop.

Copy and paste that information in your next post.


____________________________________
Step : Download and run Sysclean
  • Create a folder on your desktop called Sysclean.
  • Go to http://www.trendmicro.com/download/dcs.asp and download sysclean package to the folder you made.
  • Go to http://www.trendmicro.com/download/pattern.asp and download the Virus Pattern File (Official Pattern Release) to your desktop.
    This file will be called lptXXX.zip (XXX represents the version number)
  • Unzip lptXXX.zip and you'll get the file lpt$vpn.XXX. Read here how to unzip/extract properly.
  • Move the lpt$vpn.XXX to the Sysclean-folder you created on your desktop.
  • Open the sysclean-folder and doubleclick sysclean.com.
  • Check: "Automatically clean or delete detected files".
  • Click scan.
Open your sysclean-folder and copy and paste the contents of sysclean.log in your next reply.




Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
  • Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
    • In the Files Created Within group click 30 days
    • In the Files Modified Within group select 30 days
    • In the File String Search group select Non-Microsoft
  • Now click the Run Scan button on the toolbar.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.


In your next reply ( provided most everything went well)
Please post
  • The report from Kasperskys
  • The report from OTMOVEIT
  • The report from Sysclean
I have a dinner engagment this evening. But Ill be back no later than tommorrow.
Post #26 last edited
Hi Bob, I will keep working at this until I get all the job done from your last instructions. But since I downloaded OTMoveIt and completed that task, I will post it first then go on and add and edit this entry. Here is the OTMoveIt results: File/Folder C:WINDOWS\system32\vexga3me2.exe not found. File/Folder C:\WINDOWS\system32\vexga4m1et4.exe not found. File/Folder C:\DOCUMENTS AND SETTINGS\MIKEH\LOCALS SETTINGS\Temp\8.tmp.exe not found. File/Folder C:\WINDOWS\system32\qwertybot.exe not found. Created on 04/12/2007 16:03:41 But please note that another small window message appeared with a red X that stated:"cannot create file C:\_OTMoveIt\MovedFiles4122007_160341.log". It then had an 'ok' button, which I pressed. Now I'll go back and do the other things. I just downloaded Avant Browser. It is set just as you asked, and is now my default browser. BUT Kaspersky still does not work.
Post #27 last edited
Here now is the SysClean log:


/————————————————————–\
| Trend Micro System Cleaner |
| Copyright 2006, Trend Micro, Inc. |
| http://www.antivirus.com |
\————————————————————–/


2007-04-12, 17:29:20, Auto-clean mode specified.
2007-04-12, 17:29:20, Running scanner "C:\Documents and Settings\Mike H\Desktop\SysClean\TSC.BIN"…
2007-04-12, 17:29:30, Scanner "C:\Documents and Settings\Mike H\Desktop\SysClean\TSC.BIN" has finished running.
2007-04-12, 17:29:30, TSC Log:

Damage Cleanup Engine (DCE) 5.0(Build 1107)
Windows XP(Build 2600: Service Pack 2)



Here also is the text log from WinFind3 (though you didn't ask for it, it seems you wanted it since you asked to turn off the wordwrap):


inPFind3 logfile created on: 4/12/2007 6:03:51 PM
WinPFind3U by OldTimer - Version 1.0.34 Folder = C:\Documents and Settings\Mike H\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 7.0.5730.11)

1.50 Gb Total Physical Memory | 1.04 Gb Available Physical Memory | 69.42% Memory free
2.10 Gb Paging File | 1.71 Gb Available in Paging File | 81.09% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 28.83 Gb Free Space | 77.37% Space Free
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded

Computer Name: MIKE
Current User Name: Mike H
Logged in as Administrator.
Current Boot Mode: Normal


[Processes - Non-Microsoft Only]
apdproxy.exe -> %ProgramFiles%\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe -> Adobe Systems Incorporated [Ver = 3.0.0.49815 | Size = 57344 bytes | Modified Date = 6/6/2005 11:46:24 PM | Attr = ]
apntex.exe -> %ProgramFiles%\Apoint\ApntEx.exe -> Alps Electric Co., Ltd. [Ver = 5.5.1.19 | Size = 45056 bytes | Modified Date = 8/19/2004 9:40:08 AM | Attr = ]
apoint.exe -> %ProgramFiles%\Apoint\Apoint.exe -> Alps Electric Co., Ltd. [Ver = 5.5.101.141 | Size = 155648 bytes | Modified Date = 9/13/2004 11:33:20 AM | Attr = ]
ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> [Ver = 4, 7, 936, 0 | Size = 108160 bytes | Modified Date = 1/15/2007 12:28:58 PM | Attr = ]
ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 255616 bytes | Modified Date = 1/15/2007 12:28:32 PM | Attr = ]
ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> [Ver = 4, 7, 936, 0 | Size = 132736 bytes | Modified Date = 1/15/2007 12:28:52 PM | Attr = ]
ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 370304 bytes | Modified Date = 1/15/2007 12:27:52 PM | Attr = ]
aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> [Ver = | Size = 59008 bytes | Modified Date = 1/15/2007 12:18:24 PM | Attr = ]
ati2evxx.exe -> %System32%\ati2evxx.exe -> [Ver = | Size = 389120 bytes | Modified Date = 8/31/2004 8:38:00 PM | Attr = ]
ati2evxx.exe -> %System32%\ati2evxx.exe -> [Ver = | Size = 389120 bytes | Modified Date = 8/31/2004 8:38:00 PM | Attr = ]
atiptaxx.exe -> %ProgramFiles%\ATI Technologies\ATI Control Panel\atiptaxx.exe -> ATI Technologies, Inc. [Ver = 6.14.10.5120 | Size = 339968 bytes | Modified Date = 8/31/2004 9:10:00 PM | Attr = ]
avant.exe -> %ProgramFiles%\Avant Browser\avant.exe -> [Ver = 11.0.0.0 | Size = 1290752 bytes | Modified Date = 3/1/2007 9:47:06 PM | Attr = ]
bcmwltry.exe -> %System32%\BCMWLTRY.EXE -> Dell Inc [Ver = 3.100.41.0 | Size = 872556 bytes | Modified Date = 2/23/2005 11:19:10 AM | Attr = ]
guard.exe -> %ProgramFiles%\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 10:13:20 AM | Attr = ]
hpgs2wnd.exe -> %ProgramFiles%\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe -> Hewlett-Packard [Ver = 2,3,0,0\ 162 | Size = 69632 bytes | Modified Date = 4/17/2002 10:42:56 AM | Attr = ]
hpgs2wnf.exe -> %ProgramFiles%\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe -> [Ver = 2, 6, 0, 162 | Size = 77824 bytes | Modified Date = 4/17/2002 10:49:16 AM | Attr = ]
hpwuschd2.exe -> %ProgramFiles%\HP\HP Software Update\HPWuSchd2.exe -> Hewlett-Packard Co. [Ver = 50.0.146.000 | Size = 49152 bytes | Modified Date = 2/16/2005 11:11:42 PM | Attr = ]
jusched.exe -> %ProgramFiles%\Java\jre1.5.0_11\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 75520 bytes | Modified Date = 12/15/2006 3:23:28 AM | Attr = ]
nicconfigsvc.exe -> %ProgramFiles%\Dell\NICCONFIGSVC\NICCONFIGSVC.exe -> Dell Inc. [Ver = 1, 0, 0, 1 | Size = 356352 bytes | Modified Date = 3/3/2005 11:29:02 PM | Attr = ]
pctspk.exe -> %System32%\pctspk.exe -> [Ver = 1, 0, 0, 1 | Size = 163840 bytes | Modified Date = 7/18/2002 4:58:40 PM | Attr = ]
superantispyware.exe -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 3, 6, 0, 1000 | Size = 1310720 bytes | Modified Date = 2/27/2007 11:39:26 AM | Attr = ]
winpfind3u.exe -> %UserDesktop%\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.34.0 | Size = 318976 bytes | Modified Date = 4/10/2007 10:00:18 PM | Attr = ]
wltray.exe -> %System32%\WLTRAY.EXE -> Dell Inc [Ver = 3.100.41.0 | Size = 696425 bytes | Modified Date = 2/23/2005 11:19:14 AM | Attr = ]
wltrysvc.exe -> %System32%\WLTRYSVC.EXE -> [Ver = | Size = 65536 bytes | Modified Date = 2/23/2005 11:19:14 AM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> [Ver = | Size = 59008 bytes | Modified Date = 1/15/2007 12:18:24 PM | Attr = ]
(Ati HotKey Poller) Ati HotKey Poller [Win32_Own | Auto | Running] -> %System32%\ati2evxx.exe -> [Ver = | Size = 389120 bytes | Modified Date = 8/31/2004 8:38:00 PM | Attr = ]
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> [Ver = 4, 7, 936, 0 | Size = 132736 bytes | Modified Date = 1/15/2007 12:28:52 PM | Attr = ]
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 255616 bytes | Modified Date = 1/15/2007 12:28:32 PM | Attr = ]
(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 370304 bytes | Modified Date = 1/15/2007 12:27:52 PM | Attr = ]
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> %ProgramFiles%\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 9/28/2006 10:13:20 AM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr = ]
(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IDriverT.exe -> Macrovision Corporation [Ver = 11.00.28844 | Size = 69632 bytes | Modified Date = 4/4/2005 12:41:10 AM | Attr = ]
(NICCONFIGSVC) NICCONFIGSVC [Win32_Own | Auto | Running] -> %ProgramFiles%\Dell\NICCONFIGSVC\NICCONFIGSVC.exe -> Dell Inc. [Ver = 1, 0, 0, 1 | Size = 356352 bytes | Modified Date = 3/3/2005 11:29:02 PM | Attr = ]
(PREVXAgent) Prevx Agent [Win32_Own | Auto | Stopped] -> %ProgramFiles%\Prevx1\PXAgent.exe -> File not found
(wltrysvc) Dell Wireless WLAN Tray Service [Win32_Own | Auto | Running] -> %System32%\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe -> File not found

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Adobe Photo Downloader -> %ProgramFiles%\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe -> Adobe Systems Incorporated [Ver = 3.0.0.49815 | Size = 57344 bytes | Modified Date = 6/6/2005 11:46:24 PM | Attr = ]
Apoint -> %ProgramFiles%\Apoint\Apoint.exe -> Alps Electric Co., Ltd. [Ver = 5.5.101.141 | Size = 155648 bytes | Modified Date = 9/13/2004 11:33:20 AM | Attr = ]
ATIPTA -> %ProgramFiles%\ATI Technologies\ATI Control Panel\atiptaxx.exe -> ATI Technologies, Inc. [Ver = 6.14.10.5120 | Size = 339968 bytes | Modified Date = 8/31/2004 9:10:00 PM | Attr = ]
avast! -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> [Ver = 4, 7, 936, 0 | Size = 108160 bytes | Modified Date = 1/15/2007 12:28:58 PM | Attr = ]
Dell Wireless Manager UI -> %System32%\WLTRAY.EXE -> Dell Inc [Ver = 3.100.41.0 | Size = 696425 bytes | Modified Date = 2/23/2005 11:19:14 AM | Attr = ]
HP Software Update -> %ProgramFiles%\HP\HP Software Update\HPWuSchd2.exe -> Hewlett-Packard Co. [Ver = 50.0.146.000 | Size = 49152 bytes | Modified Date = 2/16/2005 11:11:42 PM | Attr = ]
PCTVOICE -> %System32%\pctspk.exe -> [Ver = 1, 0, 0, 1 | Size = 163840 bytes | Modified Date = 7/18/2002 4:58:40 PM | Attr = ]
QuickTime Task -> %ProgramFiles%\QuickTime\qttask.exe -> File not found
Share-to-Web Namespace Daemon -> %ProgramFiles%\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe -> Hewlett-Packard [Ver = 2,3,0,0\ 162 | Size = 69632 bytes | Modified Date = 4/17/2002 10:42:56 AM | Attr = ]
SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.5.0_11\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 75520 bytes | Modified Date = 12/15/2006 3:23:28 AM | Attr = ]
UserFaultCheck -> -> File not found
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SUPERAntiSpyware -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 3, 6, 0, 1000 | Size = 1310720 bytes | Modified Date = 2/27/2007 11:39:26 AM | Attr = ]
updateMgr -> %ProgramFiles%\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe -> Adobe Systems Incorporated [Ver = 3.1.0.9 | Size = 307200 bytes | Modified Date = 10/24/2005 4:53:40 PM | Attr = ]
Yahoo! Pager -> %ProgramFiles%\Yahoo!\Messenger\YahooMessenger.exe -> Yahoo! Inc. [Ver = 8,1,0,209 | Size = 4662776 bytes | Modified Date = 11/30/2006 10:49:04 PM | Attr = ]
< Common Startup > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup
%AllUsersStartup%\Adobe Reader Speed Launch.lnk -> %ProgramFiles%\Adobe\Acrobat 7.0\Reader\reader_sl.exe -> Adobe Systems Incorporated [Ver = 7.0.5.2005092300 | Size = 29696 bytes | Modified Date = 9/24/2005 2:05:26 AM | Attr = ]
%AllUsersStartup%\Image Transfer.lnk -> %ProgramFiles%\Sony Corporation\Image Transfer\SonyTray.exe -> [Ver = | Size = 73728 bytes | Modified Date = 7/11/2002 10:28:50 PM | Attr = ]
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{57B86673-276A-48B2-BAE7-C6DBB3020EB8} [HKLM] -> %ProgramFiles%\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 73728 bytes | Modified Date = 9/28/2006 10:13:28 AM | Attr = ]
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} [HKLM] -> %ProgramFiles%\SUPERAntiSpyware\SASSEH.DLL [] -> SuperAdBlocker.com [Ver = 1, 0, 0, 1008 | Size = 77824 bytes | Modified Date = 12/20/2006 12:55:48 PM | Attr = ]
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
< Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
!SASWinLogon -> %ProgramFiles%\SUPERAntiSpyware\SASWINLO.dll -> SUPERAntiSpyware.com [Ver = 1, 0, 0, 1030 | Size = 282624 bytes | Modified Date = 2/27/2007 11:39:26 AM | Attr = ]
AtiExtEvent -> %System32%\ati2evxx.dll -> [Ver = | Size = 86016 bytes | Modified Date = 8/31/2004 8:38:00 PM | Attr = ]
< HOSTS File > (23 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts
127.0.0.1 localhost -> ->
< Internet Explorer Settings > ->
HKLM: Default_Page_URL -> http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKLM: Main\\Default_Search_URL -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Search Page -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Start Page -> about:blank ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: SearchAssistant -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm ->
HKCU: Local Page -> C:\WINDOWS\system32\blank.htm ->
HKCU: Search Page -> http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch ->
HKCU: Start Page -> http://www.google.com/ ->
HKCU: ProxyEnable -> 0 ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> %ProgramFiles%\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 7.0.7.2006011200 | Size = 63128 bytes | Modified Date = 1/12/2006 9:38:22 PM | Attr = ]
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [] -> Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Modified Date = 5/31/2005 2:04:00 AM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> %ProgramFiles%\Java\jre1.5.0_11\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 440056 bytes | Modified Date = 12/15/2006 3:23:24 AM | Attr = ]
{A3EC8848-59D5-41B4-CF82-DB69B8462960} [HKLM] -> %ProgramFiles%\Internet Explorer\qucaw.dll [Reg Data - Value does not exist] -> File not found
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
WebBrowser\\{C7768536-96F8-4001-B1A2-90EE21279187} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [HKLM] -> Reg Data - Key not found [Yahoo! Toolbar] -> File not found
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> %ProgramFiles%\Java\jre1.5.0_11\bin\npjpi150_11.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 75528 bytes | Modified Date = 12/15/2006 3:23:26 AM | Attr = ]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> %ProgramFiles%\Java\jre1.5.0_11\bin\ssv.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 440056 bytes | Modified Date = 12/15/2006 3:23:24 AM | Attr = ]
< Internet Explorer Menu Extensions [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\
Add to AD Black List -> %ProgramFiles%\Avant Browser\AddToADBlackList.htm -> [Ver = | Size = 166 bytes | Modified Date = 2/24/2006 3:38:52 AM | Attr = ]
Block All Images from the Same Server -> %ProgramFiles%\Avant Browser\AddAllToADBlackList.htm -> [Ver = | Size = 169 bytes | Modified Date = 2/24/2006 3:38:54 AM | Attr = ]
Highlight -> %ProgramFiles%\Avant Browser\Highlight.htm -> [Ver = | Size = 191 bytes | Modified Date = 2/24/2006 3:38:52 AM | Attr = ]
Open All Links in This Page… -> %ProgramFiles%\Avant Browser\OpenAllLinks.htm -> [Ver = | Size = 272 bytes | Modified Date = 2/24/2006 3:38:50 AM | Attr = ]
Open In New Avant Browser -> %ProgramFiles%\Avant Browser\OpenInNewBrowser.htm -> [Ver = | Size = 1496 bytes | Modified Date = 2/24/2006 3:38:44 AM | Attr = ]
Search -> %ProgramFiles%\Avant Browser\Search.htm -> [Ver = | Size = 188 bytes | Modified Date = 2/24/2006 3:38:58 AM | Attr = ]
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\
{5030B2C4-9729-499E-ABDE-71357FB80D54} -> () ->
{6A6AE238-423F-4CC9-801D-CC60B167E986} -> (Dell TrueMobile 1300 WLAN Mini-PCI Card) ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
{17492023-C23A-453E-A040-C7C580BBF700} -> Windows Genuine Advantage Validation Tool - CodeBase = http://download.microsoft.com/download/3/9…heckControl.cab ->
{30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -> YInstStarter Class - CodeBase = http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab ->
{31E68DE2-5548-4B23-88F0-C51E6A0F695E} -> Microsoft PID Sniffer - CodeBase = https://support.microsoft.com/OAS/ActiveX/odc.cab ->
{4B48D5DF-9021-45F7-A240-60304302A215} -> Malicious Software Removal Tool - CodeBase = http://download.microsoft.com/download/5/c…/WebCleaner.cab ->
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} -> MSN Photo Upload Tool - CodeBase = http://by112fd.bay112.hotmail.msn.com/resources/MsnPUpld.cab ->
{6414512B-B978-451D-A0D8-FCFDF33E833C} -> WUWebControl Class - CodeBase = http://update.microsoft.com/windowsupdate/…b?1136866715612 ->
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -> MUWebControl Class - CodeBase = http://update.microsoft.com/microsoftupdat…b?1151131197821 ->
{8AD9C840-044E-11D1-B3E9-00805F499D93} -> Java Plug-in 1.5.0_11 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab ->
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} -> Java Plug-in 1.5.0_11 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab ->
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -> Java Plug-in 1.5.0_11 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab ->
{D27CDB6E-AE6D-11CF-96B8-444553540000} -> - CodeBase = http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab ->


[Files/Folders - Created Within 30 days]
!KillBox -> %SystemDrive%\!KillBox -> [Folder | Created Date = 4/6/2007 8:50:05 PM | Attr = ]
63530fac73fa18291e2d055c -> %SystemDrive%\63530fac73fa18291e2d055c -> [Folder | Created Date = 3/31/2007 9:14:12 AM | Attr = ]
Drivers -> %SystemDrive%\Drivers -> [Folder | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
fixwareout -> %SystemDrive%\fixwareout -> [Folder | Created Date = 4/4/2007 2:15:19 PM | Attr = ]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = | Size = 1609871360 bytes | Created Date = 1/1/1601 5:00:00 AM | Attr = HS]
QooBox -> %SystemDrive%\QooBox -> [Folder | Created Date = 4/6/2007 2:52:22 AM | Attr = ]
SDFix -> %SystemDrive%\SDFix -> [Folder | Created Date = 4/5/2007 5:19:45 PM | Attr = ]
$NtUninstallKB929338$ -> %SystemRoot%\$NtUninstallKB929338$ -> [Folder | Created Date = 3/15/2007 2:46:51 AM | Attr = H ]
erdnt -> %SystemRoot%\erdnt -> [Folder | Created Date = 4/6/2007 2:52:58 AM | Attr = ]
temp -> %SystemRoot%\temp -> [Folder | Created Date = 4/9/2007 2:38:03 AM | Attr = ]
TWlrZSBI -> %SystemRoot%\TWlrZSBI -> [Folder | Created Date = 4/1/2007 8:43:13 PM | Attr = HS]
actskin4.ocx -> %System32%\actskin4.ocx -> [Ver = 4, 2, 7, 3 | Size = 380928 bytes | Created Date = 4/10/2007 11:23:09 PM | Attr = ]
aswBoot.exe -> %System32%\aswBoot.exe -> [Ver = 4, 7, 936, 0 | Size = 689280 bytes | Created Date = 4/10/2007 11:23:09 PM | Attr = ]
AVASTSS.scr -> %System32%\AVASTSS.scr -> ALWIL Software [Ver = 4, 7, 936, 0 | Size = 90112 bytes | Created Date = 4/10/2007 11:23:09 PM | Attr = ]
CMMGR32.EXE -> %System32%\CMMGR32.EXE -> [Ver = | Size = 0 bytes | Created Date = 4/11/2007 11:43:47 PM | Attr = ]
java.exe -> %System32%\java.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 49248 bytes | Created Date = 4/6/2007 1:04:49 PM | Attr = ]
javaw.exe -> %System32%\javaw.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 53346 bytes | Created Date = 4/6/2007 1:04:49 PM | Attr = ]
javaws.exe -> %System32%\javaws.exe -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 127078 bytes | Created Date = 4/6/2007 1:04:49 PM | Attr = ]
jpicpl32.cpl -> %System32%\jpicpl32.cpl -> Sun Microsystems, Inc. [Ver = 5.0.110.3 | Size = 49265 bytes | Created Date = 4/6/2007 1:04:49 PM | Attr = ]
LTOCX12n.INF -> %System32%\LTOCX12n.INF -> [Ver = | Size = 1458 bytes | Created Date = 3/26/2007 1:04:17 AM | Attr = ]
ltocx12n.ocx -> %System32%\ltocx12n.ocx -> LEAD Technologies, Inc. [Ver = 12.1.0.015 | Size = 610816 bytes | Created Date = 3/26/2007 1:04:17 AM | Attr = ]
SONYHCY.DLL -> %System32%\SONYHCY.DLL -> Sony Corporation [Ver = 1.00.0628 | Size = 53248 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
aavmker4.sys -> %System32%\drivers\aavmker4.sys -> ALWIL Software [Ver = 4.7.892.0 | Size = 31560 bytes | Created Date = 4/10/2007 11:23:16 PM | Attr = ]
aswmon.sys -> %System32%\drivers\aswmon.sys -> ALWIL Software [Ver = 4.7.892.0 | Size = 85952 bytes | Created Date = 4/10/2007 11:23:14 PM | Attr = ]
aswmon2.sys -> %System32%\drivers\aswmon2.sys -> ALWIL Software [Ver = 4.7.892.0 | Size = 94424 bytes | Created Date = 4/10/2007 11:23:14 PM | Attr = ]
aswRdr.sys -> %System32%\drivers\aswRdr.sys -> ALWIL Software [Ver = 4.7.936.0 | Size = 23352 bytes | Created Date = 4/10/2007 11:23:17 PM | Attr = ]
aswTdi.sys -> %System32%\drivers\aswTdi.sys -> ALWIL Software [Ver = 4.7.936.0 | Size = 43176 bytes | Created Date = 4/10/2007 11:23:17 PM | Attr = ]
AvgAsCln.sys -> %System32%\drivers\AvgAsCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 4/3/2007 5:13:50 PM | Attr = ]
core.cache.dsk -> %System32%\drivers\core.cache.dsk -> [Ver = | Size = 182323 bytes | Created Date = 3/31/2007 3:38:35 AM | Attr = ]
core.sys -> %System32%\drivers\core.sys -> [Ver = | Size = 72320 bytes | Created Date = 3/31/2007 3:38:35 AM | Attr = ]
sonyhcb.sys -> %System32%\drivers\sonyhcb.sys -> Sony Corporation [Ver = 1, 0, 0, 53 | Size = 6097 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
sonyhcc.sys -> %System32%\drivers\sonyhcc.sys -> Sony Corporation [Ver = 1, 0, 0, 53 | Size = 38739 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
Sonyhcp.dll -> %System32%\drivers\Sonyhcp.dll -> [Ver = | Size = 3654 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
sonyhcs.sys -> %System32%\drivers\sonyhcs.sys -> Sony Corporation [Ver = 1, 0, 0, 53 | Size = 299923 bytes | Created Date = 3/26/2007 1:03:14 AM | Attr = ]
hosts.20070401-042640.backup -> %System32%\drivers\etc\hosts.20070401-042640.backup -> [Ver = | Size = 5796 bytes | Created Date = 4/1/2007 3:26:40 AM | Attr = R ]

[Files/Folders - Modified Within 30 days]
!KillBox -> %SystemDrive%\!KillBox -> [Folder | Modified Date = 4/11/2007 3:38:36 AM | Attr = ]
63530fac73fa18291e2d055c -> %SystemDrive%\63530fac73fa18291e2d055c -> [Folder | Modified Date = 3/31/2007 10:14:14 AM | Attr = ]
boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 211 bytes | Modified Date = 3/27/2007 6:34:12 PM | Attr = HS]
Config.Msi -> %SystemDrive%\Config.Msi -> [Folder | Modified Date = 4/12/2007 12:28:40 AM | Attr = H ]
Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Modified Date = 4/3/2007 2:00:24 AM | Attr = ]
Drivers -> %SystemDrive%\Drivers -> [Folder | Modified Date = 3/26/2007 2:03:16 AM | Attr = ]
fixwareout -> %SystemDrive%\fixwareout -> [Folder | Modified Date = 4/6/2007 10:24:12 PM | Attr = ]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = | Size = 1609871360 bytes | Modified Date = 4/12/2007 3:59:02 PM | Attr = HS]
HijackThis -> %SystemDrive%\HijackThis -> [Folder | Modified Date = 4/12/2007 1:24:48 AM | Attr = ]
Program Files -> %ProgramFiles% -> [Folder | Modified Date = 4/12/2007 4:19:34 PM | Attr = ]
QooBox -> %SystemDrive%\QooBox -> [Folder | Modified Date = 4/6/2007 3:52:24 AM | Attr = ]
RECYCLER -> %SystemDrive%\RECYCLER -> [Folder | Modified Date = 4/6/2007 2:46:12 AM | Attr = HS]
SDFix -> %SystemDrive%\SDFix -> [Folder | Modified Date = 4/5/2007 6:19:46 PM | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 4/12/2007 3:59:42 PM | Attr = ]
$hf_mig$ -> %SystemRoot%\$hf_mig$ -> [Folder | Modified Date = 3/15/2007 1:42:10 AM | Attr = H ]
$NtUninstallKB929338$ -> %SystemRoot%\$NtUninstallKB929338$ -> [Folder | Modified Date = 3/15/2007 3:46:54 AM | Attr = H ]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Modified Date = 4/11/2007 4:15:16 AM | Attr = S]
erdnt -> %SystemRoot%\erdnt -> [Folder | Modified Date = 4/6/2007 3:53:00 AM | Attr = ]
imsins.BAK -> %SystemRoot%\imsins.BAK -> [Ver = | Size = 1891 bytes | Modified Date = 4/2/2007 1:01:28 AM | Attr = ]
inf -> %SystemRoot%\inf -> [Folder | Modified Date = 3/30/2007 4:01:40 PM | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 4/12/2007 12:28:40 AM | Attr = HS]
MEMORY.DMP -> %SystemRoot%\MEMORY.DMP -> [Ver = | Size = 805306368 bytes | Modified Date = 4/5/2007 7:02:46 PM | Attr = ]
Minidump -> %SystemRoot%\Minidump -> [Folder | Modified Date = 3/31/2007 7:58:36 PM | Attr = ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 4/6/2007 3:01:08 AM | Attr = ]
system.ini -> %SystemRoot%\system.ini -> [Ver = | Size = 227 bytes | Modified Date = 3/27/2007 6:34:12 PM | Attr = ]
system32 -> %System32% -> [Folder | Modified Date = 4/12/2007 12:43:48 AM | Attr = ]
Tasks -> %SystemRoot%\Tasks -> [Folder | Modified Date = 4/12/2007 4:02:22 PM | Attr = S]
temp -> %SystemRoot%\temp -> [Folder | Modified Date = 4/12/2007 4:00:24 PM | Attr = ]
TWlrZSBI -> %SystemRoot%\TWlrZSBI -> [Folder | Modified Date = 4/2/2007 3:04:36 AM | Attr = HS]
win.ini -> %SystemRoot%\win.ini -> [Ver = | Size = 677 bytes | Modified Date = 3/27/2007 6:34:12 PM | Attr = ]
WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified Date = 4/1/2007 10:36:26 PM | Attr = ]
MP Scheduled Scan.job -> %SystemRoot%\tasks\MP Scheduled Scan.job -> [Ver = | Size = 330 bytes | Modified Date = 4/12/2007 4:02:22 PM | Attr = H ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 4/12/2007 3:59:20 PM | Attr = H ]
CatRoot2 -> %System32%\CatRoot2 -> [Folder | Modified Date = 4/12/2007 12:43:48 AM | Attr = ]
CMMGR32.EXE -> %System32%\CMMGR32.EXE -> [Ver = | Size = 0 bytes | Modified Date = 4/12/2007 12:43:48 AM | Attr = ]
config -> %System32%\config -> [Folder | Modified Date = 4/11/2007 11:20:14 PM | Attr = ]
CONFIG.NT -> %System32%\CONFIG.NT -> [Ver = | Size = 2626 bytes | Modified Date = 4/11/2007 12:23:18 AM | Attr = ]
dllcache -> %System32%\dllcache -> [Folder | Modified Date = 4/11/2007 4:06:40 AM | Attr = RHS]
drivers -> %System32%\drivers -> [Folder | Modified Date = 4/11/2007 12:23:18 AM | Attr = ]
FxsTmp -> %System32%\FxsTmp -> [Folder | Modified Date = 4/8/2007 11:06:06 PM | Attr = ]
mapisvc.inf -> %System32%\mapisvc.inf -> [Ver = | Size = 1074 bytes | Modified Date = 4/3/2007 1:57:36 AM | Attr = ]
tmp.reg -> %System32%\tmp.reg -> [Ver = | Size = 2222 bytes | Modified Date = 4/6/2007 10:26:10 PM | Attr = ]
wpa.dbl -> %System32%\wpa.dbl -> [Ver = | Size = 2206 bytes | Modified Date = 4/1/2007 9:06:56 PM | Attr = ]
core.cache.dsk -> %System32%\drivers\core.cache.dsk -> [Ver = | Size = 182323 bytes | Modified Date = 3/31/2007 4:38:36 AM | Attr = ]
core.sys -> %System32%\drivers\core.sys -> [Ver = | Size = 72320 bytes | Modified Date = 3/31/2007 4:38:36 AM | Attr = ]
etc -> %System32%\drivers\etc -> [Folder | Modified Date = 4/6/2007 3:54:08 AM | Attr = ]
hosts.20070401-042640.backup -> %System32%\drivers\etc\hosts.20070401-042640.backup -> [Ver = | Size = 5796 bytes | Modified Date = 4/1/2007 4:26:42 AM | Attr = R ]

[File String Scan - Non-Microsoft Only]
File scan skipped for file %SystemRoot%\MEMORY.DMP -> File size too big (805306368 bytes) ->
UPX! , UPX0 , -> %System32%\aswBoot.exe -> [Ver = 4, 7, 936, 0 | Size = 689280 bytes | Modified Date = 1/15/2007 12:32:08 PM | Attr = ]
PEC2 , -> %System32%\dfrg.msc -> [Ver = | Size = 41397 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr = ]
PEC2 , PECompact2 , -> %System32%\DivX.dll -> DivX, Inc. [Ver = 6.5.0.53 | Size = 639066 bytes | Modified Date = 2/1/2007 12:56:06 AM | Attr = ]
UPX! , UPX0 , -> %System32%\intr32.dll -> Home [Ver = 1.00 | Size = 12800 bytes | Modified Date = 10/20/2006 3:27:34 AM | Attr = ]
Thawte Consulting , -> %System32%\SmartUI2.ocx -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 2.00.0202 | Size = 874248 bytes | Modified Date = 6/14/2004 4:04:34 PM | Attr = ]
UPX! , UPX0 , -> %System32%\SrchSTS.exe -> S!Ri [Ver = | Size = 288417 bytes | Modified Date = 4/27/2006 5:49:30 PM | Attr = ]
UPX! , UPX0 , -> %System32%\swreg.exe -> SteelWerX [Ver = 2.0.1.0 | Size = 135168 bytes | Modified Date = 8/29/2006 7:43:54 PM | Attr = ]
UPX! , UPX0 , -> %System32%\swsc.exe -> [Ver = | Size = 40960 bytes | Modified Date = 1/9/2006 10:36:06 AM | Attr = ]
UPX! , UPX0 , -> %System32%\swxcacls.exe -> SteelWerX [Ver = 1.0.1.1 | Size = 79360 bytes | Modified Date = 12/1/2006 6:20:34 AM | Attr = ]
winsync , -> %System32%\wbdbase.deu -> [Ver = | Size = 1309184 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr = ]
Thawte Consulting , -> %System32%\XceedCry.dll -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 1.1.107.0 | Size = 512688 bytes | Modified Date = 11/19/2003 3:59:36 PM | Attr = ]
Thawte Consulting , -> %System32%\XceedZip.dll -> Xceed Software Inc [removed] [removed] www.xceedsoft.com [Ver = 5.0.117.0 | Size = 427864 bytes | Modified Date = 6/14/2004 3:56:26 PM | Attr = ]
abetterinternet.com , -> %System32%\drivers\etc\hosts.20070401-042640.backup -> [Ver = | Size = 5796 bytes | Modified Date = 4/1/2007 4:26:42 AM | Attr = R ]
abetterinternet.com , -> %System32%\drivers\etc\hosts.bak -> [Ver = | Size = 5468 bytes | Modified Date = 6/30/2006 1:50:48 AM | Attr = ]

< End of report >

Start time : Thu Apr 12 2007 17:29:21

Load Damage Cleanup Template (DCT) "C:\Documents and Settings\Mike H\Desktop\SysClean\tsc.ptn" (version 854) [success]

Complete time : Thu Apr 12 2007 17:29:30
Execute pattern count(3080), Virus found count(0), Virus clean count(0), Clean failed count(0)

2007-04-12, 17:29:42, An error was detected on "C:\System Volume Information\*.*": Access is denied.
2007-04-12, 17:46:14, Files Detected:
Copyright © 1990 - 2004 Trend Micro Inc.
Report Date : 4/12/2007 17:29:55
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 409 (176022 Patterns) (2007/04/11) (440900)
Command Line: C:\Documents and Settings\Mike H\Desktop\SysClean\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Documents and Settings\Mike H\Desktop\SysClean

C:\QooBox\Quarantine\WINDOWS\system32\lzx32.sys.vir [BKDR_RUSTOCK.AM]
26587 files have been read.
26587 files have been checked.
23459 files have been scanned.
49764 files have been scanned. (including files in archived)
7 files containing viruses.
Found 18 viruses totally.
Maybe 0 viruses totally.
Stop At : 4/12/2007 17:46:13
———*———*———*———*———*———*———*———*
2007-04-12, 17:46:14, Files Clean:
Copyright © 1990 - 2004 Trend Micro Inc.
Report Date : 4/12/2007 17:29:55
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 409 (176022 Patterns) (2007/04/11) (440900)
Command Line: C:\Documents and Settings\Mike H\Desktop\SysClean\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Documents and Settings\Mike H\Desktop\SysClean

Success Clean [JAVA_BYTEVER.A-1]( 1) from C:\Documents and Settings\Mike H\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a27-5b155cf3.zip,(VerifierBug.class)
Success Clean [ JAVA_BYTEVER.A]( 1) from C:\Documents and Settings\Mike H\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-2af0e7a9-77b64e20.zip,(Beyond.class)
Success Clean [ JAVA_BYTEVER.A]( 1) from C:\Documents and Settings\Mike H\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-31848636-2fb1f540.zip,(Beyond.class)
Success Clean [ JAVA_BYTEVER.AD]( 1) from C:\Documents and Settings\Mike H\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ie0601a.jar-2d1f118a-3d285c4d.zip,(Installer.class)
Success Clean [ JAVA_BYTEVER.AD]( 1) from C:\Documents and Settings\Mike H\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ie0601a.jar-686cd5c0-2bcdfcbc.zip,(Installer.class)
Success Clean [ BKDR_RUSTOCK.AM]( 1) from C:\QooBox\Quarantine\WINDOWS\system32\lzx32.sys.vir
Success Clean [ TROJ_AGENT.PSQ]( 1) from C:\SDFix\SDFix\backups\backups.zip,(backups\stdrun7.exe)
26587 files have been read.
26587 files have been checked.
23459 files have been scanned.
49764 files have been scanned. (including files in archived)
7 files containing viruses.
Found 18 viruses totally.
Maybe 0 viruses totally.
Stop At : 4/12/2007 17:46:13 16 minutes 17 seconds (977.68 seconds) has elapsed.

———*———*———*———*———*———*———*———*
2007-04-12, 17:46:14, Clean Fail:
Copyright © 1990 - 2004 Trend Micro Inc.
Report Date : 4/12/2007 17:29:55
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 409 (176022 Patterns) (2007/04/11) (440900)
Command Line: C:\Documents and Settings\Mike H\Desktop\SysClean\VSCANTM.BIN /NBPM /S /CLEANALL /DCEGENCLEAN /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Documents and Settings\Mike H\Desktop\SysClean

26587 files have been read.
26587 files have been checked.
23459 files have been scanned.
49764 files have been scanned. (including files in archived)
7 files containing viruses.
Found 18 viruses totally.
Maybe 0 viruses totally.
Stop At : 4/12/2007 17:46:13 16 minutes 17 seconds (977.68 seconds) has elapsed.

———*———*———*———*———*———*———*———*
2007-04-12, 17:46:14, Scanner "C:\Documents and Settings\Mike H\Desktop\SysClean\VSCANTM.BIN" has finished running.
Post #29 last edited
Hi Bob, I never have had Avast or Avant before you suggested I download them. I am now using Avant as my browser.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI