Also got infected with Winbluesoft

View previous topic View next topic Go down

Also got infected with Winbluesoft

Post by gorgatz on 4th June 2009, 3:14 am

Please help here is the log from the scan i did today. What should i do now?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:08:07, on 6/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Safe mode with network support

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\Program Files\Windows Defender\MsMpEng.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Internet Explorer\iexplore.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - I:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - I:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - I:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - I:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [VolPanel] "I:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [Windows Defender] "I:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [OutpostMonitor] I:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKLM\..\Run: [OutpostFeedBack] "I:\Program Files\Agnitum\Outpost Security Suite Pro\feedback.exe" /dump:os_startup
O4 - HKLM\..\Run: [QuickTime Task] "I:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "I:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "I:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [SRS Audio Sandbox] "I:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - HKCU\..\Run: [H/PC Connection Agent] "I:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tempo-setup2.exe] I:\WINDOWS\system32\tempo-setup2.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "I:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "I:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Send To &Bluetooth - I:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - I:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - I:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - I:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Outpost Security Suite Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - I:\Program Files\Agnitum\Outpost Security Suite Pro\ie_bar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {C237A80A-4C55-4C68-BAA9-CBE4408D12B2} (F-Secure Online Scanner 4.0 Launcher) - [You must be registered and logged in to see this link.]
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - [You must be registered and logged in to see this link.]
O20 - AppInit_DLLs: blocker.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - I:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - I:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - I:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - I:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - I:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - I:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - I:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - I:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - I:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6759 bytes

gorgatz
Novice
Novice

Posts Posts : 5
Joined Joined : 2009-06-04
OS OS : Vista
Points Points : 27447
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Also got infected with Winbluesoft

Post by Origin on 4th June 2009, 3:54 am


  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
    O4 - HKCU\..\Run: [tempo-setup2.exe] I:\WINDOWS\system32\tempo-setup2.exe
    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "I:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "I:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
    O4 - Global Startup: Bluetooth.lnk = ?
    O20 - AppInit_DLLs: blocker.dll



  • Press "Fix Checked"
  • Close Hijack This.





1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See [You must be registered and logged in to see this link.] for how to disable your AV. (Mcafee)
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31503
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Also got infected with Winbluesoft

Post by gorgatz on 4th June 2009, 10:49 pm

nothing happens when I double click on ComboFix.

gorgatz
Novice
Novice

Posts Posts : 5
Joined Joined : 2009-06-04
OS OS : Vista
Points Points : 27447
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Also got infected with Winbluesoft

Post by Belahzur on 4th June 2009, 10:58 pm


  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Delete a file on reboot..."
  • Then find and select this file: C:\windows\system32\blocker.dll
  • Select okay and select yes to reboot.

Then run Combofix, it will work after that.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Also got infected with Winbluesoft

Post by gorgatz on 5th June 2009, 11:09 pm

Here is the log for combofix

ComboFix 09-06-03.04 - Kuya 06/05/2009 18:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.570 [GMT -4:00]
Running from: i:\documents and settings\Kuya\Desktop\Combo-Fix.exe
AV: Outpost Security Suite Pro *On-access scanning disabled* (Updated) {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: Outpost Security Suite Pro *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
D:\Autorun.inf
E:\Autorun.inf
E:\desktop.ini
I:\autorun.inf
i:\windows\102z7spamb9t43e5.bin
i:\windows\104z5spa9bot75b.exe
i:\windows\10z89not-9-vi5us6d1.dll
i:\windows\1132b5zkdoo92055.exe
i:\windows\11803sp9mbo52d8z.dll
i:\windows\11985wozm63c5.ocx
i:\windows\11c95ddwaze3262.dll
i:\windows\1215zt9oj3e9.exe
i:\windows\12230sp9mbot73z5.bin
i:\windows\1239zw5rm1b3.cpl
i:\windows\12599s9azbot595.dll
i:\windows\1268n5t9a-viruz6bc.dll
i:\windows\1269zhac9tool5765.ocx
i:\windows\12720sp59bot22z.cpl
i:\windows\12d5addwa95295z.cpl
i:\windows\12z49spy295.bin
i:\windows\133445zt-a-vi9us414.bin
i:\windows\133z59orm774.exe
i:\windows\13536spam9ot2bz.exe
i:\windows\13cathief35z9.ocx
i:\windows\13d5back9oor1761z.bin
i:\windows\14e5zparse994.exe
i:\windows\15054zorm92.bin
i:\windows\150zdownload5r2947.bin
i:\windows\15335wo9m55az.ocx
i:\windows\15472vi5usz09.cpl
i:\windows\15554sz5mbot9b2.cpl
i:\windows\1555s9yware576z.dll
i:\windows\157z79pambot7c9.ocx
i:\windows\158z5spa9bo519e.cpl
i:\windows\1593addwarz2308.ocx
i:\windows\15989zacktoo539e.cpl
i:\windows\15d4s9z5se1862.bin
i:\windows\15e3addwarz9235.exe
i:\windows\15z7b9ckdoor173.cpl
i:\windows\163739zoj7e5.bin
i:\windows\16529wzrm699.dll
i:\windows\16541spamzo970.exe
i:\windows\1655tz5e9949.dll
i:\windows\17009hacktoo515z.dll
i:\windows\17320not5z-virus915.ocx
i:\windows\17486zpa59ot6c3.cpl
i:\windows\17509virus50z9.ocx
i:\windows\176519acktool7bz.cpl
i:\windows\17760not-a-v5rus19z.ocx
i:\windows\17c5doz5loa9er3236.exe
i:\windows\17z8backdoo59876.bin
i:\windows\18140notza-vi5us7a9.cpl
i:\windows\18319h5cktool74z.bin
i:\windows\18586sp9mbzt51b.cpl
i:\windows\19198tr5z98c.bin
i:\windows\1939bac5doo9218z.exe
i:\windows\19480troz5469.dll
i:\windows\19692not-a-vi5usf9z.exe
i:\windows\19873troj65z9.dll
i:\windows\1abszars99275.cpl
i:\windows\1b5z9ir1842.cpl
i:\windows\1bc89teal2z45.bin
i:\windows\1bz4back9o5r25.ocx
i:\windows\1caza59ware531.bin
i:\windows\1cd0st59l2z27.bin
i:\windows\1ebft9ief1635z.ocx
i:\windows\1z584s9y650.ocx
i:\windows\1z6529py18.dll
i:\windows\20208hackt5z9641.dll
i:\windows\2045spy509z.exe
i:\windows\20479spamboz5315.bin
i:\windows\20529a5kdoor15z8.bin
i:\windows\20533not-z5vir9s7a0.ocx
i:\windows\2069zworm535.exe
i:\windows\20857not-z-vi5usc79.ocx
i:\windows\20z92virus1ec5.bin
i:\windows\21615not-a-viruz195.cpl
i:\windows\21856w9zm67f.cpl
i:\windows\21895tzojf9.bin
i:\windows\21937wzr59d9.exe
i:\windows\219z0not5a-virus1f9.dll
i:\windows\22457worz2095.exe
i:\windows\22655spy299z.ocx
i:\windows\2267595azbotea.dll
i:\windows\22e7tzreat306095.exe
i:\windows\22z45sp9210.dll
i:\windows\23047sp9mb5t458z.ocx
i:\windows\23059worm237z.cpl
i:\windows\230809roz55b.dll
i:\windows\23508worm579z.ocx
i:\windows\2354tzre9t29492.cpl
i:\windows\235729pambo5zd5.ocx
i:\windows\2368addzar52294.cpl
i:\windows\23760not-z5virus8a9.dll
i:\windows\2396z5roj7a4.bin
i:\windows\23ffdown5oa9er155z.ocx
i:\windows\24595vzrus457.cpl
i:\windows\24z98vir5s23b.exe
i:\windows\2509addw9ze35.ocx
i:\windows\25351vz9us551.ocx
i:\windows\2537thz5at997.cpl
i:\windows\25651zack5ool71f9.cpl
i:\windows\25655h9cktoo53zc.cpl
i:\windows\25959trzj98d5.bin
i:\windows\25969pz106.dll
i:\windows\25989spz21b.exe
i:\windows\259do59loader333z.exe
i:\windows\2610t9reat11959z.bin
i:\windows\26bfdownl9ader4z85.cpl
i:\windows\271fthr9at5z015.cpl
i:\windows\2726tzo952.ocx
i:\windows\27292spamzot15b.exe
i:\windows\27a29ddwarez125.cpl
i:\windows\2823downloaderz5269.dll
i:\windows\28756zot-a-9irus557.cpl
i:\windows\28850worm59z.cpl
i:\windows\29051hacktzol55b.cpl
i:\windows\29252viru935z.exe
i:\windows\295fsparsez850.ocx
i:\windows\29a5ste5lz608.bin
i:\windows\2a9dbackdo5r12z59.exe
i:\windows\2ce9sparse30z5.cpl
i:\windows\2d94spar5e2z10.exe
i:\windows\2d9dspywarz25229.cpl
i:\windows\2e6dztea91520.dll
i:\windows\2z2asp5rs92555.dll
i:\windows\2z431s9y5e6.ocx
i:\windows\2z507spambot309.exe
i:\windows\2z695troj7ce.dll
i:\windows\2z757virus5f9.exe
i:\windows\2z9cstea5857.cpl
i:\windows\30039wormzba5.cpl
i:\windows\30075haz9toolb5.ocx
i:\windows\30093sp95zot7ab.exe
i:\windows\30689h9z5tool23c.ocx
i:\windows\3075viru953z.exe
i:\windows\3095thze9t32355.ocx
i:\windows\30970t9oz593.bin
i:\windows\30baddw5r964z.ocx
i:\windows\30e2addware158z9.cpl
i:\windows\31540szy699.exe
i:\windows\319btzi5f2390.cpl
i:\windows\320z8tro54899.exe
i:\windows\32c5back5oor298z.exe
i:\windows\32c9t5ief966z.ocx
i:\windows\3416zhrea944545.exe
i:\windows\34335pambzt972.cpl
i:\windows\3496szeal18025.cpl
i:\windows\3498spy5zre31.dll
i:\windows\35295aczto9l633.ocx
i:\windows\354fd9wzloader1032.ocx
i:\windows\355e9teaz2599.cpl
i:\windows\3592thizf533.dll
i:\windows\35fcs5ealz0079.ocx
i:\windows\3655thr9at11z49.dll
i:\windows\3724s5y9a2z.cpl
i:\windows\387fdownz9ader3265.bin
i:\windows\392znot5a-vi9us3a2.bin
i:\windows\394zspars9516.bin
i:\windows\395evir14z6.exe
i:\windows\39c99hreat15z7.cpl
i:\windows\39d7downlza9er1656.dll
i:\windows\39z635roj555.dll
i:\windows\3a23s9ealz504.exe
i:\windows\3a57thief38z9.cpl
i:\windows\3bccdownlza5er9917.ocx
i:\windows\3c06steal2955z.cpl
i:\windows\3c6bspywar9552z.dll
i:\windows\3e1dthreatz759.ocx
i:\windows\3f88do5nloaderz932.cpl
i:\windows\3fz9spy5are2431.dll
i:\windows\3z089t5oj1f9.cpl
i:\windows\4085vi93595z.cpl
i:\windows\419fdzwnl5ader2508.cpl
i:\windows\4259v9r5s1zb.exe
i:\windows\429e5teal682z.cpl
i:\windows\435ezpywa9e29315.cpl
i:\windows\435zaddware9565.dll
i:\windows\4550zp9rse2954.exe
i:\windows\4556spambo95z3.ocx
i:\windows\4565azd9are3164.cpl
i:\windows\456ct5r9zt24834.dll
i:\windows\459avir2z295.ocx
i:\windows\47f1zddwar91535.bin
i:\windows\484ath5e9tz6515.cpl
i:\windows\4878sz5al20149.exe
i:\windows\49z6steal645.bin
i:\windows\49zfspar9e1153.cpl
i:\windows\4a3bth5e91769z.cpl
i:\windows\4a499ackdoor2615z.bin
i:\windows\4ca6addza5e13559.dll
i:\windows\4d5d9ddware5z5.bin
i:\windows\4debd9wnlo5dez1295.ocx
i:\windows\4e0stza59477.exe
i:\windows\4e79addwz5e967.exe
i:\windows\4z54threat15995.dll
i:\windows\4zdddow5lo9der3126.ocx
i:\windows\4ze55ir982.ocx
i:\windows\5025h5ckt9ol6ffz.bin
i:\windows\508cvzr1597.ocx
i:\windows\5149stea52z30.dll
i:\windows\5191d5wnlozder991.ocx
i:\windows\521ad9ware3153z.exe
i:\windows\52f5addwzre9031.dll
i:\windows\53116not9a-virus5d4z.exe
i:\windows\5315ha9ktoolz6f.exe
i:\windows\5446zpar95501.bin
i:\windows\5483thie9140z.exe
i:\windows\5494spy5b9z.cpl
i:\windows\549stezl1528.ocx
i:\windows\54f9thr9az35198.cpl
i:\windows\5503sp9zbot4e25.cpl
i:\windows\5509sparse1z1.exe
i:\windows\5520dow95zader194.bin
i:\windows\5539woz559b.dll
i:\windows\5549steal9541z.exe
i:\windows\554hackt9ol563z.dll
i:\windows\5551downloade9655z.bin
i:\windows\55c959ief1202z.dll
i:\windows\55z30hacktool1059.bin
i:\windows\55z5spy69c.ocx
i:\windows\572tzoj9b6.bin
i:\windows\5740worz40a9.cpl
i:\windows\57727spambo961z.exe
i:\windows\57a55ownlzader9960.exe
i:\windows\57ez9hief2450.ocx
i:\windows\584ab9zkdoor1854.exe
i:\windows\5965zroj1d5.cpl
i:\windows\59a0spars5304z.cpl
i:\windows\59b5steal2054z.cpl
i:\windows\5a2dtz9eat13574.ocx
i:\windows\5af8spyware1892z.cpl
i:\windows\5b51downzo5der194.exe
i:\windows\5b52backdzo59479.cpl
i:\windows\5c2fa5zware21809.ocx
i:\windows\5cfaddwarez4759.dll
i:\windows\5d95spyzare1944.exe
i:\windows\5f1badzware20149.cpl
i:\windows\5f90downloadzr2112.dll
i:\windows\5z0029orm421.exe
i:\windows\5z1cth5e91126.ocx
i:\windows\5z2v9r3172.ocx
i:\windows\5z59vir2979.ocx
i:\windows\5z5ddo9nloader553.bin
i:\windows\6005spamboz7519.dll
i:\windows\622csparsz5679.exe
i:\windows\6329h9ckt5oz102.cpl
i:\windows\6338do9nloadzr555.bin
i:\windows\63b3azdwar517869.cpl
i:\windows\63fdthief560z9.ocx
i:\windows\64169iruzd5.dll
i:\windows\647zh9cktool525.exe
i:\windows\6509st5al25z.exe
i:\windows\659559rus577z.cpl
i:\windows\65a9dzwn5oader2115.bin
i:\windows\6600ad95are5z3.dll
i:\windows\6865thre5z10089.bin
i:\windows\68935orm599z.ocx
i:\windows\68a0st5az896.ocx
i:\windows\6916spamzot457.dll
i:\windows\6924vzr18985.ocx
i:\windows\693wo5m27z9.exe
i:\windows\698avzr17455.exe
i:\windows\6bbfaddwz5e10649.bin
i:\windows\6d94virz425.cpl
i:\windows\6z94backdoor549.cpl
i:\windows\6zabackd9or350.exe
i:\windows\7040thre9t317z5.exe
i:\windows\7044backdoorz495.dll
i:\windows\709zstea52051.bin
i:\windows\715f5parse2z29.cpl
i:\windows\74d85pywa9ez119.exe
i:\windows\74dfdownl95dez2787.exe
i:\windows\7500w9rm37bz.exe
i:\windows\7509virus5z5.dll
i:\windows\755b9zarse2429.dll
i:\windows\7593spyzare788.exe
i:\windows\75z5thief16519.dll
i:\windows\77h9ck5oolz31.bin
i:\windows\78509ir14z9.dll
i:\windows\797dzownloader5159.dll
i:\windows\79a5stzal23949.dll
i:\windows\79baspy9aze5785.bin
i:\windows\79z8spywa9e3145.ocx
i:\windows\7a1bvz92145.bin
i:\windows\7a68thi5f9z4.bin
i:\windows\7bce9pywa5e16z0.cpl
i:\windows\7c60sparse6z59.dll
i:\windows\7dd59irz127.exe
i:\windows\7e72b5ckd9zr2289.cpl
i:\windows\7z51sparse13709.ocx
i:\windows\7zb9th9ef5315.bin
i:\windows\8253hacktoo9z21.bin
i:\windows\8629tr5j20z.cpl
i:\windows\8952zpy55a.dll
i:\windows\8c7szeal14995.exe
i:\windows\8z19tr5j258.cpl
i:\windows\9054hacktool589z.cpl
i:\windows\90560trzj3d8.dll
i:\windows\90ethr9at2015z.bin
i:\windows\91095trzj2075.dll
i:\windows\9117zworm14f5.cpl
i:\windows\9157troz45d.ocx
i:\windows\92517wozm590.exe
i:\windows\94559wormz43.dll
i:\windows\9529vir5s4z2.exe
i:\windows\9557vizus591.dll
i:\windows\957thzef17995.ocx
i:\windows\9581threaz2785.ocx
i:\windows\95bs5arsz2910.dll
i:\windows\96259roz225.ocx
i:\windows\96965worm74z5.exe
i:\windows\96z48troj575.bin
i:\windows\97776hacktoo5z0.ocx
i:\windows\9805notza9v5rusd7.bin
i:\windows\98305orm39z.cpl
i:\windows\9996tzoj595.exe
i:\windows\999a5dwarz625.cpl
i:\windows\99z95py2c3.dll
i:\windows\9bzcthief2554.dll
i:\windows\9d93spzrse553.dll
i:\windows\9e45sparze799.bin
i:\windows\9f04dow5lzader427.exe
i:\windows\9f97downloade5917z.exe
i:\windows\a5aspar9e135z.bin
i:\windows\c95zteal2586.bin
i:\windows\dzav9r3256.cpl
i:\windows\e3a9dw5rez03.ocx
i:\windows\e45d5wnloader1965z.ocx

gorgatz
Novice
Novice

Posts Posts : 5
Joined Joined : 2009-06-04
OS OS : Vista
Points Points : 27447
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Also got infected with Winbluesoft

Post by gorgatz on 5th June 2009, 11:10 pm

con't of log


i:\windows\system32\1070s9za51943.bin
i:\windows\system32\107z3t59j775.ocx
i:\windows\system32\10975v95usz0a.cpl
i:\windows\system32\10991trzj51.exe
i:\windows\system32\10b1adzwar91945.cpl
i:\windows\system32\110069p5mbot4dz.bin
i:\windows\system32\1131295oz37a.ocx
i:\windows\system32\11329zpy45c.dll
i:\windows\system32\114z9virus79e5.ocx
i:\windows\system32\118a9parse59z.bin
i:\windows\system32\118fadd5zr92238.bin
i:\windows\system32\1191s5azse3904.ocx
i:\windows\system32\11997wo5z729.ocx
i:\windows\system32\11zathief1059.bin
i:\windows\system32\12510spamb9t5cbz.ocx
i:\windows\system32\1270ha9kt5olzdb.dll
i:\windows\system32\12918zp530a.cpl
i:\windows\system32\13716h9cktool1z5.ocx
i:\windows\system32\141z99orm4b65.cpl
i:\windows\system32\14382t5oj4z09.bin
i:\windows\system32\14396wzrm55.bin
i:\windows\system32\14c95parze2150.ocx
i:\windows\system32\150459orz655.bin
i:\windows\system32\15157v95uz14.exe
i:\windows\system32\152589zrm205.ocx
i:\windows\system32\1532zs95550.dll
i:\windows\system32\15388spy96z5.dll
i:\windows\system32\15503spambzt925.dll
i:\windows\system32\1552spa9sez917.exe
i:\windows\system32\1552szy6029.dll
i:\windows\system32\1559zparse1949.exe
i:\windows\system32\15698zpambot445.bin
i:\windows\system32\157589ir5z252.ocx
i:\windows\system32\15758not-a-zirus1069.cpl
i:\windows\system32\15952spamb5t66z.exe
i:\windows\system32\1599sp5rze504.cpl
i:\windows\system32\15ac9i559z.dll
i:\windows\system32\16152worm69z.exe
i:\windows\system32\16358not-a-vi9uz42f.bin
i:\windows\system32\16599spy5z.exe
i:\windows\system32\1683vz95675.exe
i:\windows\system32\16881hazk5oo9f5.ocx
i:\windows\system32\17187szy5f9.bin
i:\windows\system32\175cs9azse245.dll
i:\windows\system32\179z4vir5s219.ocx
i:\windows\system32\1856znot-a-viru519.cpl
i:\windows\system32\185steal327z9.bin
i:\windows\system32\19017worz55f.bin
i:\windows\system32\19158zirus625.dll
i:\windows\system32\19598not9a-vzrus250.dll
i:\windows\system32\19735pambot9cz.exe
i:\windows\system32\19z2d9wnl5ader2127.exe
i:\windows\system32\1a32d5wnloadez1789.exe
i:\windows\system32\1bzspars9951.cpl
i:\windows\system32\1cf9addwaze2495.ocx
i:\windows\system32\1f1fthre5t3z559.exe
i:\windows\system32\1z002spa5b9tf3.ocx
i:\windows\system32\1z19vi52909.cpl
i:\windows\system32\1z378t5o9198.cpl
i:\windows\system32\1z894troj695.bin
i:\windows\system32\20799zir95433.dll
i:\windows\system32\2079znot-a-viru9125.dll
i:\windows\system32\210199iru5z5d.bin
i:\windows\system32\21455virus2e9z.exe
i:\windows\system32\216az9ief5329.bin
i:\windows\system32\217815pamz9t201.cpl
i:\windows\system32\219679pazbot752.bin
i:\windows\system32\21974sp52z.bin
i:\windows\system32\21z00spamb9519a.bin
i:\windows\system32\22235ha5kt9oz452.dll
i:\windows\system32\22449not9az5irus17f.cpl
i:\windows\system32\22999hackt5ol1zc.ocx
i:\windows\system32\2350threat9z3.cpl
i:\windows\system32\2355s9ealz74.exe
i:\windows\system32\243025ro9z84.dll
i:\windows\system32\24557h5cztool93.bin
i:\windows\system32\248575ot-a-vir9s6eaz.dll
i:\windows\system32\24985spy70cz.ocx
i:\windows\system32\25097spy569z.ocx
i:\windows\system32\2520not-a-vi5zs393.exe
i:\windows\system32\25272tr9z4f1.cpl
i:\windows\system32\25301hacktzol291.bin
i:\windows\system32\25578ha5ktoo977z.exe
i:\windows\system32\255929py34z.bin
i:\windows\system32\25592not-a-vi9z52d2.dll
i:\windows\system32\25655w5rmz9.cpl
i:\windows\system32\257115orz1d79.exe
i:\windows\system32\2595acktozl519.cpl
i:\windows\system32\260569roj5z4.dll
i:\windows\system32\26584not-a-v59uz302.dll
i:\windows\system32\265z7spy59f.cpl
i:\windows\system32\26657zacktool559.ocx
i:\windows\system32\266z59ormcf.ocx
i:\windows\system32\2745spa5sz91.exe
i:\windows\system32\27599worm9z5.cpl
i:\windows\system32\27957hacktooz9c6.dll
i:\windows\system32\28009h5cktoolz95.bin
i:\windows\system32\28197virzs7f5.ocx
i:\windows\system32\288bv5z9994.bin
i:\windows\system32\28z19sp5154.bin
i:\windows\system32\29069wor5z1a.bin
i:\windows\system32\29197spyz56.ocx
i:\windows\system32\29215no5-a-virus691z.dll
i:\windows\system32\294185zrm5c6.bin
i:\windows\system32\2958vzr909.bin
i:\windows\system32\29690tr5j94z.ocx
i:\windows\system32\2976zs597e5.bin
i:\windows\system32\29838w5r96cz.cpl
i:\windows\system32\29999sz9mb5t539.ocx
i:\windows\system32\2b649ackdozr5017.ocx
i:\windows\system32\2b935ir1541z.cpl
i:\windows\system32\2bdsparze5099.bin
i:\windows\system32\2be09hzef1564.cpl
i:\windows\system32\2de0spyz95e297.bin
i:\windows\system32\2dzasteal595.bin
i:\windows\system32\2eebthreaz9153.ocx
i:\windows\system32\2fd9zackdoor20295.ocx
i:\windows\system32\2z089s9ambot451.cpl
i:\windows\system32\2z659spy3c25.cpl
i:\windows\system32\2z92spy599.ocx
i:\windows\system32\2zd4spa5s91109.dll
i:\windows\system32\30125spzmb9t22a.exe
i:\windows\system32\304129pambot554z.exe
i:\windows\system32\3045zworm495.exe
i:\windows\system32\30719tzoj995.exe
i:\windows\system32\3119zworm59f.cpl
i:\windows\system32\3145zpywa5e1932.ocx
i:\windows\system32\31baspazs512559.exe
i:\windows\system32\31z38tr95f8.ocx
i:\windows\system32\32121zot-5-v9rus3f4.bin
i:\windows\system32\3253z9or557.ocx
i:\windows\system32\325cthz9f2737.ocx
i:\windows\system32\3382a5dware2z769.exe
i:\windows\system32\3512hack9ozl575.ocx
i:\windows\system32\3569virus157z.bin
i:\windows\system32\35cavir9z03.cpl
i:\windows\system32\379cdo5nloader25z.exe
i:\windows\system32\3854thrza59907.bin
i:\windows\system32\39555trojz6d.dll
i:\windows\system32\39795irusz27.bin
i:\windows\system32\39dc5hreatz5993.exe
i:\windows\system32\39f2spywz5e16989.ocx
i:\windows\system32\3b75ste9l9z9.ocx
i:\windows\system32\3d29thze5291.dll
i:\windows\system32\3d2fback5o9r1z06.dll
i:\windows\system32\3fz9sparse1585.exe
i:\windows\system32\3z42th95f1277.cpl
i:\windows\system32\3z5athrea911065.cpl
i:\windows\system32\40009zo5f2.exe
i:\windows\system32\4145thzeat17997.cpl
i:\windows\system32\41z3worm595.cpl
i:\windows\system32\434ddowz9oa5er2058.exe
i:\windows\system32\4430not-z-vir9s65d.dll
i:\windows\system32\452zsteal1904.ocx
i:\windows\system32\457a5ir1549z.ocx
i:\windows\system32\45abspywzre20229.bin
i:\windows\system32\476fsparse259z.bin
i:\windows\system32\47acsparse2z59.dll
i:\windows\system32\49405zarse2102.ocx
i:\windows\system32\49495pa9zot56a.dll
i:\windows\system32\4972spyware98z5.exe
i:\windows\system32\4997t5zeat28436.dll
i:\windows\system32\499fdzwnloade52333.cpl
i:\windows\system32\4a8abacz9oor10135.exe
i:\windows\system32\4abzbac95oor13.exe
i:\windows\system32\4d5zthrea94276.dll
i:\windows\system32\4d6a5pzrse15789.exe
i:\windows\system32\4d75spywar91154z.dll
i:\windows\system32\4ddf5hief329z.bin
i:\windows\system32\4z39steal1165.dll
i:\windows\system32\5107not9a-vzrus22c.exe
i:\windows\system32\514b5owzloa9er585.dll
i:\windows\system32\5269spyware24z0.cpl
i:\windows\system32\529395eaz458.exe
i:\windows\system32\52a1down9oader25z5.bin
i:\windows\system32\52z35ir958.exe
i:\windows\system32\52z9sp951b.dll
i:\windows\system32\535abac5do9r6z3.cpl
i:\windows\system32\5396a9dware193z.ocx
i:\windows\system32\54019wozm26.bin
i:\windows\system32\5455addw9re1z53.bin
i:\windows\system32\547znot59-virus536.ocx
i:\windows\system32\5495tr9j2z8.bin
i:\windows\system32\5505spzrse9841.cpl
i:\windows\system32\551ftzie9571.cpl
i:\windows\system32\55295tealz724.exe
i:\windows\system32\5559addzare2255.ocx
i:\windows\system32\555fv9r307z.dll
i:\windows\system32\557abackzoo93006.exe
i:\windows\system32\5587do9nloader5692z.bin
i:\windows\system32\5587downloz9er124.bin
i:\windows\system32\558downloa9er1999z.ocx
i:\windows\system32\559adow9loader588z.cpl
i:\windows\system32\559csteal9z97.dll
i:\windows\system32\55dzthief695.dll
i:\windows\system32\55f5threat192z7.dll
i:\windows\system32\56215spamb9z91.dll
i:\windows\system32\5656vzr990.dll
i:\windows\system32\56e2ste9z1970.dll
i:\windows\system32\56zasp5rse8479.bin
i:\windows\system32\57474spy2z9.dll
i:\windows\system32\5765z9us76a.dll
i:\windows\system32\57905parse1282z.cpl
i:\windows\system32\57905spzmbot5a3.ocx
i:\windows\system32\57ezvir55599.cpl
i:\windows\system32\5825thze9235.exe
i:\windows\system32\5882spz5se1898.dll
i:\windows\system32\58fth9efz899.dll
i:\windows\system32\59159acztool4875.bin
i:\windows\system32\5915v9r29z1.exe
i:\windows\system32\59269py16az.ocx
i:\windows\system32\594z0troj395.exe
i:\windows\system32\59502h9zktool150.ocx
i:\windows\system32\5959backdzor3211.cpl
i:\windows\system32\5960nzt-a-viru9259.dll
i:\windows\system32\5965backdoor9756z.cpl
i:\windows\system32\598asparse259z.cpl
i:\windows\system32\598bzckd9or1321.cpl
i:\windows\system32\599149roj3zb.exe
i:\windows\system32\5992sp5waze3389.ocx
i:\windows\system32\599dsteal1380z.dll
i:\windows\system32\59f5szyware2082.ocx
i:\windows\system32\59z50worm997.cpl
i:\windows\system32\5b5z5r1199.bin
i:\windows\system32\5bccstezl9542.ocx
i:\windows\system32\5bf19pa5se2z29.bin
i:\windows\system32\5c5abackzoor2191.exe
i:\windows\system32\5cd3add9are126z.cpl
i:\windows\system32\5cf3s5ezl489.bin
i:\windows\system32\5d18vir9522z.dll
i:\windows\system32\5d7cd9wnloaderz55.cpl
i:\windows\system32\5dccdownl9ader3195z.dll
i:\windows\system32\5e07addware409z.ocx
i:\windows\system32\5e0cthr5at9z309.exe
i:\windows\system32\5e56addwzre1958.cpl
i:\windows\system32\5fcfs9eal353z.bin
i:\windows\system32\5z1cspa9se2575.exe
i:\windows\system32\5z6fdownl9ader2650.cpl
i:\windows\system32\5z84th9ef852.cpl
i:\windows\system32\5zbevi91735.ocx
i:\windows\system32\5zc8vi516619.cpl
i:\windows\system32\5zf9parse2053.exe
i:\windows\system32\5zfcspars99395.ocx
i:\windows\system32\606295t-a-vzrus461.dll
i:\windows\system32\61f69h5zf1964.bin
i:\windows\system32\622e9ownloa5er76z.ocx
i:\windows\system32\63b095ief26z5.dll
i:\windows\system32\64c5downzoad5944.bin
i:\windows\system32\6514b9ckdoor2955z.bin
i:\windows\system32\653dowzloader2559.bin
i:\windows\system32\65659hiz5583.cpl
i:\windows\system32\656dv5z11579.dll
i:\windows\system32\6591downloa9ez2556.bin
i:\windows\system32\65e8thzef94305.dll
i:\windows\system32\65ebazkdoo51904.bin
i:\windows\system32\6706a5dwaze902.cpl
i:\windows\system32\69d2vir57z29.bin
i:\windows\system32\6b909tealz518.exe
i:\windows\system32\6bdath5eatz9829.bin
i:\windows\system32\6c43addwzr5967.bin
i:\windows\system32\6dz7s59al713.cpl
i:\windows\system32\6ed05ownload9r185z.ocx
i:\windows\system32\6ezdo9nloader13965.exe
i:\windows\system32\6f10szeal5933.bin
i:\windows\system32\7048zac5tool962.ocx
i:\windows\system32\73549zy34e.exe
i:\windows\system32\736baddwzre7895.bin
i:\windows\system32\736h5ck9ooz4b9.exe
i:\windows\system32\7455thzef1939.exe
i:\windows\system32\74dbzhreat551109.cpl
i:\windows\system32\7577bac5dooz2923.cpl
i:\windows\system32\7593tzief15899.cpl
i:\windows\system32\75adth9ef1035z.dll
i:\windows\system32\75edvir65z9.bin
i:\windows\system32\75fbt5ief9z56.exe
i:\windows\system32\7651z5ckt9ol1d8.ocx
i:\windows\system32\769zp9rse5025.exe
i:\windows\system32\76a19oz5loader2905.exe
i:\windows\system32\771azir549.dll
i:\windows\system32\78zed5wnl9ader2835.bin
i:\windows\system32\7938t5i9f68z.cpl
i:\windows\system32\793z59r788.exe
i:\windows\system32\795z5ir20149.exe
i:\windows\system32\79d5thzef5899.dll
i:\windows\system32\79ebaczdoo51549.bin
i:\windows\system32\79f1backdoorz552.bin
i:\windows\system32\7a0cthrezt19354.bin
i:\windows\system32\7a55ad9wzr52406.cpl
i:\windows\system32\7bdzthie54279.cpl
i:\windows\system32\7z79spyware13575.cpl
i:\windows\system32\855hazktool45d9.cpl
i:\windows\system32\8569worm13az.exe
i:\windows\system32\8914not-a-z9rus335.exe
i:\windows\system32\8974n5t9a-virus1caz.dll
i:\windows\system32\8989w5zm463.exe
i:\windows\system32\8d0s9z5l1357.bin
i:\windows\system32\8z26tr9j158.cpl
i:\windows\system32\90859spy1z15.ocx
i:\windows\system32\90908vizus6ce5.dll
i:\windows\system32\915z55orm158.dll
i:\windows\system32\91944vir5s1za.ocx
i:\windows\system32\9195troj552z.cpl
i:\windows\system32\92z5sp9a0.exe
i:\windows\system32\93025zp592.ocx
i:\windows\system32\93418wor55za.exe
i:\windows\system32\95094vzrus3cd.dll
i:\windows\system32\9546zhacktool21f.bin
i:\windows\system32\9548vir3254z.bin
i:\windows\system32\9549sz968a.ocx
i:\windows\system32\9587downlo5der28z.cpl
i:\windows\system32\95f8ad5warz22.bin
i:\windows\system32\95z83spy1a8.bin
i:\windows\system32\97d1spywar524z8.bin
i:\windows\system32\9855zpy19a.bin
i:\windows\system32\99505sp5mbzt6b8.bin
i:\windows\system32\995steal2z845.ocx
i:\windows\system32\9b19v5r3z91.cpl
i:\windows\system32\9d4e5hzeat4402.bin
i:\windows\system32\9d9b5ir3016z.exe
i:\windows\system32\9e40spywa5e2525z.cpl
i:\windows\system32\9e7t5ief2z81.bin
i:\windows\system32\9ecaddzare31725.bin
i:\windows\system32\9f5fback5zor2144.cpl
i:\windows\system32\a8f9hief92z5.dll
i:\windows\system32\aazvi95534.ocx
i:\windows\system32\e7cz9r2165.ocx
i:\windows\system32\f29bazkdoor5256.bin
i:\windows\system32\f5evir2982z.ocx
i:\windows\system32\fffthr5az292909.cpl
i:\windows\system32\tmp31.tmp
i:\windows\system32\tmp38.tmp
i:\windows\system32\tmp40.tmp
i:\windows\system32\z0284n5t9a-virus185.ocx
i:\windows\system32\z083t9r5at25862.ocx
i:\windows\system32\z115spambo9564.exe
i:\windows\system32\z129spyw5re579.bin
i:\windows\system32\z1595s9ambot7b1.ocx
i:\windows\system32\z15daddware3955.ocx
i:\windows\system32\z2052not-a-5iru9765.cpl
i:\windows\system32\z2549spy2b6.cpl
i:\windows\system32\z2b0thie95772.dll
i:\windows\system32\z3866hacktoo53f69.bin
i:\windows\system32\z3f0spyware20995.bin
i:\windows\system32\z4246wor9545.exe
i:\windows\system32\z5979vi5us2ee.dll
i:\windows\system32\z6144no59a-virus182.cpl
i:\windows\system32\z63s5yware3069.cpl
i:\windows\system32\z690tr9j555.cpl
i:\windows\system32\z6t9reat53651.exe
i:\windows\system32\z902spy551.ocx
i:\windows\system32\z9bspyware17785.cpl
i:\windows\system32\za9c5parse312.dll
i:\windows\system32\zb679ddwar51136.cpl
i:\windows\system32\zd5cspyware2997.cpl
i:\windows\z0799spy2509.exe
i:\windows\z19f5pyware2675.exe
i:\windows\z27459irus228.cpl
i:\windows\z35tr9j557.exe
i:\windows\z3b8t9i5f2107.exe
i:\windows\z405steal99595.cpl
i:\windows\z4795ha9ktool425.ocx
i:\windows\z49a5parse9221.exe
i:\windows\z52est9al5694.dll
i:\windows\z59419py105.dll
i:\windows\z6415worm1935.dll
i:\windows\z7081h5cktool59a.ocx
i:\windows\z77abackdoor2395.dll
i:\windows\z7fspyware1955.ocx
i:\windows\z9038not-a-vi5us969.exe
i:\windows\z939virus56c.dll
i:\windows\z9465worm46b.dll
i:\windows\z9484spy456.bin
i:\windows\z9ccbackdoor17485.dll
i:\windows\za7dvir9695.exe
i:\windows\zbe9teal3185.ocx
i:\windows\zc5dspars5599.bin
i:\windows\ze14thre5t96214.dll
i:\windows\zfc4downloa9er3365.ocx
i:\windows\zfec5parse8869.cpl

gorgatz
Novice
Novice

Posts Posts : 5
Joined Joined : 2009-06-04
OS OS : Vista
Points Points : 27447
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Also got infected with Winbluesoft

Post by gorgatz on 5th June 2009, 11:11 pm

last part of log


.
((((((((((((((((((((((((( Files Created from 2009-05-05 to 2009-06-05 )))))))))))))))))))))))))))))))
.

2009-06-04 03:05 . 2009-06-04 03:05 -------- d-----w- i:\program files\Trend Micro
2009-06-04 02:36 . 2009-06-04 02:36 -------- d-----w- i:\program files\CCleaner
2009-06-04 01:50 . 2009-05-26 17:20 40160 ----a-w- i:\windows\system32\drivers\mbamswissarmy.sys
2009-06-04 01:50 . 2009-06-04 01:50 -------- d-----w- i:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-04 01:50 . 2009-05-26 17:19 19096 ----a-w- i:\windows\system32\drivers\mbam.sys
2009-06-04 01:50 . 2009-06-04 01:51 -------- d-----w- i:\program files\Malwarebytes' Anti-Malware
2009-06-03 11:05 . 2009-06-03 11:05 63984 ----a-w- i:\documents and settings\Operator.UNIT00\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-03 11:03 . 2009-06-03 11:07 664 ----a-w- i:\windows\system32\d3d9caps.dat
2009-06-03 02:12 . 2009-06-03 02:12 361472 ----a-w- i:\windows\system32\tempo-setup2.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-02 22:33 . 2006-12-18 00:42 -------- d-----w- i:\documents and settings\Kuya\Application Data\Azureus
2009-04-22 22:17 . 2007-09-29 03:15 7114736 ----a-w- i:\documents and settings\Kuya\Application Data\Azureus\plugins\azemp\azmplay.exe
2009-04-22 22:14 . 2006-12-18 00:05 -------- d-----w- i:\program files\Azureus
2009-04-12 11:47 . 2009-04-12 11:46 -------- d-----w- i:\program files\iTunes
2009-04-12 11:47 . 2009-04-12 11:46 -------- d-----w- i:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-12 11:46 . 2009-04-12 11:46 -------- d-----w- i:\program files\iPod
2009-04-12 11:46 . 2008-09-13 12:56 -------- d-----w- i:\program files\Common Files\Apple
2009-04-12 11:38 . 2009-04-12 11:38 75048 ----a-w- i:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-01 11:54 . 2009-04-01 11:54 152576 ----a-w- i:\documents and settings\Kuya\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-19 20:32 . 2009-03-19 20:32 23400 ----a-w- i:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w- i:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-09 09:19 . 2008-11-26 23:13 410984 ----a-w- i:\windows\system32\deploytk.dll
2002-08-02 12:00 . 2007-06-23 14:26 12348 ----a-w- i:\program files\viewsonicinstruct_xp.pdf
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="i:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"ctfmon.exe"="i:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SetDefaultMIDI"="MIDIDef.exe" - i:\windows\MIDIDEF.EXE [2005-04-22 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="i:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"VolPanel"="i:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-09-15 122880]
"OutpostMonitor"="i:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2008-07-15 1207128]
"OutpostFeedBack"="i:\program files\Agnitum\Outpost Security Suite Pro\feedback.exe" [2008-07-15 435544]
"QuickTime Task"="i:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="i:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2006-10-23 40048]
"SunJavaUpdateSched"="i:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="i:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"P17Helper"="SPIRun.dll" - i:\windows\system32\SPIRUN.DLL [2006-07-03 10752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 03:34 24576 ----a-w- i:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\I:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=i:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=i:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\I:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=i:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=i:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"i:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"i:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"i:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"i:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"i:\program files\Microsoft ActiveSync\rapimgr.exe"= i:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"i:\program files\Microsoft ActiveSync\wcescomm.exe"= i:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"i:\program files\Microsoft ActiveSync\WCESMgr.exe"= i:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"i:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"i:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SandBox;SandBox;i:\windows\system32\drivers\SandBox.sys [9/1/2008 15:04 673920]
R2 WinDefend;Windows Defender;i:\program files\Windows Defender\MsMpEng.exe [11/3/2006 19:19 13592]
R3 afw;Agnitum firewall driver;i:\windows\system32\drivers\afw.sys [9/1/2008 15:04 30864]
R3 afwcore;afwcore;i:\windows\system32\drivers\afwcore.sys [9/1/2008 15:05 234640]
R3 ASWFilt;ASWFilt;i:\windows\system32\Filt\ASWFilt.dll [9/1/2008 15:04 33408]
R3 VBEngNT;VBEngNT;i:\windows\system32\drivers\VBEngNT.sys [9/1/2008 15:04 1072722]
R3 VBFilt;VBFilt;i:\windows\system32\Filt\VBFilt.dll [9/1/2008 15:04 158816]
S2 acssrv;Agnitum Client Security Service;i:\progra~1\Agnitum\OUTPOS~1\acs.exe [9/1/2008 15:04 1570136]
S3 XIRLINK;IBM PC Camera;i:\windows\system32\drivers\C-itNT.sys [12/9/2006 15:30 503768]
.
Contents of the 'Scheduled Tasks' folder

2009-06-05 i:\windows\Tasks\MP Scheduled Scan.job
- i:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]

2009-06-05 i:\windows\Tasks\User_Feed_Synchronization-{4E45ABE5-87F0-4A97-8DAF-50A507642CBF}.job
- i:\windows\system32\msfeedssync.exe [2006-10-17 16:58]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-SRS Audio Sandbox - i:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - i:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send To &Bluetooth - i:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - i:\documents and settings\Kuya\Application Data\Mozilla\Firefox\Profiles\e056wyhn.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: i:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-05 18:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\ActiveSync]
"Name"="ActiveSync"
"DisplayName"="Microsoft ActiveSync"
"Param1"="ActiveSync"
"Type"="wellknown"
"Order"=dword:00000000
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\IESettings]
"Name"="IESettings"
"Type"="IESettings"
"Order"=dword:00000003
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\MediaFiles]
"Name"="MediaFiles"
"Type"="MediaFiles"
"Order"=dword:00000002
"State"=dword:0000000b

[HKEY_USERS\S-1-5-21-1275210071-507921405-839522115-1003\Software\Microsoft\Windows Mobile Disc\S*a*m*s*u*n*g* *B*l*a*c*k*J*a*c*k*"!\CriticalAppInstall\NPW]
"Name"="NPW"
"Param1"="NPW"
"Type"="wellknown"
"Order"=dword:00000001
"State"=dword:0000000b
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(956)
i:\program files\Stardock\Object Desktop\ThemeManager\fastload.dll
.
Completion time: 2009-06-05 19:01
ComboFix-quarantined-files.txt 2009-06-05 23:01

Pre-Run: 45,679,665,152 bytes free
Post-Run: 47,135,645,696 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
i:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

881 --- E O F --- 2009-05-22 12:35

gorgatz
Novice
Novice

Posts Posts : 5
Joined Joined : 2009-06-04
OS OS : Vista
Points Points : 27447
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Also got infected with Winbluesoft

Post by Belahzur on 5th June 2009, 11:46 pm

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

File::
i:\windows\system32\tempo-setup2.exe

Folder::
i:\documents and settings\Kuya\Application Data\Azureus
i:\program files\Azureus

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum