What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Annoying Browser Hijacker?

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello. I think I fixed alot of problems that my friend is having by downloading and using another anti-virus (AVG instead of her VirusRescue) program in conjection with Spybot, Ad-aware and Windows Defender. I also downloaded Spyware Blaster and ei-spyad2 for further protection.

She had a great many malware/spyware carp** which these programs were able to (hopefully) fix. But there remains some issues that I need help with (cpu freezes at times and she gets pop-ups and redirection when using her EI7 browser)

Please view this HighjackThis log. Thanks.

Logfile of HijackThis v1.99.1
Scan saved at 4:52:36 PM, on 5/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Sanctity\Desktop\Programs\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: (no name) - {18668683-731c-48fa-b1b9-ad013748fb00} - (no file)
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\dgnhhjum.dll",realset
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1167256547828
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1167435226000
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…923/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{836691DC-3406-4673-A10A-5FF258F056C7}: Domain = sympatico.ca
O17 - HKLM\System\CCS\Services\Tcpip\..\{C36BF24F-73E9-4A92-BDF3-131AF7C39A36}: Domain = sympatico.ca
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

:wavey:
Post #2
Hello and Welcome to the forum.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Open the HijackThis Folder. Find the file HijackThis.exe, Right Click on the file and Select Rename. Rename Hijackthis.exe to Spyware.exe.

Post a new HijackThis Log.
Post #3
Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 9:11:42 PM, on 5/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sanctity\Desktop\Programs\spyware.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {2C2B1C04-5039-4658-A9C7-CBB54F3121DB} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {B4EA6AA6-C202-4083-ABEC-1116D64AEA92} - (no file)
O2 - BHO: (no name) - {B670073F-6174-488C-B5B5-3A471C6240E8} - C:\WINDOWS\system32\efcccab.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\birtqtlk.dll
O2 - BHO: (no name) - {EA57D7CD-6A20-427A-8814-DEAE7A64374B} - C:\WINDOWS\system32\vtstr.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\dgnhhjum.dll",realset
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1167256547828
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1167435226000
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…923/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{836691DC-3406-4673-A10A-5FF258F056C7}: Domain = sympatico.ca
O17 - HKLM\System\CCS\Services\Tcpip\..\{C36BF24F-73E9-4A92-BDF3-131AF7C39A36}: Domain = sympatico.ca
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O20 - Winlogon Notify: efcccab - C:\WINDOWS\SYSTEM32\efcccab.dll
O20 - Winlogon Notify: vtstr - C:\WINDOWS\system32\vtstr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Post #4
* Download VirtumundoBegone, place it on your desktop.

Doubleclick VirtumundoBeGone.exe to start the tool.
Follow the instructions on the screen.
Don't worry if you'll get a Blue screen with an error in it - this is normal.
After reboot,

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following if still present (some entries won't be present anymore):

O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {2C2B1C04-5039-4658-A9C7-CBB54F3121DB} - (no file)
O2 - BHO: (no name) - {B4EA6AA6-C202-4083-ABEC-1116D64AEA92} - (no file)
O2 - BHO: (no name) - {B670073F-6174-488C-B5B5-3A471C6240E8} - C:\WINDOWS\system32\efcccab.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\birtqtlk.dll
O2 - BHO: (no name) - {EA57D7CD-6A20-427A-8814-DEAE7A64374B} - C:\WINDOWS\system32\vtstr.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\dgnhhjum.dll",realset
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O20 - Winlogon Notify: efcccab - C:\WINDOWS\SYSTEM32\efcccab.dll
O20 - Winlogon Notify: vtstr - C:\WINDOWS\system32\vtstr.dll

* Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Delete these files if listed:
C:\WINDOWS\system32\efcccab.dll
C:\WINDOWS\system32\birtqtlk.dll
C:\WINDOWS\system32\vtstr.dll
C:\WINDOWS\system32\dgnhhjum.dll




Empty Recycle Bin

Reboot

Post the contents of the log VBG.TXT which present on your desktop together with a new HijackThis log in your next reply.
Post #5
Thanks.

I deleted two of the four files. I could not find vtstr.dll. I could not delete (or rename) the efcccab.dll file. The message I get from that is "Access is denied. Make sure the disk is not full or write-protected and that the file is currently not in use".

Here are the logs.


[05/03/2007, 21:36:01] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Sanctity\Desktop\VirtumundoBeGone.exe" )
[05/03/2007, 21:36:37] - Detected System Information:
[05/03/2007, 21:36:37] - Windows Version: 5.1.2600, Service Pack 2
[05/03/2007, 21:36:37] - Current Username: Sanctity (Admin)
[05/03/2007, 21:36:37] - Windows is in NORMAL mode.
[05/03/2007, 21:36:37] - Searching for Browser Helper Objects:
[05/03/2007, 21:36:37] - BHO 1: AutorunsDisabled ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - No filename found. Continuing.
[05/03/2007, 21:36:37] - BHO 2: {2C2B1C04-5039-4658-A9C7-CBB54F3121DB} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - No filename found. Continuing.
[05/03/2007, 21:36:37] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/03/2007, 21:36:37] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/03/2007, 21:36:37] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/03/2007, 21:36:37] - BHO 5: {B4EA6AA6-C202-4083-ABEC-1116D64AEA92} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - No filename found. Continuing.
[05/03/2007, 21:36:37] - BHO 6: {B670073F-6174-488C-B5B5-3A471C6240E8} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - Checking for HKLM\…\Winlogon\Notify\efcccab
[05/03/2007, 21:36:37] - Found: HKLM\…\Winlogon\Notify\efcccab - This is probably Virtumundo.
[05/03/2007, 21:36:37] - Assigning {B670073F-6174-488C-B5B5-3A471C6240E8} MSEvents Object
[05/03/2007, 21:36:37] - BHO list has been changed! Starting over…
[05/03/2007, 21:36:37] - BHO 1: AutorunsDisabled ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - No filename found. Continuing.
[05/03/2007, 21:36:37] - BHO 2: {2C2B1C04-5039-4658-A9C7-CBB54F3121DB} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - No filename found. Continuing.
[05/03/2007, 21:36:37] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/03/2007, 21:36:37] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/03/2007, 21:36:37] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/03/2007, 21:36:37] - BHO 5: {B4EA6AA6-C202-4083-ABEC-1116D64AEA92} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - No filename found. Continuing.
[05/03/2007, 21:36:37] - BHO 6: {B670073F-6174-488C-B5B5-3A471C6240E8} (MSEvents Object)
[05/03/2007, 21:36:37] - ALERT: Found MSEvents Object!
[05/03/2007, 21:36:37] - BHO 7: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - Checking for HKLM\…\Winlogon\Notify\birtqtlk
[05/03/2007, 21:36:37] - Key not found: HKLM\…\Winlogon\Notify\birtqtlk, continuing.
[05/03/2007, 21:36:37] - BHO 8: {EA57D7CD-6A20-427A-8814-DEAE7A64374B} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - Checking for HKLM\…\Winlogon\Notify\vtstr
[05/03/2007, 21:36:37] - Found: HKLM\…\Winlogon\Notify\vtstr - This is probably Virtumundo.
[05/03/2007, 21:36:37] - Assigning {EA57D7CD-6A20-427A-8814-DEAE7A64374B} MSEvents Object
[05/03/2007, 21:36:37] - BHO list has been changed! Starting over…
[05/03/2007, 21:36:37] - BHO 1: AutorunsDisabled ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - No filename found. Continuing.
[05/03/2007, 21:36:37] - BHO 2: {2C2B1C04-5039-4658-A9C7-CBB54F3121DB} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - No filename found. Continuing.
[05/03/2007, 21:36:37] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/03/2007, 21:36:37] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/03/2007, 21:36:37] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/03/2007, 21:36:37] - BHO 5: {B4EA6AA6-C202-4083-ABEC-1116D64AEA92} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - No filename found. Continuing.
[05/03/2007, 21:36:37] - BHO 6: {B670073F-6174-488C-B5B5-3A471C6240E8} (MSEvents Object)
[05/03/2007, 21:36:37] - ALERT: Found MSEvents Object!
[05/03/2007, 21:36:37] - BHO 7: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/03/2007, 21:36:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:37] - Checking for HKLM\…\Winlogon\Notify\birtqtlk
[05/03/2007, 21:36:37] - Key not found: HKLM\…\Winlogon\Notify\birtqtlk, continuing.
[05/03/2007, 21:36:37] - BHO 8: {EA57D7CD-6A20-427A-8814-DEAE7A64374B} (MSEvents Object)
[05/03/2007, 21:36:37] - ALERT: Found MSEvents Object!
[05/03/2007, 21:36:37] - Finished Searching Browser Helper Objects
[05/03/2007, 21:36:37] - *** Detected MSEvents Object
[05/03/2007, 21:36:37] - Trying to remove MSEvents Object…
[05/03/2007, 21:36:38] - Terminating Process: IEXPLORE.EXE
[05/03/2007, 21:36:39] - Terminating Process: RUNDLL32.EXE
[05/03/2007, 21:36:39] - Disabling Automatic Shell Restart
[05/03/2007, 21:36:39] - Terminating Process: EXPLORER.EXE
[05/03/2007, 21:36:39] - Suspending the NT Session Manager System Service
[05/03/2007, 21:36:40] - Terminating Windows NT Logon/Logoff Manager
[05/03/2007, 21:36:40] - Re-enabling Automatic Shell Restart
[05/03/2007, 21:36:40] - File to disable: C:\WINDOWS\system32\efcccab.dll
[05/03/2007, 21:36:40] - Renaming C:\WINDOWS\system32\efcccab.dll -> C:\WINDOWS\system32\efcccab.dll.vir
[05/03/2007, 21:36:40] - ! File rename was unsucessful.
[05/03/2007, 21:36:40] - Attempting to Deny Access to C:\WINDOWS\system32\efcccab.dll
[05/03/2007, 21:36:40] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[05/03/2007, 21:36:40] - processed file: C:\WINDOWS\system32\efcccab.dll

[05/03/2007, 21:36:40] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[05/03/2007, 21:36:40] - Removing HKLM\…\Browser Helper Objects\{B670073F-6174-488C-B5B5-3A471C6240E8}
[05/03/2007, 21:36:41] - Removing HKCR\CLSID\{B670073F-6174-488C-B5B5-3A471C6240E8}
[05/03/2007, 21:36:41] - Adding Kill Bit for ActiveX for GUID: {B670073F-6174-488C-B5B5-3A471C6240E8}
[05/03/2007, 21:36:41] - Deleting ATLEvents/MSEvents Registry entries
[05/03/2007, 21:36:41] - Removing HKLM\…\Winlogon\Notify\efcccab
[05/03/2007, 21:36:41] - Searching for Browser Helper Objects:
[05/03/2007, 21:36:41] - BHO 1: AutorunsDisabled ()
[05/03/2007, 21:36:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:41] - No filename found. Continuing.
[05/03/2007, 21:36:41] - BHO 2: {2C2B1C04-5039-4658-A9C7-CBB54F3121DB} ()
[05/03/2007, 21:36:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:41] - No filename found. Continuing.
[05/03/2007, 21:36:41] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/03/2007, 21:36:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:41] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/03/2007, 21:36:41] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/03/2007, 21:36:41] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/03/2007, 21:36:41] - BHO 5: {B4EA6AA6-C202-4083-ABEC-1116D64AEA92} ()
[05/03/2007, 21:36:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:41] - No filename found. Continuing.
[05/03/2007, 21:36:41] - BHO 6: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/03/2007, 21:36:41] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:41] - Checking for HKLM\…\Winlogon\Notify\birtqtlk
[05/03/2007, 21:36:41] - Key not found: HKLM\…\Winlogon\Notify\birtqtlk, continuing.
[05/03/2007, 21:36:41] - BHO 7: {EA57D7CD-6A20-427A-8814-DEAE7A64374B} (MSEvents Object)
[05/03/2007, 21:36:41] - ALERT: Found MSEvents Object!
[05/03/2007, 21:36:41] - Finished Searching Browser Helper Objects
[05/03/2007, 21:36:41] - *** Detected MSEvents Object
[05/03/2007, 21:36:41] - Trying to remove MSEvents Object…
[05/03/2007, 21:36:42] - Terminating Process: IEXPLORE.EXE
[05/03/2007, 21:36:42] - Terminating Process: RUNDLL32.EXE
[05/03/2007, 21:36:42] - Disabling Automatic Shell Restart
[05/03/2007, 21:36:42] - Terminating Process: EXPLORER.EXE
[05/03/2007, 21:36:42] - Suspending the NT Session Manager System Service
[05/03/2007, 21:36:42] - Terminating Windows NT Logon/Logoff Manager
[05/03/2007, 21:36:42] - Re-enabling Automatic Shell Restart
[05/03/2007, 21:36:42] - File to disable: C:\WINDOWS\system32\vtstr.dll
[05/03/2007, 21:36:42] - Renaming C:\WINDOWS\system32\vtstr.dll -> C:\WINDOWS\system32\vtstr.dll.vir
[05/03/2007, 21:36:42] - ! File rename was unsucessful.
[05/03/2007, 21:36:42] - Attempting to Deny Access to C:\WINDOWS\system32\vtstr.dll
[05/03/2007, 21:36:42] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.
[05/03/2007, 21:36:42] - ERROR: The system cannot find the file specified.

[05/03/2007, 21:36:42] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.
[05/03/2007, 21:36:42] - Removing HKLM\…\Browser Helper Objects\{EA57D7CD-6A20-427A-8814-DEAE7A64374B}
[05/03/2007, 21:36:42] - Removing HKCR\CLSID\{EA57D7CD-6A20-427A-8814-DEAE7A64374B}
[05/03/2007, 21:36:42] - Adding Kill Bit for ActiveX for GUID: {EA57D7CD-6A20-427A-8814-DEAE7A64374B}
[05/03/2007, 21:36:42] - Deleting ATLEvents/MSEvents Registry entries
[05/03/2007, 21:36:42] - Removing HKLM\…\Winlogon\Notify\vtstr
[05/03/2007, 21:36:42] - Searching for Browser Helper Objects:
[05/03/2007, 21:36:42] - BHO 1: AutorunsDisabled ()
[05/03/2007, 21:36:42] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:42] - No filename found. Continuing.
[05/03/2007, 21:36:43] - BHO 2: {2C2B1C04-5039-4658-A9C7-CBB54F3121DB} ()
[05/03/2007, 21:36:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:43] - No filename found. Continuing.
[05/03/2007, 21:36:43] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/03/2007, 21:36:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:43] - Checking for HKLM\…\Winlogon\Notify\SDHelper
[05/03/2007, 21:36:43] - Key not found: HKLM\…\Winlogon\Notify\SDHelper, continuing.
[05/03/2007, 21:36:43] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[05/03/2007, 21:36:43] - BHO 5: {B4EA6AA6-C202-4083-ABEC-1116D64AEA92} ()
[05/03/2007, 21:36:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:43] - No filename found. Continuing.
[05/03/2007, 21:36:43] - BHO 6: {D651AFF4-9590-424d-BD1E-8E33E090DFB3} ()
[05/03/2007, 21:36:43] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/03/2007, 21:36:43] - Checking for HKLM\…\Winlogon\Notify\birtqtlk
[05/03/2007, 21:36:43] - Key not found: HKLM\…\Winlogon\Notify\birtqtlk, continuing.
[05/03/2007, 21:36:43] - Finished Searching Browser Helper Objects
[05/03/2007, 21:36:43] - Finishing up…
[05/03/2007, 21:36:43] - A restart is needed.
[05/03/2007, 21:37:02] - Attempting to Restart via STOP error (Blue Screen!)

Logfile of HijackThis v1.99.1
Scan saved at 10:12:17 PM, on 5/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sanctity\Desktop\Programs\spyware.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1167256547828
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1167435226000
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…923/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{836691DC-3406-4673-A10A-5FF258F056C7}: Domain = sympatico.ca
O17 - HKLM\System\CCS\Services\Tcpip\..\{C36BF24F-73E9-4A92-BDF3-131AF7C39A36}: Domain = sympatico.ca
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
Post #6
You can remove any programs I had you install. Use Add/Remove Programs to remove if listed there otherwise just delete them and empty recycle bin.

Log looks good :D


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.



If you dont have any programs like these, I would recommend that you get them.
Spywareblaster,
Spywareguard.


Also get a FREE FIREWALL and FREE ANTI VIRUS if you need one.

Only run one Anti-Virus and Firewall program.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Do not use Ad-aware if you have McAfee's VirusScan and AntiSpyware


Safe Surfing. :D

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein
Post #7
That is awesome.. and quick!! I noticed that her computer is now running much faster and when surfing the net the ads or redirections are not happening anymore. She will love you!!! Thank you very much :thumbup:
Post #9
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI