What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] hello again, i think i'm infected with something

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
i have a dumb question…… I was talking to Paws over in software, and she asked if I had Acronis…and I said no, I didn't see it when I went into control panel, add/remove programs….I didn't see anything that said Acronis…but I see in the Hijack this log there are items that say Acronis….. Paws wants to teach me to do something with Acronis…so do I have this program and how do I access it???
Post #32
P.S. should I pat myself on the back???????? Abydos came over and said hi and says I am way too hard on myself….. did i remember correctly? I seem to remember I should hit word wrap and that is what I did before I copied the logs…was that the right thing to do?
Post #33
compudodo,

Sure. Pat yourself on the back. You're doing great.

According to this entry:
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
you have Acronis installed and running. When we get done here, Paws(or one of the other Techs) will help you learn how to use it.

That isn't a complete ComboFix log. I'm going to need you to find a file for me.

Please:
  • Right click on START on the left end of your Windows toolbar (lower left corner of your screen)
  • Click on Explore
  • Click on Local Disk (C:) in the left-hand window pane
  • Look for ComboFix.txt in the right-hand window pane and right click on it
  • Put your cursor (arrow) on Open With
  • Move your cursor to the new menu that opens and click on Choose Program…
  • Click on Notepad

When file opens, Copy/Paste text here

If there are two .txt files there, please post both of them here.
Post #34
ComboFix 09-02-02.04 - User 2009-02-02 19:36:48.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.544 [GMT -5:00]
Running from: c:\documents and settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-01-03 to 2009-02-03 )))))))))))))))))))))))))))))))
.

2009-01-29 19:30 . 2009-01-29 20:16 d——– c:\documents and settings\User\Application Data\mjusbsp
2009-01-29 19:29 . 2008-04-13 14:45 60,032 –a—— c:\windows\system32\drivers\USBAUDIO.sys
2009-01-29 19:29 . 2008-04-13 14:45 60,032 –a–c— c:\windows\system32\dllcache\usbaudio.sys
2009-01-29 19:28 . 2008-04-13 14:45 32,128 –a—— c:\windows\system32\drivers\usbccgp.sys
2009-01-29 19:28 . 2008-04-13 14:45 32,128 –a–c— c:\windows\system32\dllcache\usbccgp.sys
2009-01-28 02:00 . 2009-01-28 02:00 d——– c:\documents and settings\User\LocalLow
2009-01-28 02:00 . 2009-01-28 02:00 d——– c:\documents and settings\All Users\Application Data\TVU Networks
2009-01-15 02:15 . 2009-01-15 02:15 d——– C:\61df232c486c6796dd2d
2009-01-15 01:29 . 2009-01-15 01:29 0 –a—— c:\windows\nsreg.dat
2009-01-07 05:20 . 2009-01-07 05:20 d——– c:\program files\Microsoft Games
2009-01-07 05:16 . 2009-01-07 05:16 d——– c:\program files\Alawar
2009-01-06 00:44 . 2009-01-06 00:45 d——– c:\documents and settings\User\Application Data\ErrorFix

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-02 14:11 ——— d—–w c:\program files\Common
2009-01-27 22:16 325,128 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-01-27 22:16 107,272 —-a-w c:\windows\system32\drivers\avgtdix.sys
2009-01-27 22:16 ——— d—–w c:\documents and settings\All Users\Application Data\Avg8
2009-01-15 06:43 ——— d—–w c:\documents and settings\User\Application Data\Move Networks
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-06 10:22 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-17 14:43 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008101720081018\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2006-10-16 1164912]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2006-10-16 1941784]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2006-10-16 87584]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2008-02-13 2065648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-10-25 136600]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-27 1601304]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"VTTimer"="VTTimer.exe" [2006-09-21 c:\windows\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [2006-10-09 c:\windows\system32\S3Trayp.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2008-01-08 114688]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-20 65588]
Microsoft Works Calendar Reminders.lnk - c:\windows\Installer\{0CD3BB5C-BBCA-11D2-8C20-00C04FBBCFF9}\A94AAB13.exe [2008-01-08 30720]
Watch.lnk - c:\program files\DV Series\Console\Watch.exe [2008-09-29 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-27 17:16 10520 c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-10-25 325128]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-10-25 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-10-25 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-10-25 298264]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2008-01-03 634880]
S3 BFAIFILT;BFAIFILT;c:\windows\system32\drivers\BFAIFILT.SYS [2008-01-12 3264]
S3 U2KG54;BUFFALO WLI-U2-KG54 Wireless LAN Adapter Service;c:\windows\system32\drivers\U2KG54.SYS [2008-01-12 245376]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd03ae00-ee64-11dd-b0c2-001d92410860}]
\Shell\AutoRun\command - E:\autorun.exe
\Shell\phone\command - E:\autorun.exe
.
.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\569f1s9h.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-02 19:39:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(792)
c:\windows\system32\relog_ap.dll
.
———————— Other Running Processes ————————
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\snmp.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-02-02 19:41:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-03 00:41:25
ComboFix2.txt 2008-10-26 01:59:30

Pre-Run: 70,652,272,640 bytes free
Post-Run: 70,789,476,352 bytes free

Current=2 Default=2 Failed=4 LastKnownGood=1 Sets=1,2,3,4
122 — E O F — 2009-01-15 19:12:11



oops, i did that wrong….
try again:


ComboFix 09-02-02.04 - User 2009-02-02 19:36:48.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.544 [GMT -5:00]
Running from: c:\documents and settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-01-03 to 2009-02-03 )))))))))))))))))))))))))))))))
.

2009-01-29 19:30 . 2009-01-29 20:16 d——– c:\documents and settings\User\Application Data\mjusbsp
2009-01-29 19:29 . 2008-04-13 14:45 60,032 –a—— c:\windows\system32\drivers\USBAUDIO.sys
2009-01-29 19:29 . 2008-04-13 14:45 60,032 –a–c— c:\windows\system32\dllcache\usbaudio.sys
2009-01-29 19:28 . 2008-04-13 14:45 32,128 –a—— c:\windows\system32\drivers\usbccgp.sys
2009-01-29 19:28 . 2008-04-13 14:45 32,128 –a–c— c:\windows\system32\dllcache\usbccgp.sys
2009-01-28 02:00 . 2009-01-28 02:00 d——– c:\documents and settings\User\LocalLow
2009-01-28 02:00 . 2009-01-28 02:00 d——– c:\documents and settings\All Users\Application Data\TVU Networks
2009-01-15 02:15 . 2009-01-15 02:15 d——– C:\61df232c486c6796dd2d
2009-01-15 01:29 . 2009-01-15 01:29 0 –a—— c:\windows\nsreg.dat
2009-01-07 05:20 . 2009-01-07 05:20 d——– c:\program files\Microsoft Games
2009-01-07 05:16 . 2009-01-07 05:16 d——– c:\program files\Alawar
2009-01-06 00:44 . 2009-01-06 00:45 d——– c:\documents and settings\User\Application Data\ErrorFix

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-02 14:11 ——— d—–w c:\program files\Common
2009-01-27 22:16 325,128 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-01-27 22:16 107,272 —-a-w c:\windows\system32\drivers\avgtdix.sys
2009-01-27 22:16 ——— d—–w c:\documents and settings\All Users\Application Data\Avg8
2009-01-15 06:43 ——— d—–w c:\documents and settings\User\Application Data\Move Networks
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-06 10:22 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-17 14:43 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008101720081018\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2006-10-16 1164912]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2006-10-16 1941784]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2006-10-16 87584]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2008-02-13 2065648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-10-25 136600]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-27 1601304]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"VTTimer"="VTTimer.exe" [2006-09-21 c:\windows\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [2006-10-09 c:\windows\system32\S3Trayp.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2008-01-08 114688]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-20 65588]
Microsoft Works Calendar Reminders.lnk - c:\windows\Installer\{0CD3BB5C-BBCA-11D2-8C20-00C04FBBCFF9}\A94AAB13.exe [2008-01-08 30720]
Watch.lnk - c:\program files\DV Series\Console\Watch.exe [2008-09-29 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-27 17:16 10520 c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-10-25 325128]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-10-25 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-10-25 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-10-25 298264]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2008-01-03 634880]
S3 BFAIFILT;BFAIFILT;c:\windows\system32\drivers\BFAIFILT.SYS [2008-01-12 3264]
S3 U2KG54;BUFFALO WLI-U2-KG54 Wireless LAN Adapter Service;c:\windows\system32\drivers\U2KG54.SYS [2008-01-12 245376]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd03ae00-ee64-11dd-b0c2-001d92410860}]
\Shell\AutoRun\command - E:\autorun.exe
\Shell\phone\command - E:\autorun.exe
.
.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\569f1s9h.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-02 19:39:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(792)
c:\windows\system32\relog_ap.dll
.
———————— Other Running Processes ————————
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\snmp.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-02-02 19:41:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-03 00:41:25
ComboFix2.txt 2008-10-26 01:59:30

Pre-Run: 70,652,272,640 bytes free
Post-Run: 70,789,476,352 bytes free

Current=2 Default=2 Failed=4 LastKnownGood=1 Sets=1,2,3,4
122 — E O F — 2009-01-15 19:12:11


oh….maybe not, looks the same

is this what you needed?????
Post #35
Am I going to need that Trend Micro Hijack this Scan Table with the 01, 03, 04 items? Also, should I allow that spybot change of registry item that popped up after the combo fix scan???
Post #36
compudodo, You did great. Allow the registry change. It was caused by Combofix so it's a good thing. :) Give me a minute (maybe 5 minutes) to get through the logs and we will get you finished up. :yeah:
Post #37
Candice,

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Please re-enable any security that was disabled.

Let me know that the uninstall went OK and if you have any quesions.
Post #38
GOT THE SAME ERROR MESSAGE…..AND ANOTHER TROJAN BACK DOOR. honestly…..I know I got the error message because I had all my security back on……. but I got another notice that the trojan back door small was back….. i hit heal, but don't know if it worked. should i turn off all my security, go and uninstall the combo fix now?
Post #39
compudodo, Did it say what the name of the file it found was? It is possible it is either targeting ComboFix, or one of the files that ComboFix removed. If it is either of these, you will stop getting the error when ComboFix is removed. The only thing you need to disable is the AVG Resident Shield. Use the same commands you did before. Don't worry about any of your other security programs. Then try to uninstall again. If it doesn't work, let me know, I have a different way to do it if need be. :P
Post #40
ok….went back and did the resident shield thing…… combo fix is now uninstalled…..i'm running a spy bot check first and then I'm going to run an AVG scan….I turned the resident shield back on. Why am I so susceptible to this trojan popping up every day now????
Post #41
compudodo, Next time the warning pops up, try to give me as much information as possible. I haven't had AVG in awhile but I believe when a scan is done, you have an option that says something like "Save Report". If you could copy/paste that here, it might tell me where it's coming from.
Post #42
oh…it was somehow linked into the combofix? i don't get it…and who is this oldman who keeps spying on what is going on here? Is he your supervisor, cause if he is, I want him to know how wonderful you have been to me these past three months now….and I TRIED my darnedest to give you guys some kind of compensation back in December, but no one would take anything….. and all they wanted was for me to write a testimonial….so whatever…… do you think I am going to be safe now? Why did I get the Trojan in the first place if I have all this stuff you helped me download???
Post #43
well, i'm; going to do the AVG scan right now…there were all kinds of tracking cookies attached to my Mozilla FireFox….so I just dis-installed it…..don't know why I did that, my boss uses Mozilla for our UPS and FED EX accounts, so i did the same thing here at home, sometimes I can get work done here…..I don't need Mozilla…I'm doing the AVG scan now….I'll look for that save report thingy
Post #45
compudodo,

Oldman960 is a very nice helper here who is just interested in whats been happening to you. As you've noticed, there are several of us who help out here. Sometimes all of us miss things or run into something we haven't seen before. The malware forums are set up so that only one of us will respond to you (usually), but often several of us review the logs. We communicate in the background so that you don't have to interpret a bunch of giberish while we decide how you will best be served. He's not my supervisor but he has helped provide a "second set of eyes" to hopefully keep me from missing something.

I don't know where you picked up that downloader. I know you know better than to open attachments in email that you don't recognize. Were you maybe applying for alot of jobs online? Maybe you got directed to some advertisement that supposedly would help you find out who was hiring?

If the icon is still there, then let's do this:

  • Make sure you have an Internet Connection.
  • Download OTCleanIt to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Then let me know if the ComboFix icon is gone, and also if your clock settings are correct.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI