WiniBlue Soft removal

View previous topic View next topic Go down

WiniBlue Soft removal

Post by Allen915 on Mon Jun 08, 2009 8:01 pm

can you help me remove winiblue soft please. I contacted you a few weeks ago and got the checked boxes you told me to fix but my computer crashed and when i got it workig the boxes were different. here is what it says now

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:29:10 PM, on 6/4/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate1c9999199297b30) (gupdate1c9999199297b30) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 14949 bytes

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Belahzur on Mon Jun 08, 2009 8:32 pm

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
    O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
    O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
    O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
    O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Tue Jun 09, 2009 5:51 am

Ok so when i did then scan only to get ready to check the ones that needed to be fixed, this one was not there anymore
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
this is a tricky little bug. I fixed the other ones though and downloaded the program.

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Tue Jun 09, 2009 6:00 am

Malwarebytes' Anti-Malware 1.37
Database version: 2182
Windows 6.0.6001 Service Pack 1

6/9/2009 1:59:12 AM
mbam-log-2009-06-09 (01-59-12).txt

Scan type: Quick Scan
Objects scanned: 73529
Time elapsed: 8 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 13
Registry Values Infected: 0
Registry Data Items Infected: 9
Folders Infected: 3
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{497dddb6-6eee-4561-9621-b77dc82c1f84} (Adware.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4e980492-027b-47f1-a7ab-ab086dacbb9e} (Adware.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5ead8321-fcbb-4c3f-888c-ac373d366c3f} (Adware.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{31f3cf6e-a71a-4daa-852b-39ac230940b4} (Adware.Ascentive) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WiniBlueSoft (Rogue.WiniBlue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NetProject (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3b5d7f84-2cc3-4841-bbdc-8027220a509a}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{76e48418-df3c-4ee9-9aa7-3a35f7e0afd4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{3b5d7f84-2cc3-4841-bbdc-8027220a509a}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{76e48418-df3c-4ee9-9aa7-3a35f7e0afd4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{3b5d7f84-2cc3-4841-bbdc-8027220a509a}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{76e48418-df3c-4ee9-9aa7-3a35f7e0afd4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.

Folders Infected:
c:\Users\Allen P Butler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Program Files\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
c:\windows\system32\gaopdxpdexqtwdijntcgiyypuoyqmniwmqxsyu.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\System32\setup2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Windows\System32\SysRestore.dll (Adware.Ascentive) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\HDPlugin\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully.
c:\program files\HDPlugin\Uninstall.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Windows\System32\gaopdxcounter (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\allen p butler\favorites\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully.


this is what it found and deleted. im about to restart to see if winiblue soft if gone.

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Tue Jun 09, 2009 3:08 pm

Ok winiblue soft is not there anymore! Thanks a lot, i will give a donation to keep the site going

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Belahzur on Tue Jun 09, 2009 5:19 pm

Hello.
It's not gone, the rootkit is still there.

Please post a new Hijack This log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Wed Jun 10, 2009 1:17 am

here is the new hijack this log
ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:29:10 PM, on 6/4/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate1c9999199297b30) (gupdate1c9999199297b30) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 14949 bytes

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Origin on Wed Jun 10, 2009 1:38 am

Please disable Ad-Watch, as it may hinder the removal of some HijackThis entries. You can re-enable it after your computer is clean. Please see here for instructions on how to disable it:

1. Right-click on the Ad-Watch icon in the system tray (located down by the system clock for most configurations)
2. Choose *Settings* from the dropdown menu
3. Under the *General Settings* tab turn OFF (red x) the option to "Load Ad-Watch at Startup" (if enabled)

4. Click on the *Status* button in the left hand menu
5. Turn OFF (red x) the option for *Regshield*
6. Close that window, then right-click on the Ad-Watch icon shield again down in the system tray next to the clock.
7. Choose *Turn off Ad-Watch* from the drop menu




  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [You must be registered and logged in to see this link.]
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
    O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
    O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
    O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
    O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
    O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111



  • Press "Fix Checked"
  • Close Hijack This.






1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See [You must be registered and logged in to see this link.] for how to disable your AV. (Mcafee)
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Status :
Online
Offline

Posts : 2685
Joined : 2009-05-05
Gender : Male
OS : Windows Xp Sp3

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Wed Jun 10, 2009 4:01 am

Ok i checked all the boxes i could see from that list but some were still not showing up in the scan only. I also dont have the ad-watch like the one above but I do have ad-aware and right clicked on it in the systray and clicked disable so hopefully that worked. I ran Hijack again and this is what it says now

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:29:10 PM, on 6/4/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate1c9999199297b30) (gupdate1c9999199297b30) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 14949 bytes

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Belahzur on Wed Jun 10, 2009 2:18 pm

Hello.
Before doing anything else, lets remove AVG because you having two AV's running and that is dangerous.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Wed Jun 10, 2009 7:20 pm

Ok here is the list of the programs

Activation Assistant for the 2007 Microsoft Office suites
ActiveCheck component for HP Active Support Library
Ad-Aware
Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.4
Adobe Shockwave Player 11
Apple Mobile Device Support
Apple Software Update
Before You Know It 3.6
Bonjour
Conexant HD Audio
DAEMON Tools Toolbar
ESU for Microsoft Vista
FastStone Image Viewer 3.5
GEAR driver installer for x86 and x64
GearDrvs
Google Earth
Google Earth Plugin
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
HDAUDIO Soft Data Fax Modem with SmartCP
HijackThis 2.0.2
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.2
HP Easy Setup - Frontend
HP Help and Support
HP Photosmart Essential 2.0
HP Quick Launch Buttons 6.20 D3
HP Total Care Advisor
HP Update
HP User Guides 0079
HP Wireless Assistant
HPAsset component for HP Active Support Library
HPNetworkAssistant
InstallMgr
Intel(R) Graphics Media Accelerator Driver
iTunes
Java(TM) 6 Update 13
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6
LibUSB-Win32-0.1.12.1
LimeWire 5.1.3
Malwarebytes' Anti-Malware
Microsoft Default Manager
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
MobileMe Control Panel
MSCU for Microsoft Vista
MSN Toolbar
MSN Toolbar
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
muvee autoProducer 6.0
My HP Games
Norton 360
OpenOffice.org Installer 1.0
QuickFreedom 1.1.0
QuickTime
Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista
Rhapsody
Rhapsody Player Engine
Rosetta Stone Version 3
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Safari
Sandlot Games Client Services
Symantec Technical Support Web Controls
Synaptics Pointing Device Driver
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Toolbar

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Belahzur on Wed Jun 10, 2009 9:43 pm

Hello.

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If Limewire is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    Java(TM) 6 Update 13
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Java(TM) SE Runtime Environment 6
    LimeWire 5.1.3

Try running Combofix now.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Thu Jun 11, 2009 1:50 am

I removed all the Java and limewire, Here is what combo-fix log says. The log is huge so i have to break it up into several different post. Please let me know if there are anymore steps I need to take. Thanks



ComboFix 09-06-09.06 - Allen P Butler 06/10/2009 21:27.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1013.342 [GMT -4:00]
Running from: c:\users\Allen P Butler\Desktop\Combo-Fix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\10337hazk9ool509.ocx
c:\windows\11143w5zm6bc9.cpl
c:\windows\111e9t5az500.dll
c:\windows\11526noz-a-vir9s400.bin
c:\windows\11590spambot470z.ocx
c:\windows\11653wormz95.ocx
c:\windows\11679zot9a-virus3e05.cpl
c:\windows\12665sza9bot449.ocx
c:\windows\12995zroj656.exe
c:\windows\135939azktool256.ocx
c:\windows\137685rojz9f.dll
c:\windows\13849nzt-a-5irus196.cpl
c:\windows\14235zp51c89.bin
c:\windows\14569teal54z9.cpl
c:\windows\147zvir9s563.dll
c:\windows\14dzspar591154.ocx
c:\windows\14e9bazkdoo52980.cpl
c:\windows\15076wzrm19.bin
c:\windows\15146zpy295.ocx
c:\windows\1517hack5o9l29z.exe
c:\windows\151cth5ef1699z.ocx
c:\windows\15536s9amzot41e.cpl
c:\windows\15556v9rus7fz.dll
c:\windows\15584troz569.exe
c:\windows\15599spambzt5a9.ocx
c:\windows\1559zspamb9t6bf.bin
c:\windows\1569backzo9r2518.exe
c:\windows\15859troj3zf9.dll
c:\windows\15d4th9ef288z.ocx
c:\windows\15z0vi95919.bin
c:\windows\15z9th9eat19154.exe
c:\windows\16329hackzool395.dll
c:\windows\16491haz5t9ol1fa.bin
c:\windows\1677359z14.dll
c:\windows\16946z5rm44c9.exe
c:\windows\16e5szywar92700.bin
c:\windows\16z50s5y279.ocx
c:\windows\16z545pa9bot331.bin
c:\windows\16z62spy559.dll
c:\windows\17195py7dfz.bin
c:\windows\17899zot-a-v5rus150.dll
c:\windows\179219izus2f05.dll
c:\windows\17d4spazs95527.dll
c:\windows\18099tro55ze.ocx
c:\windows\18139spz2f45.bin
c:\windows\18955teaz2483.exe
c:\windows\1895tzreat19885.cpl
c:\windows\18979zroj54b.exe
c:\windows\18z16spamb5t96f.ocx
c:\windows\190295ir9z469.ocx
c:\windows\19245hacktool3zf9.ocx
c:\windows\19368not-a-vizu5361.exe
c:\windows\1945zy37e.ocx
c:\windows\19539hacktoo5z73.dll
c:\windows\195605acztool69b.dll
c:\windows\1957vir128z.ocx
c:\windows\19588troj77z9.exe
c:\windows\1959hiefz058.bin
c:\windows\195backdoor169z.exe
c:\windows\195z5s5ambot449.bin
c:\windows\19670spamboz745.exe
c:\windows\196729irus59fz.bin
c:\windows\19ccd5wzloader362.ocx
c:\windows\1cb0backdooz1859.exe
c:\windows\1dczhi9f4285.bin
c:\windows\1e93sparse96z95.cpl
c:\windows\1f1dthief9z305.cpl
c:\windows\1fc3steaz98125.ocx
c:\windows\1z058viru5499.exe
c:\windows\1z080not-a-9ir5s76d.ocx
c:\windows\1z998sp5498.bin
c:\windows\200z9virus52d9.exe
c:\windows\20404not-9-zir5s57c.bin
c:\windows\20536n5t-a-vizu975.cpl
c:\windows\210495ot-a-vzrus423.bin
c:\windows\2161v9rz175.dll
c:\windows\21a5th9eat10z525.ocx
c:\windows\21z065irus4e89.dll
c:\windows\22048tz9540c.cpl
c:\windows\22160nzt-a-viru55f29.bin
c:\windows\2225thief9z38.dll
c:\windows\22365hz5ktool3f9.cpl
c:\windows\22429z9t-a-vir5sa1.cpl
c:\windows\22483s5azbot3ca9.bin
c:\windows\22649spy7zb5.dll
c:\windows\2273zwo5m5b9.cpl
c:\windows\22902v5rus3z9.ocx
c:\windows\22922szambo5147.exe
c:\windows\23185tr9j6a3z.bin
c:\windows\2325zvirus39b5.dll
c:\windows\24549spz4d39.ocx
c:\windows\24565tzoj429.exe
c:\windows\2459zot-a-virus149.ocx
c:\windows\25117t5ojz6c9.ocx
c:\windows\251z29pambot4a.bin
c:\windows\2527szy9are3269.exe
c:\windows\25300not-a9zirus3bb.dll
c:\windows\25582spa9bot76z.bin
c:\windows\25655hreat17z97.ocx
c:\windows\25662ha9ktool75fz.bin
c:\windows\257459irusfz.cpl
c:\windows\25815trzjfb9.cpl
c:\windows\2598zhac9tool630.ocx
c:\windows\259baddwzre2945.cpl
c:\windows\25z59spam9ot375.exe
c:\windows\26276n5tza-viru97af.bin
c:\windows\26346hack9zol395.cpl
c:\windows\268dback9ooz2165.exe
c:\windows\26z16tr59489.bin
c:\windows\27297sp5zb9t536.cpl
c:\windows\27319w5rz3a4.bin
c:\windows\2755zworm69b.bin
c:\windows\27785virzs91b.cpl
c:\windows\27954spyz9.bin
c:\windows\27995h95ktool75z.dll
c:\windows\27z97viru927d5.exe
c:\windows\287095orz30a.cpl
c:\windows\288z959oj74a.bin
c:\windows\28b45teal3z529.exe
c:\windows\2905zspy7e8.ocx
c:\windows\2906s5y6z.dll
c:\windows\290addwaze3025.dll
c:\windows\29456spa9botzf9.ocx
c:\windows\29529sp9mboz545.exe
c:\windows\29555spambzt521.ocx
c:\windows\295csz5al2691.ocx
c:\windows\2975addwarz2400.exe
c:\windows\29899vi9us5z3.dll
c:\windows\29928nzt-a-vir5se7.cpl
c:\windows\29975vizus252.bin
c:\windows\2a54add9arez551.bin
c:\windows\2a5faz5wa9e2584.ocx
c:\windows\2c22zhief9759.cpl
c:\windows\2e4z9hi5f788.bin
c:\windows\2z004t5o99d.exe
c:\windows\2z77sp9ware11465.exe
c:\windows\2zb9thie56839.dll
c:\windows\2zd3spyware20995.exe
c:\windows\3006859cktoolzfc.ocx
c:\windows\30518not-9-5izus585.ocx
c:\windows\30613s9y45z.dll
c:\windows\30935szy2f9.ocx
c:\windows\309z5spy4de.exe
c:\windows\31352wz95593.dll
c:\windows\31355tr5z29.exe
c:\windows\31975v5zus589.ocx
c:\windows\321825irus7z9.dll
c:\windows\32243hz9ktool3405.ocx
c:\windows\32759r5j561z.bin
c:\windows\335d9hief2z.dll
c:\windows\3458thr95t19z57.bin
c:\windows\34cfzir26589.dll
c:\windows\352279acktoozad.dll
c:\windows\352eaddware9149z.ocx
c:\windows\3551adzware14699.ocx
c:\windows\3565zddwa9e845.ocx
c:\windows\35999troj30z.dll
c:\windows\359vir827z.ocx
c:\windows\359z6troj797.cpl
c:\windows\35z9addwa9e1014.ocx
c:\windows\366z9hief13295.cpl
c:\windows\367fdown5oad9rz91.ocx
c:\windows\3895not-a-virus6f5z.ocx
c:\windows\389dvir93z95.bin
c:\windows\39585vi5zs6b1.dll
c:\windows\395eth9ezt29640.bin
c:\windows\395zorm5ee.bin
c:\windows\39e9zt5al962.ocx
c:\windows\3ad8thie9236z5.exe
c:\windows\3bdf95arse173z.ocx
c:\windows\3cd8st9zl4765.dll
c:\windows\3d6d9zywa5e393.dll
c:\windows\3d95spyware99z.exe
c:\windows\3f59vzr904.dll
c:\windows\415aaddware1z09.dll
c:\windows\41639ackzoor95.exe
c:\windows\41z9addwar526.dll
c:\windows\4259roj57z.cpl
c:\windows\4265steaz9163.dll
c:\windows\4368adzw59e885.bin
c:\windows\4392bz5kdoor1752.cpl
c:\windows\43fcadd5are9z99.cpl
c:\windows\4522sz9al1008.cpl
c:\windows\4566spazs91457.exe
c:\windows\459csparse1852z.exe
c:\windows\4691do9nloade51037z.bin
c:\windows\48z5stea520419.bin
c:\windows\4915s5ywarz2660.exe
c:\windows\4949zpambo55e.bin
c:\windows\49785acktool3zd.bin
c:\windows\49c5spyz5re1960.dll
c:\windows\49cfbazkdoor26895.ocx
c:\windows\49dead9w5re3z2.bin
c:\windows\49s5eaz2502.exe
c:\windows\4b6estezl23559.ocx
c:\windows\4b9ddozn5oader466.dll
c:\windows\4cbbthr9at27z165.exe
c:\windows\4f68th9ez51372.cpl
c:\windows\4f9zvir9405.ocx
c:\windows\4ff8downlz9d5r2368.bin
c:\windows\4z95th9ef2587.ocx
c:\windows\5025threzt3191.bin
c:\windows\50465sp94z2.dll
c:\windows\515aspzware2391.cpl
c:\windows\5241vir91z6.ocx
c:\windows\52581worm2ez9.dll
c:\windows\5265w9rm10z.exe
c:\windows\52899worm208z.cpl
c:\windows\5297vir254z.ocx
c:\windows\52b4zhre9t24345.dll
c:\windows\52e1back9oor2812z.bin
c:\windows\52eeaz9ware5141.exe
c:\windows\5329vir29z05.cpl
c:\windows\5347dz5nloade92948.bin
c:\windows\535z7wor9513.exe
c:\windows\53a0spywar9563z.cpl
c:\windows\53e3virz986.dll
c:\windows\548fspyware9538z.bin
c:\windows\54a2thre9tz5386.exe
c:\windows\54zav9r611.dll
c:\windows\5500th5e9t1z913.dll
c:\windows\5505spyz59.ocx
c:\windows\5555vir3z609.bin
c:\windows\555e9oznloader2688.bin
c:\windows\55794zackto9l5af.dll
c:\windows\5591t9reatz469.ocx
c:\windows\5604dow9lozd5r1993.exe
c:\windows\5619sp5rze1537.ocx
c:\windows\56245ot-a-viruszea9.cpl
c:\windows\56299parse1945z.exe
c:\windows\56689hzef2798.dll
c:\windows\5691spywar5746z.bin
c:\windows\56cdspywarez090.bin
c:\windows\5779downlozde968.bin
c:\windows\57z5t9oj2b8.dll
c:\windows\5802vzrus379.cpl
c:\windows\586aaddwaze559.bin
c:\windows\58aes5za977.ocx
c:\windows\59086vi9zs333.bin
c:\windows\5917z5t-a9virus7c4.exe
c:\windows\5925sp9mbot6zc.bin
c:\windows\5956backdo95z402.cpl
c:\windows\5958s5zal597.ocx
c:\windows\595dbackdzor29579.dll
c:\windows\5988sze9l2231.ocx
c:\windows\5bc5dow9loaderz775.exe
c:\windows\5beaspywzr91439.bin
c:\windows\5bf7t9ief59z.bin
c:\windows\5c21zd9ware5171.exe
c:\windows\5c5zthreat90208.bin
c:\windows\5c91b9ckdooz2399.cpl
c:\windows\5c94addware2942z.cpl
c:\windows\5f9zthreat265725.bin
c:\windows\5fdz9ir2583.dll
c:\windows\5z659irus79c.ocx
c:\windows\5zc9thief912.exe
c:\windows\62319a5kdzor2848.bin
c:\windows\6411t5oz49d.bin
c:\windows\65439hief2z29.cpl
c:\windows\6591threzt3666.bin
c:\windows\65a5spywz9e2638.bin
c:\windows\65af5ownlzader2579.ocx
c:\windows\65ebbac9dozr758.exe
c:\windows\66z5sparse9808.dll
c:\windows\6762thr95t723z.dll
c:\windows\690zsteal455.dll
c:\windows\6925virzs9fa5.ocx
c:\windows\6939thizf5635.dll
c:\windows\695evir28z8.cpl
c:\windows\6961hac9tool10z5.cpl
c:\windows\6981not-5-virus99z.ocx
c:\windows\6994thze5t30485.cpl
c:\windows\69dczdd5are686.exe
c:\windows\6a7ftzief1195.dll
c:\windows\6c0dszyw9r51562.bin
c:\windows\6c1fdownzoa9er2519.ocx
c:\windows\6c6dt59efz019.ocx
c:\windows\6d945hiefz473.bin
c:\windows\6e07thre953623z.bin
c:\windows\6e2f5owzloade9327.ocx
c:\windows\6f19viz2596.dll
c:\windows\6f90thzef50649.cpl
c:\windows\6z56thre9t6763.cpl
c:\windows\6z9daddware2852.bin
c:\windows\7020zhie51490.dll
c:\windows\7055bac5zoor1983.cpl
c:\windows\7093addzare5325.bin
c:\windows\721dadd5arz639.ocx
c:\windows\73c05pzw9re1457.cpl
c:\windows\76fcd5wnlzade91599.cpl
c:\windows\775ste9z579.bin
c:\windows\7821not-5zviru964a.exe
c:\windows\7881zackdoo913455.cpl
c:\windows\7951zhi9f573.bin
c:\windows\79fdzddware9295.dll
c:\windows\7abd9irz5555.bin
c:\windows\7azedo95loader384.ocx
c:\windows\7z26downloa95r1092.ocx
c:\windows\7z2b59arse2934.dll
c:\windows\82579i5uz6ec.ocx
c:\windows\85z8t9oj7a55.cpl
c:\windows\8699zpy185.dll
c:\windows\908spazse5499.ocx
c:\windows\9091wo9m5z9.dll
c:\windows\90fvir1z375.ocx
c:\windows\90z8vi9u56e7.cpl
c:\windows\9135spyzc.dll
c:\windows\9183z5arse1940.exe
c:\windows\9186z5irus51b.dll
c:\windows\92498wozm735.exe
c:\windows\92fbackdoorz1395.bin
c:\windows\9559ztro52a5.ocx
c:\windows\95665spz367.exe
c:\windows\95881spy4z4.ocx
c:\windows\96562tzoj7c3.cpl
c:\windows\96z29s5y43c.ocx
c:\windows\99533hacktool65z.ocx
c:\windows\9969spy7z75.cpl
c:\windows\99c4downloade551z.ocx
c:\windows\9b38thzef3151.cpl
c:\windows\9b50downlozder2099.ocx
c:\windows\9b78backdozr15885.dll
c:\windows\9c56vir829z.exe
c:\windows\9e59stealz038.bin
c:\windows\b34d5wnlo9dez1187.exe
c:\windows\b88s9eal2195z.dll
c:\windows\ba9par5e110z.bin
c:\windows\bbv951218z.exe
c:\windows\c90thief2z5.bin
c:\windows\cb95kdoor31z5.ocx
c:\windows\d559parse25z95.dll
c:\windows\db5v9r163z.bin
c:\windows\e2dzpyw9re1556.exe
c:\windows\e55spar9e954z.dll
c:\windows\fa75aczdoor951.bin

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Thu Jun 11, 2009 1:51 am

Here is part 2 to the log


c:\windows\system32\1005dzwnl9ader167.bin
c:\windows\system32\10505ddwaz91062.ocx
c:\windows\system32\1075ad9wa5e2157z.bin
c:\windows\system32\1095noz-a-vir9s79.bin
c:\windows\system32\10aca5dwzre999.ocx
c:\windows\system32\12701z5y294.bin
c:\windows\system32\129935py2z2.exe
c:\windows\system32\12z93virus7519.dll
c:\windows\system32\13487zp9mbo5283.exe
c:\windows\system32\1350zspambotf95.dll
c:\windows\system32\137z9tr5j605.dll
c:\windows\system32\13bzsparse1095.bin
c:\windows\system32\13z9ir1755.ocx
c:\windows\system32\14039wor52z2.dll
c:\windows\system32\1409zt5al9275.bin
c:\windows\system32\143795ormza7.cpl
c:\windows\system32\145559pamzot205.bin
c:\windows\system32\14579zpy693.cpl
c:\windows\system32\14589wzrm4395.dll
c:\windows\system32\14752not-a-vir9sz5e.cpl
c:\windows\system32\14ff9parsz3059.exe
c:\windows\system32\14z4095y293.bin
c:\windows\system32\15271zot-a-vi9us283.bin
c:\windows\system32\152z0hac9to5l5da.bin
c:\windows\system32\15407vir59714z.cpl
c:\windows\system32\154585py194z.ocx
c:\windows\system32\15495s5926z.cpl
c:\windows\system32\15519tzoj89.exe
c:\windows\system32\15599worm7z59.bin
c:\windows\system32\15615zpamb9t72a5.bin
c:\windows\system32\159zad9w5re781.ocx
c:\windows\system32\15e9threatz6519.bin
c:\windows\system32\15z5vir9461.ocx
c:\windows\system32\15z9downloa5er2687.bin
c:\windows\system32\16059w5rmz69.ocx
c:\windows\system32\16499zp5323.cpl
c:\windows\system32\1693zorm5435.bin
c:\windows\system32\16942spa5bzt1ec.bin
c:\windows\system32\169zh5ef2066.cpl
c:\windows\system32\16z64spambot259.bin
c:\windows\system32\17519notza-virus495.dll
c:\windows\system32\17922zir5s59c.exe
c:\windows\system32\17997zot-a-vi5usca.exe
c:\windows\system32\17zspars5987.dll
c:\windows\system32\18594spy45z.bin
c:\windows\system32\18843nzt-9-viru59b.bin
c:\windows\system32\189d5hreat19906z.exe
c:\windows\system32\19003not-a5viruz13d.cpl
c:\windows\system32\19179vizus55b.bin
c:\windows\system32\19362vi5zs7ab.dll
c:\windows\system32\19452wo9m2z9.bin
c:\windows\system32\19505wzrm1df.bin
c:\windows\system32\195z9v5rus9da.ocx
c:\windows\system32\1968z5ckdoor3218.dll
c:\windows\system32\197965orm8z.exe
c:\windows\system32\1b5ddownload9rz89.bin
c:\windows\system32\1c31down9oaderz235.exe
c:\windows\system32\1ccbtzie95037.bin
c:\windows\system32\1d925ownloadez129.exe
c:\windows\system32\1f55spy9aze1384.cpl
c:\windows\system32\1z883no95a-virus212.exe
c:\windows\system32\1z955hacktool36b.cpl
c:\windows\system32\2058not-a-9irus3z0.cpl
c:\windows\system32\20732no95a-vzrus391.ocx
c:\windows\system32\20854hack59oz610.ocx
c:\windows\system32\20z52virus928.ocx
c:\windows\system32\2139zir14605.exe
c:\windows\system32\21669zpambot558.exe
c:\windows\system32\2191downloa5er9871z.ocx
c:\windows\system32\22093zpambot589.cpl
c:\windows\system32\2242z9ir5s157.cpl
c:\windows\system32\22614sp5z79.cpl
c:\windows\system32\227539za5bot280.exe
c:\windows\system32\22999h5cktoolb4z.exe
c:\windows\system32\2325zno9-a-virus53.exe
c:\windows\system32\23665not-9-viruz7ab.cpl
c:\windows\system32\23669spazbot5ec.dll
c:\windows\system32\23865tzoj9bb.dll
c:\windows\system32\23929viru5348z.dll
c:\windows\system32\2419tr5j505z.dll
c:\windows\system32\24555zpy295.bin
c:\windows\system32\24759vizu5197.dll
c:\windows\system32\25045hackto9z86.ocx
c:\windows\system32\25050hacztool59b.exe
c:\windows\system32\254219pzc3.ocx
c:\windows\system32\254269acktoolza5.cpl
c:\windows\system32\25479spy15bz.dll
c:\windows\system32\25553trzj469.bin
c:\windows\system32\2569troz121.ocx
c:\windows\system32\25731viz9s5b3.bin
c:\windows\system32\25795zpa5bot294.cpl
c:\windows\system32\259629irus6az.ocx
c:\windows\system32\25b4spyw9re2z99.ocx
c:\windows\system32\25bzdownloade92437.exe
c:\windows\system32\25fdt9rzat7566.exe
c:\windows\system32\25z549pambot7f1.exe
c:\windows\system32\26442tr5j329z.dll
c:\windows\system32\26575hacktozl1369.dll
c:\windows\system32\2664b5ck9ooz2768.ocx
c:\windows\system32\26z49t9oj59b.ocx
c:\windows\system32\2721st5al2922z.dll
c:\windows\system32\272s5arse9z1.bin
c:\windows\system32\2756095rm19z.ocx
c:\windows\system32\276385iruz997.ocx
c:\windows\system32\27z55troj7949.dll
c:\windows\system32\28058worm9z.dll
c:\windows\system32\2833vzrus559.ocx
c:\windows\system32\285zt9o5144.bin
c:\windows\system32\28625hacktzol393.dll
c:\windows\system32\289319ot-a-virz5249.dll
c:\windows\system32\28bazo5n9oader653.dll
c:\windows\system32\29507zot-a-virus55e.cpl
c:\windows\system32\29518h5cztool614.exe
c:\windows\system32\29599zyware359.bin
c:\windows\system32\295z5troj46.ocx
c:\windows\system32\297779zrus145.exe
c:\windows\system32\297ha9ktooz54.dll
c:\windows\system32\29935hzc5to9l4a8.ocx
c:\windows\system32\29981w5rz66d.bin
c:\windows\system32\29z15spy676.ocx
c:\windows\system32\2az6ba9kdoor3510.cpl
c:\windows\system32\2e90s95zl93.cpl
c:\windows\system32\2z4319orm5cd.dll
c:\windows\system32\30090hzcktool950.bin
c:\windows\system32\304c9teal5z49.exe
c:\windows\system32\30666hacktozl5c95.ocx
c:\windows\system32\30z795eal875.exe
c:\windows\system32\31601ha9kzool645.ocx
c:\windows\system32\31824t5oj4za9.dll
c:\windows\system32\322z59irus6c6.ocx
c:\windows\system32\32704z9555f.cpl
c:\windows\system32\33bcthr95t15z97.bin
c:\windows\system32\3439th9ef1z05.dll
c:\windows\system32\35226spzm9ot6a5.ocx
c:\windows\system32\354zspyw9re12.exe
c:\windows\system32\35725rzj519.dll
c:\windows\system32\357espyw9re3166z.dll
c:\windows\system32\359129rojz62.exe
c:\windows\system32\35a8t9zef1566.cpl
c:\windows\system32\37f1z5e9l1294.dll
c:\windows\system32\389aste5z2283.exe
c:\windows\system32\3939down5zader2992.cpl
c:\windows\system32\393e59arsz1216.bin
c:\windows\system32\39556zorm624.cpl
c:\windows\system32\3973not-5zvirus993.ocx
c:\windows\system32\399z9s5y642.exe
c:\windows\system32\39c4zd9war5145.ocx
c:\windows\system32\39dfbackdooz2745.exe
c:\windows\system32\3a1ztea518119.ocx
c:\windows\system32\3a7cvzr25429.ocx
c:\windows\system32\3az5stea92845.exe
c:\windows\system32\3c08d5wnloa9er890z.bin
c:\windows\system32\3d2cb9z5door445.dll
c:\windows\system32\3e39downlozd5r21949.dll
c:\windows\system32\3efezow5l9ader295.cpl
c:\windows\system32\3z370tro58f9.bin
c:\windows\system32\3z49spa5se1079.ocx
c:\windows\system32\3z605spambo93c2.dll
c:\windows\system32\3za2sp5wa9e1971.cpl
c:\windows\system32\4092t5oj5z19.ocx
c:\windows\system32\4259zackto5l93f.dll
c:\windows\system32\42a9tzreat170735.exe
c:\windows\system32\4403not-a-z9r5s417.exe
c:\windows\system32\4553zpy59re897.exe
c:\windows\system32\4575vir289z.cpl
c:\windows\system32\45aczownload9r5210.bin
c:\windows\system32\4685doznloade92055.dll
c:\windows\system32\4795szarse1599.bin
c:\windows\system32\47d4st9al5z27.exe
c:\windows\system32\4835spywar9z031.bin
c:\windows\system32\4898thiz55.dll
c:\windows\system32\48e5dowzloade52295.cpl
c:\windows\system32\49145ir9s309z.bin
c:\windows\system32\491at5re9t20z.bin
c:\windows\system32\4956spzware2291.bin
c:\windows\system32\4996back5oor794z.ocx
c:\windows\system32\49ez5pywar9159.exe
c:\windows\system32\4b21viz1959.exe
c:\windows\system32\4b35do9nloader23z9.exe
c:\windows\system32\4c9faddwarz7695.ocx
c:\windows\system32\4ccdstzal16195.ocx
c:\windows\system32\4d95ownloade9z015.exe
c:\windows\system32\4dzaddw5re3209.cpl
c:\windows\system32\4fb9bazkd5or1239.dll
c:\windows\system32\4z2d5hreat10409.exe
c:\windows\system32\5037thr9az11989.dll
c:\windows\system32\5080znot-a-vir9s6e2.exe
c:\windows\system32\513539pamboz7e1.bin
c:\windows\system32\51519hi5z2908.exe
c:\windows\system32\51ac5par9z2530.exe
c:\windows\system32\51cadownloader5z98.bin
c:\windows\system32\5262azdw5re2593.exe
c:\windows\system32\526cth5ea917326z.cpl
c:\windows\system32\5356ste9l2z08.cpl
c:\windows\system32\5400zownload5r31529.bin
c:\windows\system32\54779aczdoor1945.cpl
c:\windows\system32\5489stezl3149.exe
c:\windows\system32\5495szy16f.bin
c:\windows\system32\55155not-a-vi9uszf6.bin
c:\windows\system32\553fvz51089.dll
c:\windows\system32\55410z9ambotf9.dll
c:\windows\system32\5594szarse2809.cpl
c:\windows\system32\55bfz59233.dll
c:\windows\system32\55ccvir9z9.exe
c:\windows\system32\55d1bzckdoor1696.ocx
c:\windows\system32\56065ot-a9virus6zc.bin
c:\windows\system32\5656doznloader10059.dll
c:\windows\system32\565dstzal9295.bin
c:\windows\system32\56caste9l5z07.exe
c:\windows\system32\56czsparse1609.bin
c:\windows\system32\56dzs9eal1905.ocx
c:\windows\system32\57601zpy92b.ocx
c:\windows\system32\57e1zhi9f1212.cpl
c:\windows\system32\58eetz9ef539.ocx
c:\windows\system32\5908zworm281.ocx
c:\windows\system32\5954s5zrse169.bin
c:\windows\system32\5957threat632z.bin
c:\windows\system32\5959zi9us302.dll
c:\windows\system32\595espzw9re1698.ocx
c:\windows\system32\595zworm95a.ocx
c:\windows\system32\59d8szars59275.dll
c:\windows\system32\59dathief515z.dll
c:\windows\system32\59e3spyware7z1.cpl
c:\windows\system32\59f15parze2299.cpl
c:\windows\system32\59z9spa5se2993.ocx
c:\windows\system32\5a39threat25z5.ocx
c:\windows\system32\5afcthief1279z.dll
c:\windows\system32\5b59zir2545.exe
c:\windows\system32\5b5edow5lozder19899.bin
c:\windows\system32\5b64threa95814z.cpl
c:\windows\system32\5ca2threz915251.exe
c:\windows\system32\5d07zir91915.dll
c:\windows\system32\5d479hie51z03.cpl
c:\windows\system32\5dz0sp9rse729.dll
c:\windows\system32\5e49teal2757z.ocx
c:\windows\system32\5ed9vi5z276.cpl
c:\windows\system32\5f0cb9ck5zor2572.ocx
c:\windows\system32\5f59spazse15645.dll
c:\windows\system32\5fe9thz5f836.cpl
c:\windows\system32\5z17spyware1998.ocx
c:\windows\system32\5z759sp9372.exe
c:\windows\system32\5za0vir968.exe
c:\windows\system32\621ddownzoader31509.dll
c:\windows\system32\6268stz5l999.cpl
c:\windows\system32\62dfdownloade592z7.exe
c:\windows\system32\6384s9e5l2200z.dll
c:\windows\system32\63bca95ware1z14.cpl
c:\windows\system32\63dbthie5149z.cpl
c:\windows\system32\64dz9pyware5695.cpl
c:\windows\system32\65935zyware79.dll
c:\windows\system32\65d95ackdoor302z.dll
c:\windows\system32\65vi9z665.bin
c:\windows\system32\6600zpa5se3539.bin
c:\windows\system32\66bba5kdoo9z76.dll
c:\windows\system32\66ez9ief725.cpl
c:\windows\system32\6749threatz554.dll
c:\windows\system32\68f5ba9kdo5r9z9.bin
c:\windows\system32\6915sza5se4089.cpl
c:\windows\system32\6979not-az9irus4c5.dll
c:\windows\system32\69afb5ckdoor92z.bin
c:\windows\system32\6a8fthrea52199z.dll
c:\windows\system32\6aa1downlo9der5005z.ocx
c:\windows\system32\6dzaaddw9re2905.cpl
c:\windows\system32\6dzaspyware29825.bin
c:\windows\system32\6e37do5nloader2980z.dll
c:\windows\system32\6ed5zpywa9e1624.ocx
c:\windows\system32\6f93doznl5ader963.exe
c:\windows\system32\6z84thre9t19155.ocx
c:\windows\system32\6zct5r9at19099.dll
c:\windows\system32\6zd5v5r2980.exe
c:\windows\system32\6zed9ir599.dll
c:\windows\system32\707e9tealz526.dll
c:\windows\system32\7092zirus5b55.cpl
c:\windows\system32\70d8t5rezt26791.cpl
c:\windows\system32\7159th5eat6049z.cpl
c:\windows\system32\72z95pambot3b.ocx
c:\windows\system32\73d8t5reat10900z.dll
c:\windows\system32\75055zoj7f9.cpl
c:\windows\system32\7569backdoor2782z.dll
c:\windows\system32\7590spywa5z2072.bin
c:\windows\system32\75z3spywar9556.bin
c:\windows\system32\76e4adzwar95055.bin
c:\windows\system32\7754za9kdoor1656.bin
c:\windows\system32\77f8thiefz8959.ocx
c:\windows\system32\787faddz5re2749.dll
c:\windows\system32\7963threat15075z.bin
c:\windows\system32\7970hacktozl3f5.cpl
c:\windows\system32\797z9irus4695.bin
c:\windows\system32\79z6spyware1554.bin
c:\windows\system32\7a69vi525z5.exe
c:\windows\system32\7b88sp9waze5861.cpl
c:\windows\system32\7d25th9ea5132z9.cpl
c:\windows\system32\7d55zack9oor1386.cpl
c:\windows\system32\7dabback9ozr7495.ocx
c:\windows\system32\7e689zief955.cpl
c:\windows\system32\7e9f5i9z1.bin
c:\windows\system32\7f9bvir114z5.ocx
c:\windows\system32\7fzaspar9e5619.ocx
c:\windows\system32\8883w9rmzaa5.bin
c:\windows\system32\8887zpam9o597.exe
c:\windows\system32\90055vi5us6c6z.dll
c:\windows\system32\901z5arse576.ocx
c:\windows\system32\90363t5oj17z.ocx
c:\windows\system32\909e5ddware1770z.exe
c:\windows\system32\90cds5eal174z.ocx
c:\windows\system32\915z5wo5m785.dll
c:\windows\system32\9233zackdoo53090.ocx
c:\windows\system32\93599spamzot668.cpl
c:\windows\system32\9375ackdooz1393.dll
c:\windows\system32\93935orm7z7.dll
c:\windows\system32\93z94not-a-virus63e5.dll
c:\windows\system32\94525hacktoolcz.bin
c:\windows\system32\9494viru5578z.cpl
c:\windows\system32\9500zp9363.dll
c:\windows\system32\95201not-a-zi5us2c6.cpl
c:\windows\system32\9523worm1z45.bin
c:\windows\system32\95d15ddwarez48.cpl
c:\windows\system32\96645szy7f5.bin
c:\windows\system32\9742not-a-5i9zs3a9.bin
c:\windows\system32\9777hz9k5ool69a.ocx
c:\windows\system32\9790not-z-vir5s63e.exe
c:\windows\system32\97c0sp5ware1032z.dll
c:\windows\system32\97f75hrezt7145.bin
c:\windows\system32\9887spambo9zd5.cpl
c:\windows\system32\9d5b5oznloader389.bin
c:\windows\system32\9d85spy5are324z.bin
c:\windows\system32\9e75vir2733z.ocx
c:\windows\system32\9eebs5arse139z.dll
c:\windows\system32\9z996wo5m3dd.exe
c:\windows\system32\a9ctzr95t3426.bin
c:\windows\system32\ac8ste9531z6.cpl
c:\windows\system32\b15zddwar92819.ocx
c:\windows\system32\b8a9ir852z.cpl
c:\windows\system32\be9zir225.dll
c:\windows\system32\bf0thi9z5122.cpl
c:\windows\system32\czddownloade91570.ocx
c:\windows\system32\e31dow9loader56z.cpl
c:\windows\system32\e69bzckdoor1051.dll
c:\windows\system32\f995zdware19459.dll
c:\windows\system32\z0697hackt9ol125.bin
c:\windows\system32\z0bbsparse945.cpl
c:\windows\system32\z1840v59usa8.ocx
c:\windows\system32\z2091not-a-vir5s52f.ocx
c:\windows\system32\z3839p56fc.bin
c:\windows\system32\z396troj9d5.ocx
c:\windows\system32\z5019troj965.dll
c:\windows\system32\z554spyware15399.dll
c:\windows\system32\z579thr5at377.ocx
c:\windows\system32\z57sp5wa9e53.exe
c:\windows\system32\z595v9r1558.exe
c:\windows\system32\z67159py642.bin
c:\windows\system32\z6945hackt5ol6f6.bin
c:\windows\system32\z7037hack9oo57dc.dll
c:\windows\system32\z8699hackt5ol2619.bin
c:\windows\system32\z8949virus5ba.dll
c:\windows\system32\z9294wor94925.cpl
c:\windows\system32\z95995y7a8.dll
c:\windows\system32\zb959ownloader1469.exe
c:\windows\system32\zdc6vir25799.dll
c:\windows\system32\zeb4ste5l798.bin
c:\windows\system32\zf51thr9at22512.bin

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Thu Jun 11, 2009 1:52 am

And here is the 3rd part


c:\windows\twain_16.dll
c:\windows\z1424spy5559.ocx
c:\windows\z196steal1509.ocx
c:\windows\z30threa925209.bin
c:\windows\z31bac9door950.dll
c:\windows\z3689ot-a-virus55a.bin
c:\windows\z4cbt9reat1885.bin
c:\windows\z557steal23879.ocx
c:\windows\z5894troj3c09.cpl
c:\windows\z58dbackdoor895.cpl
c:\windows\z64459rm57c.dll
c:\windows\z73539irus440.bin
c:\windows\z74275py7fe9.ocx
c:\windows\z754s9ea51853.bin
c:\windows\z792sp5309.bin
c:\windows\z8829sp519c.bin
c:\windows\z915spy96b.cpl
c:\windows\z95ddownloader25969.ocx
c:\windows\z9f6thr5at2297.ocx
c:\windows\zb02thre5t21269.bin
c:\windows\zc4backdo9r24455.dll
c:\windows\zda95ir1975.bin
c:\windows\zf5avir9603.exe
D:\Desktop.ini

.
((((((((((((((((((((((((( Files Created from 2009-05-11 to 2009-06-11 )))))))))))))))))))))))))))))))
.

2009-06-11 01:25 . 2009-06-11 01:35 -------- d-s---w- \Combo-Fix
2009-06-11 01:21 . 2009-06-11 01:33 -------- d---a-w- \Qoobox
2009-06-11 00:09 . 2009-06-07 15:43 89104 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\NAVENG.SYS
2009-06-11 00:09 . 2009-06-07 15:43 876144 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\NAVEX15.SYS
2009-06-11 00:09 . 2009-06-07 15:43 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\NAVENG32.DLL
2009-06-11 00:09 . 2009-06-07 15:43 1181040 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\NAVEX32A.DLL
2009-06-11 00:09 . 2009-06-07 15:43 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\EECTRL.SYS
2009-06-11 00:09 . 2009-06-07 15:43 101936 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\ERASER.SYS
2009-06-11 00:09 . 2009-06-07 15:43 259368 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\ECMSVR32.DLL
2009-06-11 00:09 . 2009-06-07 15:43 2414128 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\CCERASER.DLL
2009-06-10 18:25 . 2009-06-10 18:24 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-09 23:06 . 2009-06-09 23:06 -------- d-----w- c:\program files\iPod
2009-06-09 23:06 . 2009-06-09 23:07 -------- d-----w- c:\program files\iTunes
2009-06-09 23:02 . 2009-06-09 23:03 -------- d-----w- c:\program files\QuickTime
2009-06-09 22:51 . 2009-06-09 22:51 75048 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-09 14:11 . 2008-12-06 04:42 376832 ----a-w- c:\windows\system32\winhttp.dll
2009-06-09 14:09 . 2008-11-27 04:43 268288 ----a-w- c:\windows\system32\schannel.dll
2009-06-09 05:45 . 2009-06-09 05:45 -------- d-----w- c:\users\Allen P Butler\AppData\Roaming\Malwarebytes
2009-06-09 05:45 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-09 05:45 . 2009-06-09 05:45 -------- d-----w- c:\programdata\Malwarebytes
2009-06-09 05:45 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-09 05:45 . 2009-06-09 05:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-08 19:48 . 2009-06-08 19:48 758088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-06-08 18:24 . 2009-06-07 15:43 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSviA64.sys
2009-06-08 18:24 . 2009-06-07 15:43 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSvix86.sys
2009-06-08 18:24 . 2009-06-07 15:43 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSXpx86.sys
2009-06-08 18:24 . 2009-06-07 15:43 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSxpx86.dll
2009-06-08 18:24 . 2009-03-16 20:03 533880 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\Scxpx86.dll
2009-06-08 14:15 . 2009-06-08 14:15 39428 ----a-w- c:\programdata\Lavasoft\Ad-Aware\ThreatWork\Submit\WNASPINT.DLL
2009-06-07 15:46 . 2009-06-07 15:46 -------- d-----w- c:\programdata\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-06-07 15:45 . 2009-06-07 15:45 -------- d-----w- c:\users\Allen P Butler\AppData\Local\Downloaded Installations
2009-06-07 15:45 . 2009-06-07 15:43 25136 ----a-r- c:\windows\system32\drivers\SymIMV.sys
2009-06-07 15:45 . 2009-06-07 15:45 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-06-07 15:45 . 2009-06-07 15:45 -------- d-----w- c:\program files\Symantec
2009-06-07 15:43 . 2009-06-07 15:43 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvia64.sys
2009-06-07 15:43 . 2009-06-07 15:43 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-06-07 15:43 . 2009-06-07 15:43 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.sys
2009-06-07 15:43 . 2009-06-07 15:43 1290592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2009-06-07 15:43 . 2009-06-07 15:43 136840 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2009-06-07 15:43 . 2009-06-07 15:43 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\idsxpx86.dll
2009-06-07 15:43 . 2009-06-07 15:43 796016 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2009-06-07 15:42 . 2009-06-07 15:42 -------- d-----w- c:\windows\system32\drivers\N360
2009-06-07 15:42 . 2009-06-07 15:42 -------- d-----w- c:\program files\Norton 360
2009-06-07 15:29 . 2009-06-07 15:29 -------- d-----w- c:\programdata\PCSettings
2009-06-07 15:28 . 2009-06-07 15:28 -------- d-----w- c:\programdata\Norton
2009-06-07 15:11 . 2009-06-07 15:42 -------- d-----w- c:\programdata\NortonInstaller
2009-06-07 15:11 . 2009-06-07 15:27 -------- d-----w- c:\program files\NortonInstaller
2009-06-05 15:42 . 2009-06-05 15:42 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-05 15:42 . 2009-06-05 15:42 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-31 07:51 . 2009-06-10 07:17 1063378944 --sha-w- \hiberfil.sys
2009-05-31 07:34 . 2009-05-31 07:34 -------- d-----w- c:\windows\system32\.exe
2009-05-24 19:42 . 2009-05-24 19:42 -------- d-----w- c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-11 01:10 . 2007-04-24 19:44 -------- d-----w- c:\program files\Java
2009-06-11 01:08 . 2007-09-02 12:29 -------- d-----w- c:\program files\LimeWire
2009-06-11 00:57 . 2007-09-02 12:29 -------- d-----w- c:\users\Allen P Butler\AppData\Roaming\LimeWire
2009-06-10 07:17 . 2009-05-31 07:51 1063378944 --sha-w- \hiberfil.sys
2009-06-10 07:17 . 2007-06-05 00:54 1592786944 --sha-w- \pagefile.sys
2009-06-10 07:15 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-10 00:49 . 2007-11-25 04:25 -------- d-----w- c:\programdata\Google Updater
2009-06-10 00:35 . 2007-10-19 21:29 -------- d-----w- c:\programdata\Apple
2009-06-09 23:06 . 2007-10-19 21:29 -------- d-----w- c:\program files\Common Files\Apple
2009-06-09 22:50 . 2008-03-23 15:40 -------- d-----w- c:\program files\Safari
2009-06-08 23:36 . 2007-11-25 04:24 -------- d-----w- c:\program files\Google
2009-06-08 16:19 . 2007-09-02 03:34 94456 ----a-w- c:\users\Allen P Butler\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-07 16:09 . 2007-04-24 18:40 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-07 15:45 . 2009-06-07 15:45 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-06-07 15:45 . 2009-06-07 15:45 7386 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-06-07 15:42 . 2008-10-09 02:34 -------- d-----w- c:\programdata\Symantec
2009-06-07 15:34 . 2008-04-07 22:24 -------- d-----w- c:\users\Allen P Butler\AppData\Roaming\Symantec
2009-06-04 19:25 . 2009-03-05 23:59 -------- d-----w- c:\programdata\Rosetta Stone
2009-05-31 11:49 . 2009-04-20 03:52 -------- d-----w- c:\program files\LibUSB-Win32
2009-05-31 07:33 . 2008-04-18 00:45 1356 ----a-w- c:\users\Allen P Butler\AppData\Local\d3d9caps.dat
2009-05-09 02:23 . 2009-03-10 22:33 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-05-09 02:23 . 2008-08-07 01:12 -------- d-----w- c:\program files\Apple Software Update
2009-05-09 01:28 . 2009-05-09 01:28 15670 ----a-w- c:\windows\9057s9am5otz.exe
2009-05-07 05:44 . 2009-05-07 05:44 -------- d-----w- c:\program files\Microsoft
2009-05-07 05:42 . 2009-05-07 05:42 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-04-29 17:18 . 2009-04-29 17:18 -------- d-----w- c:\program files\Realtek
2009-04-29 17:18 . 2007-04-24 18:29 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-20 03:39 . 2009-04-20 03:39 -------- d-----w- c:\program files\QuickFreedom
2009-04-15 19:42 . 2009-04-15 19:42 -------- d-----w- c:\programdata\WindowsSearch
2009-04-15 18:21 . 2009-04-15 18:14 -------- d-----w- c:\programdata\Lavasoft
2009-04-15 18:15 . 2009-04-15 18:15 -------- dc-h--w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-15 18:14 . 2009-04-15 18:14 -------- d-----w- c:\program files\Lavasoft
2009-03-31 19:35 . 2009-04-22 16:29 17160 ----a-w-

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Thu Jun 11, 2009 1:52 am

here is the last part


c:\windows\Help\OEM\scripts\HC_TotalCareAdvisorUpdate.exe
2009-03-30 21:30 . 2009-04-22 16:29 17160 ----a-w- c:\windows\Help\OEM\scripts\HC_DanzkaDubraBIOSUpdate.exe
2009-03-20 00:37 . 2009-03-20 00:37 34062 ----a-w- c:\users\Allen P Butler\AppData\Roaming\Move Networks\ie_bin\Uninst.exe
2009-03-19 20:32 . 2009-04-10 20:15 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 20:32 . 2009-03-19 20:32 23400 ----a-w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-17 03:38 . 2009-06-09 14:10 13824 ----a-w- c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-06-09 14:10 24064 ----a-w- c:\windows\system32\amxread.dll
2009-03-16 20:03 . 2009-03-16 20:03 533880 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\Scxpx86.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-8988-34A187E2698B}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2007-03-20 1773568]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-25 68856]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-19 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-31 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-31 151552]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-31 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-03-29 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-03-06 180224]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-10 518488]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2007-04-24 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

c:\users\Allen P Butler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B89089E0-93F3-4AAF-88BC-A77D8C0CE919}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{6D8029B1-4EAB-4DD3-A2EE-20CE97784762}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{01805BF0-44B0-4852-82C2-4371FC760EB0}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{B0E7ADF8-5A75-41E5-A2CA-A5BF5D3E553D}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{5263EB6C-C32D-42ED-85BA-6ACF0EFA275E}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{4CA7B5A8-30FA-4D1A-93BF-9ADCC28BACEC}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{9F854534-00F2-4FC6-9DCE-27D00FE51D06}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{EA468C31-1C10-4FED-A10C-B6C3D4C56FE1}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{18CDF69B-2AC8-47E5-A6D8-4D581A618267}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{84964846-0ADE-4863-A648-CE7765AD75F2}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D54D72DF-5B78-4592-A43B-CDB974B692CF}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{1B93D466-8C9E-4BED-B0A5-1AE708A1D28C}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{23D3D96F-0199-4117-B0EA-CBD607B1B971}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{D15CC401-1941-4CD3-8FC4-372E82D6E8C7}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{341627A5-2511-40F1-B92F-C9CBA3FB8F27}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{B91C10C5-1B9A-4D35-9732-9E90D4F38511}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{8B135C10-D6A0-4945-AD4A-A7849EF03D08}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{ED5041E8-94B3-486F-902D-F83A8E0050EA}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{FCBD9011-3D9C-48FA-9D2D-09F245F2A080}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{35B970EE-824B-4B76-BB8A-0CF9C76DCA24}c:\\program files\\rhapsody\\rhapsody.exe"= UDP:c:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody
"UDP Query User{FCAB759C-292B-4F1D-9A76-90A7BF7F4949}c:\\program files\\rhapsody\\rhapsody.exe"= TCP:c:\program files\rhapsody\rhapsody.exe:RealNetworks Rhapsody
"{A0ABA86B-A419-4DF6-8384-4B12113648F9}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{8DDC40CF-B16C-4935-B6E9-F9AE5F7D5325}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{B7041966-FC8A-4C76-9953-3A1B1EAD11C4}"= UDP:c:\program files\1stWORKS\pc2me\BIN\pc2me.exe:PC2Me
"{CB0C0261-2C62-41E1-9100-99E15A2579EA}"= TCP:c:\program files\1stWORKS\pc2me\BIN\pc2me.exe:PC2Me
"{31EB4B14-CEB6-48F5-8803-E029AFA1AA4A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{E363862D-2F94-4457-B8E1-541DAB4D6344}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{D3EA381E-E7AF-4B34-A545-708AA769B89D}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{7049FAF1-FB1A-4A05-9B80-2291B9247CBF}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{7C6A9DCC-D8BC-42D6-AA89-78EF9D5E790E}"= c:\program files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe:Rosetta Stone Version 3 Application
"{F99D3905-0CC0-42AD-B05D-5282BA6BB6DB}"= c:\program files\Rosetta Stone\Rosetta Stone Version 3\support\bin\win\RosettaStoneLtdServices.exe:Rosetta Stone Ltd Services
"{C4E6E488-17E7-4926-8391-36F96E97C7D1}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{8D3B9629-B68E-4BB9-9419-49AEBD6FD357}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\N360\0300000.086\SymEFA.sys [6/7/2009 11:43 AM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\drivers\N360\0300000.086\BHDrvx86.sys [6/7/2009 11:43 AM 258608]
R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\N360\0300000.086\cchpx86.sys [6/7/2009 11:43 AM 482352]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSvix86.sys [6/8/2009 2:24 PM 292912]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 3:06 PM 1005904]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe [6/7/2009 11:43 AM 115560]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/7/2009 11:43 AM 101936]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\drivers\N360\0300000.086\symndisv.sys [6/7/2009 11:43 AM 39984]
S0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [6/10/2009 2:25 PM 64160]
S2 gupdate1c9999199297b30;Google Update Service (gupdate1c9999199297b30);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2009 6:44 AM 133104]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\System32\drivers\libusb0.sys [4/19/2009 11:52 PM 28672]
.
Contents of the 'Scheduled Tasks' folder

2009-06-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 18:24]

2009-06-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-11-25 05:41]

2009-06-10 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-28 10:43]

2008-12-16 c:\windows\Tasks\HPCeeScheduleForAllen P Butler.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-04-24 21:23]

2009-06-10 c:\windows\Tasks\User_Feed_Synchronization-{A653F827-0705-42A6-AE63-EE9BB8493479}.job
- c:\windows\system32\msfeedssync.exe [2008-09-20 07:33]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-10 21:35
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.0.0.134\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.0.0.134\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-06-11 21:42
ComboFix-quarantined-files.txt 2009-06-11 01:42

Pre-Run: 15,902,486,528 bytes free
Post-Run: 15,975,706,624 bytes free

987 --- E O F --- 2009-06-10 07:09

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Belahzur on Thu Jun 11, 2009 3:51 pm

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\system32\.exe
c:\windows\9057s9am5otz.exe

Folder::
c:\program files\LimeWire
c:\users\Allen P Butler\AppData\Roaming\LimeWire

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{D54D72DF-5B78-4592-A43B-CDB974B692CF}"=-
"{1B93D466-8C9E-4BED-B0A5-1AE708A1D28C}"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Thu Jun 11, 2009 5:22 pm

Ok I did the drag and drop on the combo fix and it took about 10 minutes and created a log but my programs did not come back up there was just a background with no icons or programs. I waited a while and the computer just restarted but when It came back up I couldnt find the log. It said it was saved and i searched for the name but it didnt come up. Should I scan it again?

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Belahzur on Thu Jun 11, 2009 5:25 pm

No, it would of still done it's job.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Allen915 on Thu Jun 11, 2009 10:28 pm

ok so that removed the combo fix and the computer seems to be doing pretty good. Thanks a lot. So is the WiniBlue Soft completely gone from my computer now.

Allen915
Novice
Novice

Status :
Online
Offline

Posts : 15
Joined : 2009-05-26
OS : Vista

View user profile

Back to top Go down

Re: WiniBlue Soft removal

Post by Belahzur on Thu Jun 11, 2009 10:30 pm

Yep, I'd say it is.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum