winbluesoft is attacking me.

View previous topic View next topic Go down

winbluesoft is attacking me.

Post by longlast4 on 2nd June 2009, 11:19 pm

Winbluesoft is attacking me. I downloaded hijack this. I turned on the scan, but the notepad will not open. Please help with the winbluesoft removal.

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Belahzur on 3rd June 2009, 12:14 am

Can you try opening it in Wordpad instead of Notepad?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 3rd June 2009, 12:36 am

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:01:04 PM, on 6/2/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Documents and Settings\user\Desktop\fdg.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WinInet Class - {39fc2065-c9c7-49cd-8942-44cc2dedc844} - C:\WINDOWS\ieocx.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O3 - Toolbar: Fast Browser Search - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [FBSearch] C:\Program Files\Fast Browser SearchP\FastBrowserSearchProtection.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Blubster] C:\Program Files\Blubster\Blubster.exe SILENT
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinBlueSoft] C:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe -min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [tempo-setup2.exe] C:\WINDOWS\system32\tempo-setup2.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [tempo-setup2.exe] C:\WINDOWS\system32\tempo-setup2.exe (User 'Default user')
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\user\Application Data\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - [You must be registered and logged in to see this link.]
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - [You must be registered and logged in to see this link.]
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{A047A98F-AE3E-46A0-BE09-060C6A5D6A4A}: NameServer = 85.255.112.149,85.255.112.214
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.149,85.255.112.214
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.149,85.255.112.214
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.149,85.255.112.214
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.149,85.255.112.214
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: blocker.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 10327 bytes

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 3rd June 2009, 12:36 am

sorry for no text. please help now.

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 3rd June 2009, 12:49 am

i have even tried the century spy on free trial. winbluesoft is taking my mouse and moving it every ten minutes or so.

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 3rd June 2009, 1:05 am

i

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Origin on 3rd June 2009, 2:33 am


  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: WinInet Class - {39fc2065-c9c7-49cd-8942-44cc2dedc844} - C:\WINDOWS\ieocx.dll (file missing)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [WinBlueSoft] C:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe -min
    O4 - HKUS\S-1-5-18\..\Run: [tempo-setup2.exe] C:\WINDOWS\system32\tempo-setup2.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [tempo-setup2.exe] C:\WINDOWS\system32\tempo-setup2.exe (User 'Default user')
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A047A98F-AE3E-46A0-BE09-060C6A5D6A4A}: NameServer = 85.255.112.149,85.255.112.214
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.149,85.255.112.214
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.149,85.255.112.214
    O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.149,85.255.112.214
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.149,85.255.112.214



  • Press "Fix Checked"
  • Close Hijack This.





1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.
See [You must be registered and logged in to see this link.] for how to disable your AV..

  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31523
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 3rd June 2009, 2:53 am

I tried it, but it did not work.

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 3rd June 2009, 2:55 am

here's the log again in case something changed.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:53:54 PM, on 6/2/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\user\Desktop\fdg.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\Fast Browser Search\IE\tbhelper.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O3 - Toolbar: Fast Browser Search - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [FBSearch] C:\Program Files\Fast Browser SearchP\FastBrowserSearchProtection.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\user\Application Data\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - [You must be registered and logged in to see this link.]
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - [You must be registered and logged in to see this link.]
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - [You must be registered and logged in to see this link.]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: blocker.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 8956 bytes

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Origin on 3rd June 2009, 2:58 am

Download Dr.Web CureIt to the desktop:
[You must be registered and logged in to see this link.]

  • Double-click the launch.exe or cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, just let it cure whatever it finds...
    o Now, go to Settings >> Change Settings
    o Go to Actions tab >> under Objects section, change the settings to below
    Infected objects - Cure
    Incurable objects - Report
    Suspicious objects - Report
    o Don't change any other settings
  • Start the scan again. This time, choose Complete Scan
  • Click the green arrow button at the right, and the scan will start.
  • After the scan finished, click Select all
  • Click on Cure and choose Report incurable (means take no actions.. Don't "move", or "rename" or "delete")
  • When the scan has finished, in the menu, click File and choose Save report list
  • Save the report to your Desktop. The report will be called DrWeb.csv
  • Post DrWeb.csv in your next reply (Open it as Notepad).. Do NOT reboot the computer yet..


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31523
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 3rd June 2009, 10:57 pm

does reboot means turn off the computer. or some other thing. If it is not turning off the computer please tell me how to reboot my computer

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 3rd June 2009, 11:01 pm

the computer keeps logging of in 5 minutes.

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 3rd June 2009, 11:11 pm

i downloaded the Dr.Web CureIt, but it doesn't open at all.

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Belahzur on 4th June 2009, 12:38 am

Hello.

We've only just figured out a way of beating this today so forget Dr.web for now.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Delete a file on reboot..."
  • Then find and select this file: C:\windows\system32\blocker.dll
  • Select okay and select yes to reboot.

Once that file is gone, follow origins instructions and run Combofix, it will work this time.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 4th June 2009, 10:23 pm

i don't know what happened but when i turned on the computer it, the winbluesoft was not their.

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Belahzur on 4th June 2009, 10:29 pm

Because the blocker file is gone, try running Combofix now.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 6th June 2009, 8:48 pm

ComboFix 09-06-05.09 - user 06/06/2009 13:32.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.383.137 [GMT -7:00]
Running from: c:\documents and settings\user\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\documents and settings\LocalService\Application Data\ShoppingReport
c:\documents and settings\LocalService\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\LocalService\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\LocalService\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\LocalService\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\LocalService\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
c:\documents and settings\user\Application Data\ShoppingReport
c:\documents and settings\user\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\user\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\user\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\user\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\user\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\user\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\user\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
c:\documents and settings\user\My Documents\My Documents.url
c:\program files\ShoppingReport
c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
c:\program files\ShoppingReport\Uninst.exe
c:\windows\10209ddwarez545.ocx
c:\windows\1045895zmbot4ac.dll
c:\windows\105315zambo923e.exe
c:\windows\1069zspy65e.exe
c:\windows\1076not-9-z5rus2f3.cpl
c:\windows\10915wz9m54.cpl
c:\windows\11250tz9j7665.exe
c:\windows\11795wzr94dd.dll
c:\windows\11855ddware396z.ocx
c:\windows\1196sp5z9f.bin
c:\windows\1196znot-a-5irus5ea.dll
c:\windows\119z5hief2636.exe
c:\windows\1205zt5al26419.exe
c:\windows\12138spa9bot5az.dll
c:\windows\12672v9ruz455.ocx
c:\windows\12792s59132z.bin
c:\windows\13006spa5bzt918.exe
c:\windows\14019s5yz93.ocx
c:\windows\14189hz5f1299.dll
c:\windows\1436worz45e9.cpl
c:\windows\14629tzo5f9.ocx
c:\windows\15419hreatz8329.exe
c:\windows\15522spazbo950a.bin
c:\windows\155275i9us25z.exe
c:\windows\15735spy3z9.bin
c:\windows\1595thiefz9459.bin
c:\windows\15e5s9eal2z96.cpl
c:\windows\160z8spamb5t43c9.dll
c:\windows\16192spamb5t74cz.bin
c:\windows\1655459cktool390z.cpl
c:\windows\16d2s59wzre2018.dll
c:\windows\17057z9cktoo51bb.bin
c:\windows\174675zy199.bin
c:\windows\1795adzware1656.exe
c:\windows\179z8hacktool675.ocx
c:\windows\17a9viz1035.bin
c:\windows\1822znot59-virusf9.bin
c:\windows\18558zorm7cf9.bin
c:\windows\1898backd5o9z891.exe
c:\windows\189d5irz255.ocx
c:\windows\19543not-a9vz5us7fa.exe
c:\windows\19665zirus37b.dll
c:\windows\1999z5ot-a-9irus6fe.ocx
c:\windows\19des5zrse1889.dll
c:\windows\1a1zv5r22829.dll
c:\windows\1a95addwaze118.exe
c:\windows\1b54spyware295z.dll
c:\windows\1b95bazkd5or1854.ocx
c:\windows\1cez9i589.ocx
c:\windows\1cz5sparse9256.bin
c:\windows\1d33spz5se927.bin
c:\windows\1dz5v9r1851.exe
c:\windows\1ez5parse579.exe
c:\windows\1ez99parse9315.dll
c:\windows\1f35dzware2922.bin
c:\windows\1z1829pambo5501.dll
c:\windows\1z361w9rm55c.cpl
c:\windows\1z9525pambot73a9.dll
c:\windows\1z961hacktool55d.bin
c:\windows\1ze1thr59t19136.bin
c:\windows\201429p5zcb.bin
c:\windows\2026znot-9-5irus56f.dll
c:\windows\204c9zyware1555.ocx
c:\windows\2058virus49z.bin
c:\windows\20903n5t-z-virus5f7.cpl
c:\windows\20949py5z5.exe
c:\windows\209825ozm576.exe
c:\windows\20z16sp5594.exe
c:\windows\21324wo5mzb59.bin
c:\windows\2205a5dza9e3165.bin
c:\windows\222z95py551.dll
c:\windows\22392spzmbot9c5.exe
c:\windows\23003ha5ktzol79a.exe
c:\windows\23156not-5-viruszf9.dll
c:\windows\2329zspa5bot269.exe
c:\windows\2365zw9rm1db.bin
c:\windows\23891not-9zvirus559.cpl
c:\windows\24158t5oj269z.ocx
c:\windows\25059zp543f.dll
c:\windows\251175acktozl7e9.bin
c:\windows\25242spam9ot71z.ocx
c:\windows\252945py2z2.exe
c:\windows\252z8tro92375.exe
c:\windows\25391nzt-a-viru566d9.ocx
c:\windows\25589spamboz4f8.exe
c:\windows\25590t5oj111z.cpl
c:\windows\2591sparze15909.bin
c:\windows\26940w5zm50b.exe
c:\windows\27150tr9j85z.exe
c:\windows\2778zhacktool5ce9.exe
c:\windows\27z14wo95694.dll
c:\windows\28252ha5ztool609.bin
c:\windows\288z0no9-5-virus2ce.bin
c:\windows\29085haczto9l1ae.bin
c:\windows\29359worm75z.bin
c:\windows\295eszyware779.exe
c:\windows\2965zpy5are1253.dll
c:\windows\29705hreatz8697.dll
c:\windows\2998spzrse556.dll
c:\windows\29cfdownloaderz599.exe
c:\windows\2bbaszyware18569.bin
c:\windows\2cf9hizf1582.cpl
c:\windows\2cz5steal9583.cpl
c:\windows\2d95zparse2139.exe
c:\windows\2dfcdow5l9ader1555z.bin
c:\windows\2z257spambo94ae.cpl
c:\windows\2z322not-a-vir9s7e5.exe
c:\windows\2z5f9ir3196.cpl
c:\windows\30235szy49c9.ocx
c:\windows\30323wo9564z.bin
c:\windows\30644h5ck9ooz391.bin
c:\windows\3085bzckdoor3199.bin
c:\windows\31299haczt5ol309.dll
c:\windows\3144not-a-5izus98.exe
c:\windows\3145zi92518.exe
c:\windows\31527zacktool95.cpl
c:\windows\31555not-azvirus598.ocx
c:\windows\315z6worm592.dll
c:\windows\316959dwzre1545.ocx
c:\windows\316d9ackdozr5881.cpl
c:\windows\316znot-a-v59us370.bin
c:\windows\31910not-a5vzrus941.bin
c:\windows\31945tezl927.cpl
c:\windows\32159tzoj4de.exe
c:\windows\334stezl9935.dll
c:\windows\3499vi52153z.dll
c:\windows\352asteal1579z.dll
c:\windows\3578sz9456.ocx
c:\windows\3615vir9sz56.dll
c:\windows\3619troj595z.dll
c:\windows\36dba5k9ooz2002.dll
c:\windows\372zspars527859.dll
c:\windows\374zvir16595.exe
c:\windows\37f9sp5rsz2119.cpl
c:\windows\3894sparse9z965.exe
c:\windows\3895backdoor2z075.bin
c:\windows\38z8bac9door3755.dll
c:\windows\3926add59re4z3.exe
c:\windows\39a55parse91z7.ocx
c:\windows\39z19spy45e.ocx
c:\windows\39z88spam5ot626.exe
c:\windows\3a5ddzwnloade9854.bin
c:\windows\3a65stea9z01.cpl
c:\windows\3az1spywa9e3205.cpl
c:\windows\3b0fspa9se1z53.cpl
c:\windows\3d41thief9z125.exe
c:\windows\3d9abac9dzor30765.dll
c:\windows\3ecc5i9z553.bin
c:\windows\3z7cb5ckdoor23169.ocx
c:\windows\3z99backdoor575.exe
c:\windows\3ze6ste5l2908.exe
c:\windows\4054zackdo5r25079.dll
c:\windows\40945irz959.bin
c:\windows\409zhacktool15e.bin
c:\windows\4204thr9at5421z.cpl
c:\windows\429zsteal795.dll
c:\windows\42zado9nlo5der254.cpl
c:\windows\44z79orm4345.bin
c:\windows\4524hz9ktool45e.bin
c:\windows\454evi9125z.bin
c:\windows\458z9ackdoor3064.bin
c:\windows\478zspa5s92575.exe
c:\windows\495szambot595.exe
c:\windows\4972virzs525.exe
c:\windows\4994sp5ware25z0.ocx
c:\windows\49z5py78f9.exe
c:\windows\4a56zpy9a5e2899.dll
c:\windows\4b47down9oad5z540.ocx
c:\windows\4c22downlozder2359.bin
c:\windows\4c985tezl3194.bin
c:\windows\4d1fspz5are2519.ocx
c:\windows\4e8zad9ware2445.ocx
c:\windows\4z35vir9s7f0.bin
c:\windows\4z53spyw5re219.exe
c:\windows\50968w9rm75z.exe
c:\windows\509fthr5at2z340.dll
c:\windows\50b9threat14713z.exe
c:\windows\5226zhack9ool534.exe
c:\windows\52398hacktz9l358.ocx
c:\windows\5257sparsez1909.bin
c:\windows\5259threa5z9669.bin
c:\windows\52899troj5zd.dll
c:\windows\5295hreatz6418.dll
c:\windows\5305vzrus5069.exe
c:\windows\5345thiez2992.dll
c:\windows\536z6spy7b19.ocx
c:\windows\539v9r1501z.exe
c:\windows\53edzteal7795.bin
c:\windows\547bzc9door543.ocx
c:\windows\54b9addwarz5287.bin
c:\windows\54fbt5zeat9551.cpl
c:\windows\55335spambo97z9.exe
c:\windows\554zthie59082.cpl
c:\windows\555z9teal532.cpl
c:\windows\55b9thief2566z.ocx
c:\windows\55fd9hizf45.dll
c:\windows\55z2spam5ot9a.cpl
c:\windows\55zot-a-v5r9s234.ocx
c:\windows\56619ackdoo5z008.ocx
c:\windows\567395eal24z6.cpl
c:\windows\56czthreat157269.bin
c:\windows\56ezs9yware16335.bin
c:\windows\5725wzrm9e2.exe
c:\windows\5751sp5mbzt593.dll
c:\windows\575zdd9are272.dll
c:\windows\5792spyzare519.bin
c:\windows\57z69orm4ea5.exe
c:\windows\58362n9t-a-vzrus479.cpl
c:\windows\5842zhie512559.dll
c:\windows\58971wozmd2.bin
c:\windows\58z2th9ef5994.cpl
c:\windows\58z3stea52941.dll
c:\windows\5904wor97z2.ocx
c:\windows\590cs9ez5619.ocx
c:\windows\5948w5rm4z.cpl
c:\windows\5959zorm4755.dll
c:\windows\5963spywz9e598.dll
c:\windows\59646virusz9.bin
c:\windows\59czth5eat279.dll
c:\windows\59f1sparsez591.bin
c:\windows\59fetzie51910.ocx
c:\windows\59fzba5kdoor3939.bin
c:\windows\5a22spyw9re274z.ocx
c:\windows\5b3bth95zt17688.cpl
c:\windows\5b68dowz5oade91317.ocx
c:\windows\5b8fvzr2959.bin
c:\windows\5b9owzloader5536.bin
c:\windows\5bfdt5izf29229.ocx
c:\windows\5c79szeal555.cpl
c:\windows\5c97vi5795z.bin
c:\windows\5ce4spa9se22z0.ocx
c:\windows\5d16ad5wz9e977.cpl
c:\windows\5e9esteal5z09.dll
c:\windows\5eedsteaz9935.bin
c:\windows\5ezdsp9ware2653.exe
c:\windows\5f25downlozder1899.ocx
c:\windows\5fb6zown9oader3579.cpl
c:\windows\5z9worm290.bin
c:\windows\60f49pywarz21075.cpl
c:\windows\6399woz9553.cpl
c:\windows\651spy99z.exe
c:\windows\65b29parsez322.cpl
c:\windows\669cstea59z68.ocx
c:\windows\6755viz15999.bin
c:\windows\6883addwaze35339.exe
c:\windows\688eazdwa5e944.cpl
c:\windows\6909zpy5are900.ocx
c:\windows\6920spywarz512.bin
c:\windows\6966backdzor5944.cpl
c:\windows\697dz5eal3900.bin
c:\windows\6c0dzhi952883.ocx
c:\windows\6e8ftzreat52595.cpl
c:\windows\6f5zteal28955.ocx
c:\windows\73f3downl5aderz92.cpl
c:\windows\73fa95czdoor349.dll
c:\windows\74345ackdooz9206.ocx
c:\windows\7549viru5z5a.exe
c:\windows\7559zdw5re3266.bin
c:\windows\75aedo9nzoade53022.bin
c:\windows\75f65ddza9e212.bin
c:\windows\7629szarse5171.exe
c:\windows\7696back9ozr3095.dll
c:\windows\7717dowzloa9er10995.exe
c:\windows\7883not-a-v9r5z3c8.dll
c:\windows\7895thizf9489.ocx
c:\windows\797azdware5247.cpl
c:\windows\797zworm5b99.dll
c:\windows\7993szeal13915.ocx
c:\windows\7993z5ief3216.dll
c:\windows\7a5cthiez9265.dll
c:\windows\7e5czir9255.bin
c:\windows\7z95thief628.ocx
c:\windows\86759zcktoo55ea.cpl
c:\windows\8d1zow5lo9der3183.cpl
c:\windows\901z5acktool545.cpl
c:\windows\90274not-a-vi5zs539.ocx
c:\windows\925t9oz5f1.bin
c:\windows\9280t5oj51az.exe
c:\windows\92z25virus5f2.ocx
c:\windows\93421hacktool544z.exe
c:\windows\93750n5t-a-vzrus79.exe
c:\windows\94316sp5zbot676.bin
c:\windows\94359pa5bzt4c4.exe
c:\windows\944zthief29485.exe
c:\windows\9464v9zu5723.dll
c:\windows\94741spy9z5.exe
c:\windows\94929zirus4ea5.bin
c:\windows\9530zot-a5virusc7.cpl
c:\windows\9555worz576.dll
c:\windows\9561sparsez596.cpl
c:\windows\9583spazse2534.cpl
c:\windows\9592spyza95.exe
c:\windows\95aas5arse19z3.exe
c:\windows\96556worz2d6.dll
c:\windows\969bstzal1125.exe
c:\windows\969zworm7d35.ocx
c:\windows\96cvzr9259.dll
c:\windows\97769orz650.cpl
c:\windows\97dthief25z2.cpl
c:\windows\9818ztroj52e.exe
c:\windows\9833thr5atz4381.dll
c:\windows\9845zpyc9.exe
c:\windows\9869tr9z5e8.ocx
c:\windows\98955pz439.cpl
c:\windows\98z2vir19195.ocx
c:\windows\99094not-a-viruzbb5.ocx
c:\windows\997z3viru5620.ocx
c:\windows\9a5addwar9555z.cpl
c:\windows\9a7zst5al19.ocx
c:\windows\9c65vir2890z.cpl
c:\windows\9d5v9r266z.cpl
c:\windows\9ez5addware420.exe
c:\windows\9z06viru59c.bin
c:\windows\9z12hac5tool25e9.bin
c:\windows\a9f9hie5133z.cpl
c:\windows\bdaa95zare2573.dll
c:\windows\c5ad9wnlzader2852.cpl
c:\windows\c5z9teal36.exe
c:\windows\d57d9wnloade5260z.dll
c:\windows\e5ezackdoo52099.ocx
c:\windows\system32\10154virusz98.cpl
c:\windows\system32\10195not9a-virz5329.exe
c:\windows\system32\10465sp95z.exe
c:\windows\system32\1046zpy955.bin
c:\windows\system32\10fcbackzoor32695.bin
c:\windows\system32\111zbac5door2389.dll
c:\windows\system32\1149thie5z03.exe
c:\windows\system32\11528wor579bz.dll
c:\windows\system32\1177ad5wzre859.exe
c:\windows\system32\11b3th5zat56759.ocx
c:\windows\system32\120349iruz465.ocx
c:\windows\system32\12489noz-a5virus302.dll
c:\windows\system32\12515hac5tzo9156.bin
c:\windows\system32\12686tzo957.ocx
c:\windows\system32\129bad9wa5e25z.ocx
c:\windows\system32\12bfsparse5z99.exe
c:\windows\system32\14146hacztoo956f.cpl
c:\windows\system32\14582hack9oolz815.cpl
c:\windows\system32\146z3hac9to5l2c.dll
c:\windows\system32\1487ha9ktoolz55.bin
c:\windows\system32\14c8spyw9rez955.cpl
c:\windows\system32\154155ir9s128z.cpl
c:\windows\system32\15499spy54z.cpl
c:\windows\system32\159ezpyware2215.cpl
c:\windows\system32\15z9vir5497.cpl
c:\windows\system32\16400not-9-vzr5s702.bin
c:\windows\system32\16445r9z5ec.dll
c:\windows\system32\16b7b9ckdo5z664.ocx
c:\windows\system32\16eet5iez9205.bin
c:\windows\system32\16f9t5reatz691.ocx
c:\windows\system32\17232wor9z5.dll
c:\windows\system32\1755thi5z9695.cpl
c:\windows\system32\17778wo5m69z.ocx
c:\windows\system32\17880hac5toolz93.ocx
c:\windows\system32\179zsteal596.dll
c:\windows\system32\1855steal19z3.ocx
c:\windows\system32\1858thi5f9z58.cpl
c:\windows\system32\18976spy5zc.ocx
c:\windows\system32\18d859czdoor2985.exe
c:\windows\system32\19225noz-a5virus194.exe
c:\windows\system32\192fstezl2165.ocx
c:\windows\system32\192z35orm498.exe
c:\windows\system32\19304n9z-a-virus265.bin
c:\windows\system32\19690zot-a-95rus73a.cpl
c:\windows\system32\19784w5rm46z.bin
c:\windows\system32\19855v5rus5abz.ocx
c:\windows\system32\19858not-a-vi9us2za.bin
c:\windows\system32\199z9not-a-virus15.cpl
c:\windows\system32\1b65b9ckdoorz042.cpl
c:\windows\system32\1c25sza9se1358.bin
c:\windows\system32\1c345hzef998.ocx
c:\windows\system32\1c7et5izf1961.bin
c:\windows\system32\1caaddwa5e911z.exe
c:\windows\system32\1z000s5y309.exe
c:\windows\system32\1z4119i5us95.ocx
c:\windows\system32\1z531viru95de.exe
c:\windows\system32\1z576v95us735.dll
c:\windows\system32\1z628hacktoo5790.ocx
c:\windows\system32\20385troj950z.exe
c:\windows\system32\2052t9iefz39.exe
c:\windows\system32\20656hac9tool189z.ocx
c:\windows\system32\2075z5pambot55b9.dll
c:\windows\system32\2131259zj4e6.bin
c:\windows\system32\21945iz5399.cpl
c:\windows\system32\220249ackzool259.dll
c:\windows\system32\22123w9zm45f.exe
c:\windows\system32\2255th5zat20798.exe
c:\windows\system32\2256download9r38z.ocx

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 6th June 2009, 8:49 pm

c:\windows\system32\229z7viru5924.cpl
c:\windows\system32\22z7add9are165.ocx
c:\windows\system32\233635acktooz929.cpl
c:\windows\system32\234cbaczdoor5928.bin
c:\windows\system32\2429v5r2521z.bin
c:\windows\system32\246z0not-a-5irus529.cpl
c:\windows\system32\2475zworm394.cpl
c:\windows\system32\24795wormz15.ocx
c:\windows\system32\2492zno9-a5virus600.bin
c:\windows\system32\24955troj155z.ocx
c:\windows\system32\2536szar9e452.bin
c:\windows\system32\25488not-z-viru95ff.dll
c:\windows\system32\25529v9rus487z.exe
c:\windows\system32\25547spy17z9.dll
c:\windows\system32\256785o9-a-zirus12.exe
c:\windows\system32\25775hack5zo91d7.dll
c:\windows\system32\25825h9cztool8b.ocx
c:\windows\system32\25918not-a-vzrus599.cpl
c:\windows\system32\25z959cktool534.bin
c:\windows\system32\2609859cktozl7ef.bin
c:\windows\system32\260z35r9j66e.cpl
c:\windows\system32\265959ac5tozl5e.dll
c:\windows\system32\26886s9amzot5f5.cpl
c:\windows\system32\27456t5oj199z.dll
c:\windows\system32\27549sp57z99.exe
c:\windows\system32\2795zsp5mbot7f9.dll
c:\windows\system32\279615rojz4.ocx
c:\windows\system32\280a5ownz9ader2259.ocx
c:\windows\system32\284z5viru91d5.dll
c:\windows\system32\28634hackzool2509.ocx
c:\windows\system32\28658noz-a-9irus45b.ocx
c:\windows\system32\288dzteal5495.cpl
c:\windows\system32\2897t59zat22951.exe
c:\windows\system32\2899azdwar5951.exe
c:\windows\system32\28z21wo9m5a15.exe
c:\windows\system32\29150s9ambot6z2.exe
c:\windows\system32\29152not-a-5iru94z.cpl
c:\windows\system32\29626vi9uz1a5.cpl
c:\windows\system32\298249pz4365.dll
c:\windows\system32\29925szy23c9.dll
c:\windows\system32\299695pyz3e.cpl
c:\windows\system32\29a99h5ez3101.dll
c:\windows\system32\2azddownl9ader5405.ocx
c:\windows\system32\2b41stz5l1799.dll
c:\windows\system32\2c84back59or1760z.dll
c:\windows\system32\2e79zhreat19521.ocx
c:\windows\system32\2z150virus6b9.cpl
c:\windows\system32\2z1estea52991.exe
c:\windows\system32\2z61spy5are2924.bin
c:\windows\system32\2z754ha9ktool84.bin
c:\windows\system32\2z9635py1bf.bin
c:\windows\system32\30a5zparse9589.dll
c:\windows\system32\31502vzr9s55d.exe
c:\windows\system32\31744spambo95zb5.ocx
c:\windows\system32\317579ormz5c.exe
c:\windows\system32\31775ownloade9z.bin
c:\windows\system32\32fzbackd9or5378.cpl
c:\windows\system32\336z5i9us80.dll
c:\windows\system32\34995ir1962z.cpl
c:\windows\system32\3525sp9wzre324.bin
c:\windows\system32\355bzackdoor19259.dll
c:\windows\system32\3572downlo9der7z5.cpl
c:\windows\system32\35a45zief2229.cpl
c:\windows\system32\3691vi9u55zf.ocx
c:\windows\system32\36a29ir254z.ocx
c:\windows\system32\37395pamb9z4ca.cpl
c:\windows\system32\3834spars9z1075.exe
c:\windows\system32\3895add9aze31145.dll
c:\windows\system32\394fvzr3054.dll
c:\windows\system32\39a0downloadzr1051.ocx
c:\windows\system32\39c1vir1z359.cpl
c:\windows\system32\3bd59i533z.dll
c:\windows\system32\3ce6d9wzloa5er2382.exe
c:\windows\system32\3d04t5reat3z903.dll
c:\windows\system32\3ff3t9reat102z75.bin
c:\windows\system32\3z4939acktool57f.bin
c:\windows\system32\3z51steal3196.cpl
c:\windows\system32\408bbzckdoor19555.exe
c:\windows\system32\40estezl5892.exe
c:\windows\system32\4184zacktool5b95.exe
c:\windows\system32\422th9zat6357.exe
c:\windows\system32\43not-z5virus559.cpl
c:\windows\system32\442azpars92050.dll
c:\windows\system32\4478not-a95izus119.dll
c:\windows\system32\44d5vir496z.ocx
c:\windows\system32\4505spywaze1957.dll
c:\windows\system32\4535not-9zvir5s5de.ocx
c:\windows\system32\456spambz5349.cpl
c:\windows\system32\4615spy195z.exe
c:\windows\system32\4649addzare2517.bin
c:\windows\system32\476zs9ambo532.cpl
c:\windows\system32\47a5spz5se9126.ocx
c:\windows\system32\47b5ba5kdozr991.cpl
c:\windows\system32\47z55py29.ocx
c:\windows\system32\47z9vir2095.exe
c:\windows\system32\48dazackdoo5789.ocx
c:\windows\system32\48f7a9dzare5115.exe
c:\windows\system32\48f7th95at269z8.cpl
c:\windows\system32\4935threzt98734.cpl
c:\windows\system32\4942spa5se6z6.cpl
c:\windows\system32\4951tzi9f675.exe
c:\windows\system32\4c91spywa5e28z3.exe
c:\windows\system32\4ef79hze5t24132.dll
c:\windows\system32\4f5ethrz9t16909.cpl
c:\windows\system32\4z25add9are254.ocx
c:\windows\system32\50a2s5ar9e1z73.bin
c:\windows\system32\50z5v9r2513.bin
c:\windows\system32\51169worm34z.cpl
c:\windows\system32\51299troj729z.dll
c:\windows\system32\5183worm59z.cpl
c:\windows\system32\52409iz5s4e2.dll
c:\windows\system32\529espz5se32269.exe
c:\windows\system32\529zspywar928075.cpl
c:\windows\system32\5304troz9d0.exe
c:\windows\system32\533asparsz1196.ocx
c:\windows\system32\5394thiez13659.dll
c:\windows\system32\53c2th9zf1858.bin
c:\windows\system32\53e85ackdoo9z530.dll
c:\windows\system32\54259t9zj6c4.cpl
c:\windows\system32\5429spambot7z99.exe
c:\windows\system32\54922szambot383.dll
c:\windows\system32\553eaddwa9z2591.cpl
c:\windows\system32\55a0vzr7329.exe
c:\windows\system32\55b39ir200z.exe
c:\windows\system32\55d3th9eat2z610.cpl
c:\windows\system32\55ezthief6929.ocx
c:\windows\system32\55f5s9arsz1629.exe
c:\windows\system32\55fcaddw9rez003.exe
c:\windows\system32\55z20h9cktool7c.bin
c:\windows\system32\56089hizf1676.bin
c:\windows\system32\5620zv9rus299.cpl
c:\windows\system32\5629v5r2179z.dll
c:\windows\system32\564995iefz252.dll
c:\windows\system32\56zfs59rse2992.bin
c:\windows\system32\5715th9eat2876z.dll
c:\windows\system32\57799hacktool5za.cpl
c:\windows\system32\578z9ief1723.dll
c:\windows\system32\5795backdoorz716.exe
c:\windows\system32\58795hiez455.exe
c:\windows\system32\589zs5arse821.dll
c:\windows\system32\58z3threa57941.ocx
c:\windows\system32\5938steal3217z.cpl
c:\windows\system32\595aaddware185z.ocx
c:\windows\system32\596zv5rus52a9.bin
c:\windows\system32\5991spamboz2c9.bin
c:\windows\system32\5996thzef30115.ocx
c:\windows\system32\59azspar5e3163.dll
c:\windows\system32\59b4backdo9r256z.bin
c:\windows\system32\59zthief523.cpl
c:\windows\system32\5bbbthzea590299.dll
c:\windows\system32\5bc3t9reat2z557.exe
c:\windows\system32\5be49dzware1158.cpl
c:\windows\system32\5bfb9teal2152z.exe
c:\windows\system32\5c04thiez1993.cpl
c:\windows\system32\5c8zdownl95der984.dll
c:\windows\system32\5c9zaddwa5e2192.bin
c:\windows\system32\5cb05ddware9328z.bin
c:\windows\system32\5cz5spy9are1510.exe
c:\windows\system32\5d09ir195z.bin
c:\windows\system32\5dfspywzre9074.bin
c:\windows\system32\5ebadd9are95z.exe
c:\windows\system32\5eezspars926755.dll
c:\windows\system32\5f10adzware9759.cpl
c:\windows\system32\5f59down5z9der595.ocx
c:\windows\system32\5f5zack95or3252.dll
c:\windows\system32\5fb5spyzar91766.ocx
c:\windows\system32\5z06s95al1823.cpl
c:\windows\system32\5z56ad5ware9948.ocx
c:\windows\system32\5zc8spywa9e411.ocx
c:\windows\system32\5zd89ownloader1554.ocx
c:\windows\system32\6059thief59z.bin
c:\windows\system32\60dzth5ef9369.dll
c:\windows\system32\60fzsp5rse22959.cpl
c:\windows\system32\6150haczt9ol30.bin
c:\windows\system32\6159worm7z4.dll
c:\windows\system32\61779hr5at1z816.exe
c:\windows\system32\620fdownl9ader51z.cpl
c:\windows\system32\623f9tealz4835.cpl
c:\windows\system32\62b99hz5at7970.exe
c:\windows\system32\62f4spywaz92052.bin
c:\windows\system32\646as9arze5567.dll
c:\windows\system32\6479spywaze5250.exe
c:\windows\system32\6596z59us2a1.cpl
c:\windows\system32\6597zir1259.bin
c:\windows\system32\671fst5zl9279.exe
c:\windows\system32\6915spzmb5t5b6.cpl
c:\windows\system32\6957d9wnzoader2631.exe
c:\windows\system32\695zspambotb4.exe
c:\windows\system32\69b9sp5zare9065.cpl
c:\windows\system32\6bbbz95eat17180.dll
c:\windows\system32\6c3259ezl561.ocx
c:\windows\system32\6c615ackdo9r1z05.bin
c:\windows\system32\6cbfth5zat245359.exe
c:\windows\system32\6ce3backdoo9562z.dll
c:\windows\system32\6czd5ackdoor946.bin
c:\windows\system32\6e51dowzloa9er2115.bin
c:\windows\system32\6e77bacz9o5r2481.bin
c:\windows\system32\6f9dbac95oor13z0.bin
c:\windows\system32\6z915pyware654.ocx
c:\windows\system32\70305ot-a-v9rusz72.dll
c:\windows\system32\70z2add9are1595.bin
c:\windows\system32\738zste9l5893.dll
c:\windows\system32\7473z5y3e09.cpl
c:\windows\system32\75de9ownloade53100z.cpl
c:\windows\system32\75z55hief1509.cpl
c:\windows\system32\7639h9ck5ozl591.exe
c:\windows\system32\7652dow9lzader2785.bin
c:\windows\system32\7654zor9158.ocx
c:\windows\system32\76z2ad9wa5e960.cpl
c:\windows\system32\78z2s5ywa9e420.dll
c:\windows\system32\795czir262.ocx
c:\windows\system32\7994b5ckzoor1669.exe
c:\windows\system32\79afsp5ware9z10.dll
c:\windows\system32\7aa0backdoz9953.dll
c:\windows\system32\7be9downloadzr5715.bin
c:\windows\system32\7c8fzt9al1560.dll
c:\windows\system32\7c95sp9ware179z.cpl
c:\windows\system32\7ea95hr9at2z873.ocx
c:\windows\system32\7f6a5zi9f2130.cpl
c:\windows\system32\7z72downloa5er2947.cpl
c:\windows\system32\7z79s95al2174.bin
c:\windows\system32\7zcc5ownloader2696.cpl
c:\windows\system32\7zeaadd9are2145.dll
c:\windows\system32\892zspa5bot5b19.dll
c:\windows\system32\8946spyz305.dll
c:\windows\system32\8ddzownloade51499.cpl
c:\windows\system32\9016not-a-virz540e.cpl
c:\windows\system32\90684sp5mbotz41.ocx
c:\windows\system32\907755irus5z5.exe
c:\windows\system32\9104spazse3155.cpl
c:\windows\system32\9141spy5ze.cpl
c:\windows\system32\91735t5oj5z3.bin
c:\windows\system32\91805spy1e5z.dll
c:\windows\system32\9192zpy5b2.exe
c:\windows\system32\92105viruz35f.dll
c:\windows\system32\92292hacztool259.bin
c:\windows\system32\92517zr5j4da.bin
c:\windows\system32\9365zteal1559.ocx
c:\windows\system32\9546z5rus7a4.cpl
c:\windows\system32\95adviz2924.dll
c:\windows\system32\95z25worm465.ocx
c:\windows\system32\96433viru572z.ocx
c:\windows\system32\9660zh5eat17823.bin
c:\windows\system32\96ddaddwzre3915.cpl
c:\windows\system32\96dezownl5ader3057.exe
c:\windows\system32\9753stea595z.dll
c:\windows\system32\976bspazse22385.exe
c:\windows\system32\978vi5239z.dll
c:\windows\system32\98763viruza05.bin
c:\windows\system32\9895thief2182z.bin
c:\windows\system32\98aa5zr916.ocx
c:\windows\system32\990z3worm559.cpl
c:\windows\system32\99132sp56bz.dll
c:\windows\system32\9979sp5zdf9.ocx
c:\windows\system32\9b33vi526z8.cpl
c:\windows\system32\9d8aspzrs51876.dll
c:\windows\system32\9e6tzreat845.dll
c:\windows\system32\9f5stzal2905.bin
c:\windows\system32\9fbt5reat2195z.dll
c:\windows\system32\9za9v5r818.bin
c:\windows\system32\9zf1thief2565.ocx
c:\windows\system32\9zf25ir617.bin
c:\windows\system32\9zsteal955.dll
c:\windows\system32\adfaddw5r938z.dll
c:\windows\system32\b50thi9f1391z.cpl
c:\windows\system32\bb3z9r5989.dll
c:\windows\system32\c10sza9se5125.cpl
c:\windows\system32\ddzdd5a9e701.exe
c:\windows\system32\drivers\gxvxcyrqqmmqgiyebxocpubnskbaibklqprml.sys
c:\windows\system32\dz05pyware2922.dll
c:\windows\system32\e8dspywzre9435.ocx
c:\windows\system32\ebcback9o5r15z8.dll
c:\windows\system32\f52z5i9f29.bin
c:\windows\system32\f789ac5dozr2140.exe
c:\windows\system32\gxvxcoyxuqavcogttlkmkkievoytnttkdlmku.dll
c:\windows\system32\gxvxcugyxevtviyvotuunkclfpylfshqfhplo.dll
c:\windows\system32\z00309ro59d.cpl
c:\windows\system32\z0506tro519d.dll
c:\windows\system32\z0515spamb9t2b8.exe
c:\windows\system32\z05evi52987.exe
c:\windows\system32\z05threat15799.cpl
c:\windows\system32\z2518worm90.dll
c:\windows\system32\z3539not-a-vir9s2d2.dll
c:\windows\system32\z39539irus255.dll
c:\windows\system32\z5007not-5-v9rus408.cpl
c:\windows\system32\z503spywa9e2404.ocx
c:\windows\system32\z5332tro935c.dll
c:\windows\system32\z5359spambot5b7.cpl
c:\windows\system32\z56bthi9f336.cpl
c:\windows\system32\z5824not-a-virus4669.cpl
c:\windows\system32\z5acba5kdoor6899.ocx
c:\windows\system32\z5acvir9919.bin
c:\windows\system32\z5e7sp9rse197.dll
c:\windows\system32\z6046v5r9s7d3.bin
c:\windows\system32\z6051troj954.exe
c:\windows\system32\z88faddwa5e3009.dll
c:\windows\system32\z914ba5kdoor2089.bin
c:\windows\system32\z916threat117855.exe
c:\windows\system32\z92t5oj7c7.ocx
c:\windows\system32\z947thi5f2308.ocx
c:\windows\system32\z9554n5t-a-virus952.bin
c:\windows\system32\z9c3vi95965.ocx
c:\windows\system32\za59vir846.dll
c:\windows\system32\za94addw5re926.bin
c:\windows\system32\zd68backdo951108.bin
c:\windows\system32\zd7asparse25299.dll
c:\windows\system32\ze7e5ddw9re2830.exe
c:\windows\system32\zf4bdownload9r1725.exe
c:\windows\system32\zf8evi59040.ocx
c:\windows\z0572hack9o5l2fc.dll
c:\windows\z0725hief4299.cpl
c:\windows\z0922worm195.cpl
c:\windows\z1397h5cktool59d.cpl
c:\windows\z1577not-a-virus6249.bin
c:\windows\z1799pyware1515.exe
c:\windows\z2283virus5699.dll
c:\windows\z5161spy94.cpl
c:\windows\z544spyware20349.ocx
c:\windows\z5495worm55c.cpl
c:\windows\z5730viru9515.cpl
c:\windows\z5796spy52.bin
c:\windows\z58dspy9are519.cpl
c:\windows\z694virus150.exe

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 6th June 2009, 8:49 pm

c:\windows\z904wo5m17b.exe
c:\windows\z9576spam5o933e.cpl
c:\windows\z9b7vi5225.ocx
c:\windows\zc279teal22515.dll
c:\windows\zf9bdownl5ader987.exe
H:\Autorun.inf
H:\Desktop.ini
H:\resycled

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_GXVXCSERV.SYS


((((((((((((((((((((((((( Files Created from 2009-05-06 to 2009-06-06 )))))))))))))))))))))))))))))))
.

2009-06-04 23:19 . 2009-06-04 23:20 -------- d-----w- c:\program files\SystemRequirementsLab
2009-06-04 23:19 . 2009-06-04 23:20 -------- d-----w- c:\documents and settings\user\Application Data\SystemRequirementsLab
2009-06-04 23:19 . 2009-06-04 23:19 207872 ----a-w- c:\documents and settings\user\Application Data\SystemRequirementsLab\SRLProxy_srl_4.dll
2009-06-04 23:19 . 2009-06-04 23:19 207872 ----a-w- c:\documents and settings\user\Application Data\SystemRequirementsLab\SRLProxy_srl_3.dll
2009-06-04 23:19 . 2009-06-04 23:19 207872 ----a-w- c:\documents and settings\user\Application Data\SystemRequirementsLab\SRLProxy_srl_2.dll
2009-06-04 23:19 . 2009-06-04 23:19 207872 ----a-w- c:\documents and settings\user\Application Data\SystemRequirementsLab\SRLProxy_srl_1.dll
2009-06-03 02:12 . 2009-06-03 02:28 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-02 03:41 . 2009-06-02 03:41 65608 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-02 03:18 . 2009-06-02 03:18 -------- d-----w- C:\PerfLogs
2009-06-02 02:22 . 2009-06-03 00:10 1164288 ----a-w- c:\windows\system32\tempo-setup2.exe
2009-05-30 23:03 . 2009-05-30 23:03 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-05-27 03:18 . 2009-05-27 03:18 -------- d-----w- c:\program files\Microsoft Reader
2009-05-27 03:18 . 2003-06-06 00:15 57436 ----a-w- c:\windows\DASShp.dll
2009-05-24 22:58 . 2009-05-24 22:58 -------- d-----w- c:\documents and settings\user\Application Data\TuneUpMedia
2009-05-24 22:57 . 2009-05-24 22:57 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUpMedia
2009-05-24 22:52 . 2009-05-24 22:57 14839672 ----a-w- c:\documents and settings\user\Application Data\OpenCandy\TuneUpInst-1.5.0-cmp3.exe
2009-05-24 22:52 . 2009-05-24 22:52 -------- d-----w- c:\documents and settings\user\Application Data\OpenCandy
2009-05-24 22:52 . 2009-05-24 22:52 -------- d-----w- c:\documents and settings\user\Application Data\Participatory Culture Foundation
2009-05-24 22:51 . 2009-05-24 22:51 -------- d-----w- c:\program files\Participatory Culture Foundation
2009-05-24 14:18 . 2009-05-24 14:18 177 ----a-w- c:\documents and settings\user\Application Data\asd.bat
2009-05-23 13:58 . 2009-05-23 13:58 94208 ----a-w- c:\documents and settings\user\Application Data\svchost32.exe
2009-05-19 15:49 . 2009-05-09 19:59 2051864 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-05-19 15:49 . 2009-05-09 19:59 424472 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwdwsc.dll
2009-05-19 15:49 . 2009-05-09 19:59 312088 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avglngx.dll
2009-05-19 15:49 . 2009-05-09 19:59 177432 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmail.dll
2009-05-19 15:49 . 2009-05-09 19:59 354584 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgxch32.dll
2009-05-19 15:48 . 2009-05-09 19:59 3288344 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe
2009-05-19 15:48 . 2009-05-09 19:59 486168 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe
2009-05-19 15:45 . 2009-05-09 19:52 1437464 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-05-19 15:45 . 2009-05-09 19:52 755992 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll
2009-05-17 18:46 . 2009-05-17 18:46 -------- d-----w- c:\documents and settings\user\Application Data\Ascaron Entertainment
2009-05-14 23:11 . 2009-05-14 23:11 -------- d-----w- c:\documents and settings\user\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-05-14 23:11 . 2008-06-12 10:09 33088 ----a-w- c:\documents and settings\user\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2009-05-13 19:57 . 2009-05-09 19:59 2302232 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll
2009-05-13 19:57 . 2009-05-09 19:59 3399960 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-05-13 01:11 . 2009-05-13 01:19 -------- d-----w- c:\documents and settings\user\.coc

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-03 01:39 . 2009-04-07 01:15 -------- d-----w- c:\program files\Blubster
2009-06-02 01:00 . 2009-03-13 02:27 -------- d-----w- c:\program files\Norton Security Scan
2009-05-28 23:59 . 2009-02-28 23:35 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-27 03:18 . 2009-02-17 20:16 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-15 02:23 . 2009-02-19 01:15 65608 ----a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-10 21:34 . 2009-02-27 00:10 -------- d-----w- c:\documents and settings\user\Application Data\uTorrent
2009-05-09 19:59 . 2009-02-18 00:06 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-09 19:59 . 2009-02-18 00:06 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-09 19:59 . 2009-02-18 00:06 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-09 19:59 . 2009-02-18 00:06 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-05 01:06 . 2009-03-13 02:27 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-04-10 22:54 . 2009-02-18 00:03 -------- d-----w- c:\program files\CCleaner
2009-04-09 01:56 . 2009-04-09 01:56 60744 ----a-w- c:\documents and settings\user\g2mdlhlpx.exe
2009-04-02 23:29 . 2009-04-02 23:29 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-26 22:23 . 2009-04-07 00:02 36864 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-03-26 22:23 . 2009-04-07 00:02 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-03-22 21:33 . 2009-03-22 21:31 22328 ----a-w- c:\documents and settings\user\Application Data\PnkBstrK.sys
2009-03-22 21:33 . 2009-03-22 21:31 22328 ----a-w- c:\documents and settings\user\Application Data\PnkBstrK.sys
2009-03-22 21:33 . 2009-03-22 21:31 107832 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-03-22 21:31 . 2009-03-22 21:31 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-03-22 02:58 . 2009-03-22 02:58 0 ----a-w- c:\windows\nsreg.dat
2009-03-19 23:32 . 2009-04-07 00:07 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 23:32 . 2009-03-19 23:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-13 02:49 . 2009-03-13 02:50 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-03-13 02:48 . 2009-03-13 02:48 152576 ----a-w- c:\documents and settings\user\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
2008-06-12 23:57 1111904 ----a-w- c:\program files\Search Settings\kb127\SearchSettings.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-23 39408]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-09 1947928]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-13 148888]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"FBSearch"="c:\program files\Fast Browser SearchP\FastBrowserSearchProtection.exe" [2008-11-26 325504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"au"="c:\program files\Dealio\DealioAU.exe" [2008-05-27 595296]
"SearchSettings"="c:\program files\Search Settings\SearchSettings.exe" [2008-06-12 991584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"SiSPower"="SiSPower.dll" - c:\windows\system32\SiSPower.dll [2005-04-12 49152]
"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Utility Tray.lnk - c:\windows\system32\sistray.exe [2009-2-17 266240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-09 19:59 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Blubster\\Blubster.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23194:TCP"= 23194:TCP:BitComet 23194 TCP
"23194:UDP"= 23194:UDP:BitComet 23194 UDP

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/17/2009 5:06 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/17/2009 5:06 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2/17/2009 5:05 PM 908568]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/17/2009 5:05 PM 298776]
.
Contents of the 'Scheduled Tasks' folder

2009-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-06-02 c:\windows\Tasks\Norton Security Scan for user.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 03:20]
.
- - - - ORPHANS REMOVED - - - -

BHO-{100EB1FD-D03E-47FD-81F3-EE91287F9465} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uDefault_Search_URL = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Compare Prices with &Dealio - c:\documents and settings\user\Application Data\Dealio\kb127\res\DealioSearch.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B2} - {C9CCBB35-D123-4a31-AFFC-9B2933132116} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\nz32hf1z.default\
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-06 13:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
FBSearch = c:\program files\Fast Browser SearchP\FastBrowserSearchProtection.exe?? software program on your com

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-06-06 13:40
ComboFix-quarantined-files.txt 2009-06-06 20:40

Pre-Run: 22,440,570,880 bytes free
Post-Run: 22,439,387,136 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
921 --- E O F --- 2009-05-21 10:01

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 6th June 2009, 8:50 pm

i couldn't put the file on one post so i put it in three. It is the combofix logfile. Do i need to do something else.

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Belahzur on 6th June 2009, 8:56 pm

Hello.
Before removing some leftovers, we need to uninstall a few things.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 7th June 2009, 7:39 pm

Acrobat.com
Acrobat.com
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.1
Adobe Shockwave Player
Apple Mobile Device Support
Apple Software Update
AVG Free 8.5
Blubster 3.0.7
Bonjour
CCleaner (remove only)
Data Fax SoftModem with SmartCP
Dealio Toolbar 3.4
Fast Browser Search (My Web Tattoo)
Fast Browser Search Protection
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HijackThis 2.0.2
Hotfix for Windows XP (KB952287)
HP Driver Diagnostics
HP PSC & OfficeJet 5.3.B
InstallMgr
iTunes
Java(TM) 6 Update 12
Microsoft .NET Framework 2.0
Microsoft Default Manager
Microsoft Office 2003 Web Components
Microsoft Office Professional Edition 2003
Microsoft Reader
Microsoft Search Enhancement Pack
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.10)
MSN
MSN Toolbar
MSN Toolbar
Norton Security Scan
Norton Security Scan (Symantec Corporation)
Picasa 3
QuickTime
Realtek AC'97 Audio
Search Settings 1.2
Security Update for Windows Media Player (KB952069)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB963027)
SiS VGA Utilities
SiSAGP driver
Spelling Dictionaries Support For Adobe Reader 9
System Requirements Lab
Update for Windows XP (KB898461)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Live Sign-in Assistant
Yahoo! Install Manager
Yahoo! Toolbar

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Belahzur on 7th June 2009, 7:55 pm

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    Fast Browser Search (My Web Tattoo)
    Fast Browser Search Protection
    Java(TM) 6 Update 12
    Search Settings 1.2

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\system32\tempo-setup2.exe
c:\documents and settings\user\Application Data\asd.bat
c:\documents and settings\user\Application Data\svchost32.exe

Folder::
c:\documents and settings\user\Application Data\uTorrent

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=-
"UpdatesDisableNotify"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23194:TCP"=-
"23194:UDP"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 8th June 2009, 7:35 pm

ComboFix 09-06-07.07 - user 06/08/2009 12:27.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.383.203 [GMT -7:00]
Running from: c:\documents and settings\user\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\user\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\documents and settings\user\Application Data\asd.bat"
"c:\documents and settings\user\Application Data\svchost32.exe"
"c:\windows\system32\tempo-setup2.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\user\Application Data\asd.bat
c:\documents and settings\user\Application Data\uTorrent
c:\documents and settings\user\Application Data\uTorrent\Chaos Online - Best Free to play MMORPG of 2009.torrent
c:\documents and settings\user\Application Data\uTorrent\dht.dat
c:\documents and settings\user\Application Data\uTorrent\dht.dat.old
c:\documents and settings\user\Application Data\uTorrent\Jeaniene Frost - [Night Huntress 03] - At Grave's End.torrent
c:\documents and settings\user\Application Data\uTorrent\PlaneShift-v0.4.03.exe.torrent
c:\documents and settings\user\Application Data\uTorrent\resume.dat
c:\documents and settings\user\Application Data\uTorrent\resume.dat.old
c:\documents and settings\user\Application Data\uTorrent\settings.dat
c:\documents and settings\user\Application Data\uTorrent\settings.dat.old
c:\documents and settings\user\Application Data\uTorrent\utorrent.lng
c:\windows\IE4 Error Log.txt

.
((((((((((((((((((((((((( Files Created from 2009-05-08 to 2009-06-08 )))))))))))))))))))))))))))))))
.

2009-06-04 23:19 . 2009-06-04 23:20 -------- d-----w- c:\program files\SystemRequirementsLab
2009-06-04 23:19 . 2009-06-04 23:20 -------- d-----w- c:\documents and settings\user\Application Data\SystemRequirementsLab
2009-06-04 23:19 . 2009-06-04 23:19 207872 ----a-w- c:\documents and settings\user\Application Data\SystemRequirementsLab\SRLProxy_srl_4.dll
2009-06-04 23:19 . 2009-06-04 23:19 207872 ----a-w- c:\documents and settings\user\Application Data\SystemRequirementsLab\SRLProxy_srl_3.dll
2009-06-04 23:19 . 2009-06-04 23:19 207872 ----a-w- c:\documents and settings\user\Application Data\SystemRequirementsLab\SRLProxy_srl_2.dll
2009-06-04 23:19 . 2009-06-04 23:19 207872 ----a-w- c:\documents and settings\user\Application Data\SystemRequirementsLab\SRLProxy_srl_1.dll
2009-06-03 02:12 . 2009-06-03 02:28 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-02 03:41 . 2009-06-02 03:41 65608 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-02 03:18 . 2009-06-02 03:18 -------- d-----w- C:\PerfLogs
2009-05-30 23:03 . 2009-05-30 23:03 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-05-27 03:18 . 2009-05-27 03:18 -------- d-----w- c:\program files\Microsoft Reader
2009-05-27 03:18 . 2003-06-06 00:15 57436 ----a-w- c:\windows\DASShp.dll
2009-05-24 22:58 . 2009-05-24 22:58 -------- d-----w- c:\documents and settings\user\Application Data\TuneUpMedia
2009-05-24 22:57 . 2009-05-24 22:57 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUpMedia
2009-05-24 22:52 . 2009-05-24 22:57 14839672 ----a-w- c:\documents and settings\user\Application Data\OpenCandy\TuneUpInst-1.5.0-cmp3.exe
2009-05-24 22:52 . 2009-05-24 22:52 -------- d-----w- c:\documents and settings\user\Application Data\OpenCandy
2009-05-24 22:52 . 2009-05-24 22:52 -------- d-----w- c:\documents and settings\user\Application Data\Participatory Culture Foundation
2009-05-24 22:51 . 2009-05-24 22:51 -------- d-----w- c:\program files\Participatory Culture Foundation
2009-05-19 15:49 . 2009-05-09 19:59 2051864 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-05-19 15:49 . 2009-05-09 19:59 424472 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwdwsc.dll
2009-05-19 15:49 . 2009-05-09 19:59 312088 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avglngx.dll
2009-05-19 15:49 . 2009-05-09 19:59 177432 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmail.dll
2009-05-19 15:49 . 2009-05-09 19:59 354584 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgxch32.dll
2009-05-19 15:48 . 2009-05-09 19:59 3288344 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe
2009-05-19 15:48 . 2009-05-09 19:59 486168 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe
2009-05-19 15:45 . 2009-05-09 19:52 1437464 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-05-19 15:45 . 2009-05-09 19:52 755992 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll
2009-05-17 18:46 . 2009-05-17 18:46 -------- d-----w- c:\documents and settings\user\Application Data\Ascaron Entertainment
2009-05-14 23:11 . 2009-05-14 23:11 -------- d-----w- c:\documents and settings\user\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-05-14 23:11 . 2008-06-12 10:09 33088 ----a-w- c:\documents and settings\user\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2009-05-13 19:57 . 2009-05-09 19:59 2302232 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll
2009-05-13 19:57 . 2009-05-09 19:59 3399960 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-05-13 01:11 . 2009-05-13 01:19 -------- d-----w- c:\documents and settings\user\.coc

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-06 22:02 . 2009-02-19 01:15 65608 ----a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-03 01:39 . 2009-04-07 01:15 -------- d-----w- c:\program files\Blubster
2009-06-02 01:00 . 2009-03-13 02:27 -------- d-----w- c:\program files\Norton Security Scan
2009-05-28 23:59 . 2009-02-28 23:35 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-27 03:18 . 2009-02-17 20:16 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-09 19:59 . 2009-02-18 00:06 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-09 19:59 . 2009-02-18 00:06 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-09 19:59 . 2009-02-18 00:06 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-09 19:59 . 2009-02-18 00:06 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-05 01:06 . 2009-03-13 02:27 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-04-10 22:54 . 2009-02-18 00:03 -------- d-----w- c:\program files\CCleaner
2009-04-09 01:56 . 2009-04-09 01:56 60744 ----a-w- c:\documents and settings\user\g2mdlhlpx.exe
2009-04-02 23:29 . 2009-04-02 23:29 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-26 22:23 . 2009-04-07 00:02 36864 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-03-26 22:23 . 2009-04-07 00:02 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-03-22 21:33 . 2009-03-22 21:31 22328 ----a-w- c:\documents and settings\user\Application Data\PnkBstrK.sys
2009-03-22 21:33 . 2009-03-22 21:31 22328 ----a-w- c:\documents and settings\user\Application Data\PnkBstrK.sys
2009-03-22 21:33 . 2009-03-22 21:31 107832 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-03-22 21:31 . 2009-03-22 21:31 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-03-22 02:58 . 2009-03-22 02:58 0 ----a-w- c:\windows\nsreg.dat
2009-03-19 23:32 . 2009-04-07 00:07 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 23:32 . 2009-03-19 23:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-13 02:49 . 2009-03-13 02:50 410984 ----a-w- c:\windows\system32\deploytk.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-23 39408]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-09 1947928]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"au"="c:\program files\Dealio\DealioAU.exe" [2008-05-27 595296]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"SiSPower"="SiSPower.dll" - c:\windows\system32\SiSPower.dll [2005-04-12 49152]
"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Utility Tray.lnk - c:\windows\system32\sistray.exe [2009-2-17 266240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-09 19:59 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Blubster\\Blubster.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/17/2009 5:06 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/17/2009 5:06 PM 108552]
.
Contents of the 'Scheduled Tasks' folder

2009-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-06-02 c:\windows\Tasks\Norton Security Scan for user.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 03:20]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Compare Prices with &Dealio - c:\documents and settings\user\Application Data\Dealio\kb127\res\DealioSearch.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} -
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\nz32hf1z.default\
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-08 12:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-06-08 12:34
ComboFix-quarantined-files.txt 2009-06-08 19:33
ComboFix2.txt 2009-06-06 20:40

Pre-Run: 22,235,009,024 bytes free
Post-Run: 22,268,440,576 bytes free

Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
167 --- E O F --- 2009-05-21 10:01

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 8th June 2009, 8:02 pm

after i did what you said i can't play a game i play on the computer called battledawn. it's a browser game. The web address is battledawn.com

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Belahzur on 8th June 2009, 8:33 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 9th June 2009, 6:24 pm

thanks it worked.

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Belahzur on 9th June 2009, 7:34 pm

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by longlast4 on 11th June 2009, 7:06 pm

is CCleaner a good protection for the computer, because i have that

longlast4
Novice
Novice

Posts Posts : 31
Joined Joined : 2009-06-02
OS OS : window XP
Points Points : 27525
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft is attacking me.

Post by Belahzur on 11th June 2009, 7:09 pm

CCleaner isn't really for protection, just temp file cleaning. Smile


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum