WinBlue Soft..PLEASE help

View previous topic View next topic Go down

WinBlue Soft..PLEASE help

Post by in deep trouble on Tue Jun 23, 2009 5:45 pm

Hi I really could use some help this winblue Soft is not letting me do any thing, I haven't registered for it because I knew there was something wrong with the program. I just want it gone. Here's the log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:14 PM, on 6/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\PDF Complete\pdfsaver.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\My Documents\hijackgpthis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [FlyMonitor] "C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - [You must be registered and logged in to see this link.] Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {226ACC34-3194-70E2-5AE7-864FCFE9E80D} (CPlayFirstmsiControl Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} (WebIQ Engine Application Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {49E67060-2C0D-415E-94C7-52A49F73B2F1} (CPlayFirstPiratePoppersControl Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - [You must be registered and logged in to see this link.]
O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{8414BD31-C009-4812-BF6E-247375BD2453}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O20 - Winlogon Notify: hpkcrkin - C:\Documents and Settings\Administrator\Application Data\hpkcrkin.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: OSCM Utility Service - Sprint Spectrum, L.L.C - C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 12280 bytes

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by Belahzur on Tue Jun 23, 2009 5:48 pm

Hello.

I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

Please make sure Teatimer is disable before we do this, otherwise this fix will fail.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8414BD31-C009-4812-BF6E-247375BD2453}: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
    O20 - Winlogon Notify: hpkcrkin - C:\Documents and Settings\Administrator\Application Data\hpkcrkin.dll (file missing)


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Tue Jun 23, 2009 8:57 pm

I would be happy to EXCEPT, i cant the program refuses to run along with spy doctor and system restore. Any ideas??

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Tue Jun 23, 2009 9:03 pm

Could I go to task manager and end it in PROCESSES without messing my computer up?

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by Belahzur on Tue Jun 23, 2009 9:09 pm

Are you talking about TeaTimer? if so, yes, try and end TeaTimer.exe via the Task Manager.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Tue Jun 23, 2009 9:30 pm

Ok so i used HJT and fixed every thing you instruced but now I cant download maleware bytes because neither Internet Exporer or Firefox will let me go through your link. Internet Explorer says page cant be displayed and Firefox redirects me to ask.com where every time I try to go to the maleware byets siteIm rediriected to another

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Tue Jun 23, 2009 9:44 pm

Ok nevermind im not sure how but got the program, how ever i can,t open it. I see the hour glass fo a split second and then nothing what should i do?

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by Belahzur on Tue Jun 23, 2009 10:11 pm

Before we can use our main tool, we need to uninstall a few things.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Tue Jun 23, 2009 10:15 pm

3DVIA player 5.0
Acrobat.com
Acrobat.com
Adobe AIR
Adobe AIR
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Reader 9.1.2
Adobe Shockwave Player 11
Apple Software Update
ArcSoft VideoImpression 1.6FP
Athlon 64 Processor Driver
ATI Control Panel
ATI Display Driver
AXIS Media Control Embedded
Broadcom Management Programs
CA Yahoo! Anti-Spy (remove only)
Canon MP Navigator EX 1.0
Canon MX310 series
Canon MX310 series User Registration
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
Compatibility Pack for the 2007 Office system
Critical Update for Windows Media Player 11 (KB959772)
FinePixViewer Ver.2.0
FLY World
FUJIFILM USB Driver
Highlight Viewer (Windows Live Toolbar)
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
HP Help and Support
HP Safety and Comfort Guide
InterVideo WinDVD
Java DB 10.4.2.1
Java(TM) 6 Update 14
Java(TM) SE Development Kit 6 Update 14
LiveUpdate 3.0 (Symantec Corporation)
Logitech Desktop Messenger
Logitech IM Video Companion
Logitech ImageStudio
Logitech Print Service
Malwarebytes' Anti-Malware
Map Button (Windows Live Toolbar)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Mobile Broadband Drivers
Mozilla Firefox (3.0.11)
MP4-based Video Downloader
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
PDF Complete
PlayStation(R)Network Downloader
PlayStation(R)Store
Presto! PageManager 7.15.16
PSP Max Media Manager
QuickTime
QuickTiming
RealPlayer
Realtek AC'97 Audio
Roxio Easy Media Creator 7
Roxio UDF Reader
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Smart Menus (Windows Live Toolbar)
Sony Media Manager for PSP 3.0
Sprint Mobile Broadband (Novatel Wireless)
Spybot - Search & Destroy
Spyware Doctor 6.0
The Weather Channel Desktop 6
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
URGE
ViewAhead Photo Center
WebIQ Technology Engine
Windows Driver Package - LeapFrog (FlyUsb) USB (06/15/2007 1.0.0.6)
Windows Live Favorites for Windows Live Toolbar
Windows Live installer
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
Yahoo! Browser Services
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Toolbar

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Wed Jun 24, 2009 4:17 pm

What do you think i need to uninstall?

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by Belahzur on Wed Jun 24, 2009 4:36 pm

Hello.
Since you can't disable TeaTimer, were gonna temporarily uninstall it until we are done. Smile

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    Spybot - Search & Destroy
    LiveUpdate 3.0 (Symantec Corporation)

Next,

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Thu Jun 25, 2009 7:43 pm

ComboFix 09-06-25.01 - Administrator 06/25/2009 14:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.556 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\program files\Common Files\System\Uninstall
c:\windows\103525ormz9e.dll
c:\windows\1051worm945z.ocx
c:\windows\10754trojz9.cpl
c:\windows\109459amzot230.cpl
c:\windows\10970spy25az.cpl
c:\windows\10c4dzwnload9r2255.bin
c:\windows\10z96worm529.bin
c:\windows\110279pamb5t72ez.dll
c:\windows\11598trzj70b.exe
c:\windows\12559ackt5ol5f7z.dll
c:\windows\1297szea929725.ocx
c:\windows\12999haczt95l518.ocx
c:\windows\13094not-a9viru5z29.exe
c:\windows\13130zr5j3129.cpl
c:\windows\13358spamz5915.exe
c:\windows\13959ackdoor915z.ocx
c:\windows\13z565acktool19a.bin
c:\windows\14256nz9-a-virus5c7.exe
c:\windows\143z9not-a-vir5sb2.dll
c:\windows\15535virus9fz.cpl
c:\windows\1561695oj7zd.exe
c:\windows\15bfdownlozder2396.cpl
c:\windows\15fbackdo9r109z.ocx
c:\windows\15z48hacktoo539c.bin
c:\windows\16563zr9j655.exe
c:\windows\16745not-a-vizus7195.ocx
c:\windows\17255wzrm1fa9.dll
c:\windows\17857noz-a5v9rus51d.cpl
c:\windows\17956spy799z.dll
c:\windows\18dzb9ckdoor5489.bin
c:\windows\18z71hackto5l209.exe
c:\windows\19030nz5-a-vi9us174.bin
c:\windows\1907v5rzs6929.ocx
c:\windows\19109virzs2ce5.cpl
c:\windows\19226zpa9bot65f.dll
c:\windows\1979spyw5re3z17.bin
c:\windows\197ezhreat54389.bin
c:\windows\19825hazkt5ol2789.ocx
c:\windows\198fsp5war95z.ocx
c:\windows\1991spzrse1855.ocx
c:\windows\19z53s9y592.bin
c:\windows\1d87vi925z7.cpl
c:\windows\1e48thrza925691.ocx
c:\windows\1f47z95eat10612.ocx
c:\windows\1f9ezown5oader185.ocx
c:\windows\1fc9thrzat11532.dll
c:\windows\1z591spy23e.exe
c:\windows\1z774spam5o9402.dll
c:\windows\1zedth5e9t12158.ocx
c:\windows\20531tzoj7059.bin
c:\windows\2088hac5tzol698.dll
c:\windows\211z7hacktool5b9.dll
c:\windows\21792not-59vzrus70b.ocx
c:\windows\22499troj2z5.ocx
c:\windows\225009zrus695.cpl
c:\windows\22551hazkto9l52c5.bin
c:\windows\2288not-a-viz955d.dll
c:\windows\22995spam5otbz.ocx
c:\windows\22f8s9eal67z5.ocx
c:\windows\23599spy275z.bin
c:\windows\23805zoj1689.exe
c:\windows\24033v5rus75z9.exe
c:\windows\24702z5rus9a4.ocx
c:\windows\2495addware11z7.bin
c:\windows\25108ha5ztool44b9.dll
c:\windows\25405szam9ot9d5.exe
c:\windows\2589backdoor2z79.exe
c:\windows\25908v5rus51z.dll
c:\windows\25995worm74ez.dll
c:\windows\2601dow9loaderz695.dll
c:\windows\2619n5t-a-viruz5f8.exe
c:\windows\26734ha5zto9l396.cpl
c:\windows\26edown5oad9r121z.exe
c:\windows\27529no5-a-virus21az.bin
c:\windows\27691hac9to5l36cz.bin
c:\windows\27a7zpars51049.bin
c:\windows\27z50wo9m6515.cpl
c:\windows\2845z9pambot1da.ocx
c:\windows\28715sp5mboz2c99.bin
c:\windows\28887vir9526z.dll
c:\windows\288e5dz9are1438.cpl
c:\windows\28911not-azvir5s29.bin
c:\windows\28ddzackdoor18599.exe
c:\windows\29258not-a9vizus755.dll
c:\windows\29331s5y757z.ocx
c:\windows\29644hazk5o9l38f.bin
c:\windows\29650spy1fz.bin
c:\windows\2980s59zbot529.bin
c:\windows\299zhacktool454.exe
c:\windows\29a8do5zloader1955.exe
c:\windows\29edbzckdoor28335.cpl
c:\windows\2a5aste9l3z12.bin
c:\windows\2bazad5ware9885.ocx
c:\windows\2d005parsez792.ocx
c:\windows\2d715irz955.bin
c:\windows\2ez9sparse26025.dll
c:\windows\2z505hacktool7c59.cpl
c:\windows\2z543not-a-virus5e9.dll
c:\windows\2z553spambo95e6.exe
c:\windows\2zbst59l1754.exe
c:\windows\30359s5y9zc.ocx
c:\windows\30956viruz6a.bin
c:\windows\30z49spy539.bin
c:\windows\31557vir9s18z5.bin
c:\windows\3211z5py698.ocx
c:\windows\32425zorm79c.bin
c:\windows\324655ackto9lez.dll
c:\windows\3251backzo593215.exe
c:\windows\3259ownloazer2279.exe
c:\windows\32752zro559d.bin
c:\windows\3413z59al1198.ocx
c:\windows\346aadd59rz973.dll
c:\windows\34azst9al9445.dll
c:\windows\3539not-9-virzs1b95.exe
c:\windows\359avzr3097.ocx
c:\windows\35c9dowzloader157.ocx
c:\windows\35d6zpy9are2738.cpl
c:\windows\35dbackdoor9958z.dll
c:\windows\3625zroj7b59.dll
c:\windows\3843worz953.cpl
c:\windows\3920spa5se446z.dll
c:\windows\39a9thief2599z.bin
c:\windows\3a0b9pywaz52150.bin
c:\windows\3bz59hief3121.cpl
c:\windows\3cz49hreat3555.exe
c:\windows\3e9bzhi5f3099.dll
c:\windows\3z0705acktool799.exe
c:\windows\3z529or59d.dll
c:\windows\3z57addware9540.ocx
c:\windows\3zc95pa9se320.cpl
c:\windows\4089viruz2f5.ocx
c:\windows\40b1zownload9r2858.exe
c:\windows\41e9downlza5er1917.dll
c:\windows\437659yware308z.dll
c:\windows\445zvi91559.exe
c:\windows\44eb5ir121z9.bin
c:\windows\44f9dow5lo9dez1144.exe
c:\windows\4513s9arze2207.cpl
c:\windows\453znot-a-virus59.dll
c:\windows\45f1szywar596.ocx
c:\windows\45febackdoor193z5.exe
c:\windows\46c3spazse2955.cpl
c:\windows\4955ha9ktzol5c.dll
c:\windows\495abaczdoor763.cpl
c:\windows\49685hzeat55309.bin
c:\windows\4999backd5orz7.dll
c:\windows\49acv9r5z57.bin
c:\windows\4d31thz5at29678.exe
c:\windows\4d69backd5or3z0.dll
c:\windows\4z65spars510609.cpl
c:\windows\503stea91z46.dll
c:\windows\5067thre9t4z765.exe
c:\windows\50719viruz9a5.ocx
c:\windows\508zthief22459.exe
c:\windows\5154vzr1992.ocx
c:\windows\51812spambotbz9.dll
c:\windows\51967vir9s16ez.cpl
c:\windows\5217hac5t9ol6z1.dll
c:\windows\5229not5a-viz9s196.ocx
c:\windows\5255thr9atz6609.cpl
c:\windows\52a9ba5kzoor659.exe
c:\windows\533289ot-a-vizus235.cpl
c:\windows\5376viruz9d2.ocx
c:\windows\539ztroj99b.dll
c:\windows\5553t9zj6aa.bin
c:\windows\556cba9kdoor2000z.bin
c:\windows\557d9parse28z3.dll
c:\windows\5599zreat5557.cpl
c:\windows\55fzbackdoor953.dll
c:\windows\56097virusz92.bin
c:\windows\5649viz15425.exe
c:\windows\56a6z9r38.cpl
c:\windows\5795tzief1564.ocx
c:\windows\57a5s9ealz129.bin
c:\windows\58903not-azvi9us7f5.dll
c:\windows\58cdthiefz059.bin
c:\windows\5915zpyware115.ocx
c:\windows\593hacktooz34.cpl
c:\windows\5941zteal2001.bin
c:\windows\599spyw9ze1685.dll
c:\windows\59adsparz92861.cpl
c:\windows\5aza5parse9773.ocx
c:\windows\5cbbth9z51522.ocx
c:\windows\5ccfvi59z53.exe
c:\windows\5ce5download9z28615.bin
c:\windows\5d2th9ez2625.dll
c:\windows\5e59zddwa9e2424.dll
c:\windows\5ea9adzwa593209.exe
c:\windows\5ezfdownlo5der5379.dll
c:\windows\5fezspar5e933.ocx
c:\windows\5z1add9are588.dll
c:\windows\5z42tr9j85.ocx
c:\windows\5z54n9t-a5virus4c0.ocx
c:\windows\5z594viru931.dll
c:\windows\5z773spy5689.cpl
c:\windows\6181backdooz957.dll
c:\windows\61z5addwa9e249.ocx
c:\windows\6264not-9-vizus58c.dll
c:\windows\639cszeal1554.cpl
c:\windows\63fdthzef1759.exe
c:\windows\6450bac5door89z.ocx
c:\windows\64e0addware955z.exe
c:\windows\6560sz9ware875.bin
c:\windows\65775tzal692.cpl
c:\windows\6599spz35a.ocx
c:\windows\65d9add9are1z57.dll
c:\windows\6659backd5zr3104.exe
c:\windows\665zhacktool3fb9.exe
c:\windows\6730a5z9are2827.exe
c:\windows\68z1t5ief8199.ocx
c:\windows\6918zi5164.ocx
c:\windows\6925thief700z.cpl
c:\windows\69ac5teal15z7.exe
c:\windows\69ddsparsz1385.ocx
c:\windows\6a53thre5t169z1.dll
c:\windows\6b56dozn5oader9609.bin
c:\windows\6b7cad95are5z8.bin
c:\windows\6bccthr59t990z.ocx
c:\windows\6cz9bac5door485.dll
c:\windows\6e4bbackd9oz1569.cpl
c:\windows\6z97hacktool135.exe
c:\windows\6za9threat56392.ocx
c:\windows\7059spars5z98.exe
c:\windows\7245threat905z6.cpl
c:\windows\73zes9eal905.ocx
c:\windows\746zviru96f5.cpl
c:\windows\7558vzr2933.bin
c:\windows\755dow9loaderz20.bin
c:\windows\75b8ad9wzr51823.exe
c:\windows\75dzdownload9r94.ocx
c:\windows\76ezspywa5e2179.dll
c:\windows\781bspy9are227z5.ocx
c:\windows\78z4tro53c9.cpl
c:\windows\79715ozm59e.dll
c:\windows\7988zot-5-viru9577.bin
c:\windows\799b5ckdoor54z.exe
c:\windows\7d19spar5ez257.ocx
c:\windows\7fb9szarse1725.dll
c:\windows\7z529parse957.bin
c:\windows\7z849o5mf5.exe
c:\windows\835h9cktooz10d.exe
c:\windows\8556v9ruszf.bin
c:\windows\8626zot-a9virus557.bin
c:\windows\8d5threaz91907.ocx
c:\windows\90267s5z351.dll
c:\windows\9105downlzader2283.cpl
c:\windows\91972troz435.dll
c:\windows\922sp5ware1z959.exe
c:\windows\9296zpa5bot5c9.cpl
c:\windows\9325not-a-z9rus4ef.exe
c:\windows\93436not-5-viruz55.cpl
c:\windows\93892spambzt55.dll
c:\windows\93dfvir5z98.dll
c:\windows\93z8s5y21c.ocx
c:\windows\940s5y7f8z.ocx
c:\windows\948spzr9e9535.dll
c:\windows\9511z5roj50d.bin
c:\windows\952ddo5nzoader2972.bin
c:\windows\953dz9nloader85.dll
c:\windows\9569acktool13z.ocx
c:\windows\95884hacktoolzb0.exe
c:\windows\969vir1z685.exe
c:\windows\97564spz75.dll
c:\windows\97650vzrus42e.exe
c:\windows\9812hack5ool69bz.bin
c:\windows\9844hzcktoo52a0.cpl
c:\windows\984a5dzware3159.ocx
c:\windows\9855tz5j579.ocx
c:\windows\987csparse3z05.ocx
c:\windows\99375zpambot50.cpl
c:\windows\995dszeal3020.exe
c:\windows\9abcad5zare2735.bin
c:\windows\9c1bbackdozr5493.exe
c:\windows\9c55steaz942.ocx
c:\windows\9ce3zhrea52993.dll
c:\windows\9d06vzr485.dll
c:\windows\9e25steal56z.bin
c:\windows\9z642spy557.dll
c:\windows\a9fthi5z241.bin
c:\windows\b43s5yw9re2589z.cpl
c:\windows\c40dzwnloader95215.ocx
c:\windows\egadetakobi.dll
c:\windows\f71down9o5der2652z.cpl
c:\windows\f8aadd5are95z.bin
c:\windows\system32\10506viru95aaz.exe
c:\windows\system32\109625roz399.cpl
c:\windows\system32\1102a5dware1z539.exe
c:\windows\system32\11099sp5mbot5efz.exe
c:\windows\system32\11511sp9z5ot5ea.cpl
c:\windows\system32\11579notza9virus183.dll
c:\windows\system32\1199par5e257z.cpl
c:\windows\system32\12915wormz9.cpl
c:\windows\system32\13450ha9ktoolzbb.bin
c:\windows\system32\13469trojz549.ocx
c:\windows\system32\13635s9z45e.cpl
c:\windows\system32\13697s5z5ba.cpl
c:\windows\system32\138b9p5rsz1457.ocx
c:\windows\system32\14322hackto59zf1.exe
c:\windows\system32\14350sp9zbote5.dll
c:\windows\system32\1452n5z-a-9irus1a9.cpl
c:\windows\system32\14845h9cktzol64.cpl
c:\windows\system32\14858tzo91f4.bin
c:\windows\system32\15329zpambot986.dll
c:\windows\system32\155ddowzloader1793.dll
c:\windows\system32\15755tro97z5.exe
c:\windows\system32\15995vi9uz3325.ocx
c:\windows\system32\159z65py8e.ocx
c:\windows\system32\15d5addzare6509.dll
c:\windows\system32\1601zh5cktool709.bin
c:\windows\system32\16725hackto5z66f9.cpl

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Thu Jun 25, 2009 7:43 pm

c:\windows\system32\1689bazkdoo52313.cpl
c:\windows\system32\16999wo5m4cez.ocx
c:\windows\system32\16z61viru55fc9.exe
c:\windows\system32\17445ha9ktoolz235.bin
c:\windows\system32\18816zp5mbot595.exe
c:\windows\system32\1914troj45z9.bin
c:\windows\system32\193865zr9677.bin
c:\windows\system32\1939zteal5869.dll
c:\windows\system32\193z3spy458.ocx
c:\windows\system32\19457spz16f.bin
c:\windows\system32\1949ste5z405.bin
c:\windows\system32\1992spzwa5e2153.dll
c:\windows\system32\1997zn9t-a-virus355.exe
c:\windows\system32\19f3downloadzr2354.cpl
c:\windows\system32\1a5adow9loazer5881.exe
c:\windows\system32\1aadad9wzre1335.ocx
c:\windows\system32\1bfa9pars5z352.bin
c:\windows\system32\1d795zarse3067.cpl
c:\windows\system32\1z363s5y935.cpl
c:\windows\system32\1z5fst5a9898.ocx
c:\windows\system32\1z6429ot5a-virus775.dll
c:\windows\system32\1z9ethief5962.bin

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Thu Jun 25, 2009 7:46 pm

c:\windows\system32\1z9ethief5962.bin
c:\windows\system32\20180worz495.bin
c:\windows\system32\2018backdooz5697.bin
c:\windows\system32\20698not-a-vi5usz93.bin
c:\windows\system32\2072s9e5l11z.cpl
c:\windows\system32\20946not-5zvirus280.dll
c:\windows\system32\20d4s59alz043.cpl
c:\windows\system32\20e9backzoo5749.dll
c:\windows\system32\2137za9ktool5b05.exe
c:\windows\system32\2152not9azvirusa5.ocx
c:\windows\system32\21596spamboz9ed5.cpl
c:\windows\system32\2205zspy2c9.ocx
c:\windows\system32\22545not-a-virus39z.dll
c:\windows\system32\229t5ief1z94.cpl
c:\windows\system32\22z95troj41b9.ocx
c:\windows\system32\2343do9nloa5erz89.dll
c:\windows\system32\23652spambotzf95.cpl
c:\windows\system32\236z3w95m1d1.cpl
c:\windows\system32\239299ot5a-vzrus6f8.ocx
c:\windows\system32\24649szy1c45.cpl
c:\windows\system32\24z4ste5l2399.dll
c:\windows\system32\2529zvi5us395.ocx
c:\windows\system32\252z9wo5m519.cpl
c:\windows\system32\25352spy3z59.dll
c:\windows\system32\25479pzrse2002.cpl
c:\windows\system32\255z69pambot568.cpl
c:\windows\system32\255ztroj5c19.dll
c:\windows\system32\25856not-z-virus27f9.bin
c:\windows\system32\258ezownl9ader859.ocx
c:\windows\system32\25943h9cktoo5zf6.cpl
c:\windows\system32\25997spazbot1955.dll
c:\windows\system32\26615hac9tooz5d6.dll
c:\windows\system32\26637nzt9a-vi5us5f5.exe
c:\windows\system32\266abzc9doo5294.cpl
c:\windows\system32\26939tro93ze5.ocx
c:\windows\system32\26z485or9540.exe
c:\windows\system32\275235a9ktooz56c.exe
c:\windows\system32\276955ackzool693.exe
c:\windows\system32\2769doznloa5er150.bin
c:\windows\system32\27afd9wnloader53z0.ocx
c:\windows\system32\27z2bac5door9199.bin
c:\windows\system32\284z0troj3579.exe
c:\windows\system32\288599pambotzc0.exe
c:\windows\system32\2892not-a-9i5uszc.dll
c:\windows\system32\29181sz95bot63d.cpl
c:\windows\system32\2936s9ywarz5121.bin
c:\windows\system32\29559hac9tool7dz.exe
c:\windows\system32\295z0spy50c9.cpl
c:\windows\system32\2962zspy4a25.ocx
c:\windows\system32\2964zspy598.exe
c:\windows\system32\296525pyzd.ocx
c:\windows\system32\29903z5rm4.dll
c:\windows\system32\2995tzreat3316.exe
c:\windows\system32\2a41downloader29z59.dll
c:\windows\system32\2eb2zte5l6179.bin
c:\windows\system32\2fc4virz9255.bin
c:\windows\system32\2z029s5y299.cpl
c:\windows\system32\2z1d9teal225.bin
c:\windows\system32\2z349spam59t443.ocx
c:\windows\system32\2z36sp59are655.ocx
c:\windows\system32\2za55hr9at5694.dll
c:\windows\system32\2zf3thie9355.cpl
c:\windows\system32\301z59ot-a-vi5us2d6.exe
c:\windows\system32\30516not-a-virus93z.exe
c:\windows\system32\305z59o5m57b.bin
c:\windows\system32\3094not-a-v5rus7dcz.exe
c:\windows\system32\30z5thief23559.bin
c:\windows\system32\31306notza-95rus33c.exe
c:\windows\system32\31999zpy585.dll
c:\windows\system32\32334worz985.cpl
c:\windows\system32\3242dow5lza9er2018.cpl
c:\windows\system32\3245tz9ef912.dll
c:\windows\system32\3395spazb9t23c.ocx
c:\windows\system32\340db5zkdoor9394.ocx
c:\windows\system32\35a6zi92889.exe
c:\windows\system32\35b8szeal195.ocx
c:\windows\system32\35z6download9r20265.bin
c:\windows\system32\3660dz5nlo9der588.dll
c:\windows\system32\3783z5rm79.bin
c:\windows\system32\3795vizus90c.dll
c:\windows\system32\3849h9cktoolz5e.cpl
c:\windows\system32\3909z5py5e5.dll
c:\windows\system32\391z5worm520.cpl
c:\windows\system32\392665azktool594.exe
c:\windows\system32\3959thief1075z.ocx
c:\windows\system32\396c5ddwzre1456.cpl
c:\windows\system32\39830virus2z5.exe
c:\windows\system32\39999ormz9d5.cpl
c:\windows\system32\39a05zckdoor2330.cpl
c:\windows\system32\39f9spyware279z5.dll
c:\windows\system32\3a59vir275z9.exe
c:\windows\system32\3ba3dzwnloader29815.exe
c:\windows\system32\3c40downloa5er27z69.cpl
c:\windows\system32\3c57zhief1091.dll
c:\windows\system32\3d7zt59ef119.bin
c:\windows\system32\3deda5dwar923z2.ocx
c:\windows\system32\3dza9h5eat10527.dll
c:\windows\system32\3e529pzware2971.ocx
c:\windows\system32\3e7bspazse1895.exe
c:\windows\system32\3e95sparze59.dll
c:\windows\system32\3f09s5arsez9889.exe
c:\windows\system32\3f60zi5395.cpl
c:\windows\system32\3z57s5y298.cpl
c:\windows\system32\3z65backdoor2589.exe
c:\windows\system32\40e9ba5kdoo92z3.bin
c:\windows\system32\40zdaddwa5e1090.cpl
c:\windows\system32\4168a5dware2z79.ocx
c:\windows\system32\41e5paz9e1184.cpl
c:\windows\system32\444eaddw9re1z75.cpl
c:\windows\system32\44895rzj9f3.dll
c:\windows\system32\450etzie9521.dll
c:\windows\system32\4511back9zor857.ocx
c:\windows\system32\4554s9y1bz.dll
c:\windows\system32\45659or5zfb.ocx
c:\windows\system32\45f5zddware5899.dll
c:\windows\system32\4695spywaz51638.cpl
c:\windows\system32\46dezir58059.dll
c:\windows\system32\4795vzr3048.cpl
c:\windows\system32\47zvi5us789.bin
c:\windows\system32\4819thze5t26432.cpl
c:\windows\system32\49095ddw9ze463.ocx
c:\windows\system32\490spamz5t1b.ocx
c:\windows\system32\4971doz5loader3120.exe
c:\windows\system32\4aaespzrse985.bin
c:\windows\system32\4azesteal5592.dll
c:\windows\system32\4b6dadd5are3z99.exe
c:\windows\system32\4bdzba5kdo9r1942.ocx
c:\windows\system32\4c53zh5ef1914.dll
c:\windows\system32\4cb1a59ware9z8.cpl
c:\windows\system32\4e2cdow5lozde93253.ocx
c:\windows\system32\4ezedownlo95er1842.ocx
c:\windows\system32\4fc1szar952618.dll
c:\windows\system32\4z66s5ars92951.ocx
c:\windows\system32\4z84backd5o92338.cpl
c:\windows\system32\4za2addwa5e3229.exe
c:\windows\system32\50289not-a-zirus3ad.cpl
c:\windows\system32\505fdownlo9dez836.dll
c:\windows\system32\5065tzreat9671.dll
c:\windows\system32\50996not-a-vzrus7a8.bin
c:\windows\system32\drivers\MSIVXoyumaqocnjndwyuxpmioxqqkllrsuvpp.sys
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXeylkdahsoddiqlsvswrihngxuvwlsubw.dll
c:\windows\system32\MSIVXyppxehbawmyluiwehuilyeubbeekpgdo.dll
c:\windows\z095spy142.exe
c:\windows\z0c6thi5f269.cpl
c:\windows\z1918s59695.bin
c:\windows\z2590wor55d9.exe
c:\windows\z284h5ckto9l1b4.bin
c:\windows\z3885spy695.bin
c:\windows\z4361tro595b.bin
c:\windows\z6145t9oj251.cpl
c:\windows\z9601hacktool9805.dll
c:\windows\z9923wo9m4b5.bin
c:\windows\z9d7thre5t15611.bin
c:\windows\z9e25parse158.exe
c:\windows\za8do5nlo9der2007.dll
c:\windows\zb95pyware3199.dll
c:\windows\ze0dsteal29085.ocx
c:\windows\ze959i52102.bin

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys


((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-06-25 )))))))))))))))))))))))))))))))
.

2009-12-21 18:05 . 2009-12-21 18:05 13600 ----a-w- c:\windows\system32\9045vzr541.exe
2009-12-20 17:50 . 2009-12-20 17:50 3403 ----a-w- c:\windows\system32\57e9spyw5re2580z.bin
2009-12-15 20:24 . 2009-12-15 20:24 11435 ----a-w- c:\windows\system32\5z744hackto9l2b6.dll
2009-12-10 21:17 . 2009-12-10 21:17 15545 ----a-w- c:\windows\system32\7189v5r9s6ez.dll
2009-12-08 21:56 . 2009-12-08 21:56 9884 ----a-w- c:\windows\system32\91539spamboz748.dll
2009-11-23 10:48 . 2009-11-23 10:48 3416 ----a-w- c:\windows\system32\ea8tzi5f3924.bin
2009-11-21 18:43 . 2009-11-21 18:43 4234 ----a-w- c:\windows\system32\581azackdoor2981.exe
2009-11-19 18:29 . 2009-11-19 18:29 12562 ----a-w- c:\windows\system32\7dz7vir5190.exe
2009-11-17 16:31 . 2009-11-17 16:31 17221 ----a-w- c:\windows\system32\759spz74b.bin
2009-10-27 02:07 . 2009-10-27 02:07 12671 ----a-w- c:\windows\system32\5950virus75z.exe
2009-10-16 21:34 . 2009-10-16 21:34 2964 ----a-w- c:\windows\system32\68z3backdoo514749.bin
2009-10-12 06:09 . 2009-10-12 06:09 16447 ----a-w- c:\windows\system32\5379backdoor8z7.exe
2009-10-10 02:38 . 2009-10-10 02:38 5327 ----a-w- c:\windows\system32\5956not-a-zirus422.exe
2009-09-20 12:21 . 2009-09-20 12:21 5151 ----a-w- c:\windows\system32\7bz7spy9are2501.bin
2009-09-08 15:04 . 2009-09-08 15:04 10861 ----a-w- c:\windows\system32\780b59zef161.exe
2009-09-04 23:24 . 2009-09-04 23:24 15983 ----a-w- c:\windows\system32\50f9st5zl1507.dll
2009-08-24 05:00 . 2009-08-24 05:00 3610 ----a-w- c:\windows\system32\91215ir1941z.dll
2009-08-07 09:01 . 2009-08-07 09:01 6072 ----a-w- c:\windows\system32\6d29vi5z095.dll
2009-08-01 10:35 . 2009-08-01 10:35 16583 ----a-w- c:\windows\system32\5239zoj553.bin
2009-07-02 12:09 . 2009-07-02 12:09 3000 ----a-w- c:\windows\system32\5452dzwnloader3990.dll
2009-06-26 17:44 . 2009-06-26 17:44 4722 ----a-w- c:\windows\system32\527z5not-a-9irus5e4.dll
2009-06-19 22:20 . 2008-12-11 13:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-19 22:19 . 2009-04-03 16:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-19 22:19 . 2008-12-18 17:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-19 22:19 . 2009-06-25 19:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-19 22:19 . 2008-12-10 16:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-19 22:19 . 2009-06-24 14:23 -------- d-----w- c:\program files\Spyware Doctor
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools
2009-06-19 20:06 . 2009-06-19 20:06 8997 ----a-w- c:\windows\system32\17286h5z9tool.bin
2009-06-19 20:06 . 2009-06-19 20:06 6287 ----a-w- c:\windows\system32\92815nzt-a-vir5s73e.bin
2009-06-19 20:06 . 2009-06-19 20:06 8730 ----a-w- c:\windows\system32\9042sp9m5oz9.bin
2009-06-19 20:06 . 2009-06-19 20:06 7684 ----a-w- c:\windows\system32\z56c9ddware2465.dll
2009-06-19 20:06 . 2009-06-19 20:06 7205 ----a-w- c:\windows\system32\z5335not-a-v59us11b.dll
2009-06-19 20:06 . 2009-06-19 20:06 3180 ----a-w- c:\windows\system32\95160hacztool478.bin
2009-06-19 20:06 . 2009-06-19 20:06 16937 ----a-w- c:\windows\system32\ef8v5z14539.bin
2009-06-18 23:22 . 2009-06-18 23:22 -------- d-----w- c:\program files\QuickTiming
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\3DVIA
2009-06-16 17:08 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-06-16 17:08 . 2006-09-28 21:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\windows\Logs
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\program files\Virtools
2009-06-16 11:34 . 2009-06-16 11:34 16235 ----a-w- c:\windows\system32\8170spa9bot5z5.exe
2009-06-13 21:51 . 2009-06-13 21:51 10137 ----a-w- c:\windows

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Thu Jun 25, 2009 7:46 pm

\system32\5e93downzo5der3114.bin
2009-05-30 21:17 . 2009-05-30 21:17 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2009-05-30 21:16 . 2009-05-30 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-30 21:15 . 2009-03-18 22:55 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-28 04:56 . 2009-06-19 23:49 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 19:05 . 2009-03-24 01:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-25 19:01 . 2009-03-24 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-25 18:53 . 2007-03-29 18:13 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-24 17:59 . 2009-06-24 17:59 11332 ----a-w- c:\windows\system32\z958worm15.dll
2009-05-30 21:15 . 2007-11-24 15:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-24 07:57 . 2009-05-24 07:57 2912 ----a-w- c:\windows\system32\ad6adz5are9007.bin
2009-05-08 08:51 . 2009-05-08 08:51 5163 ----a-w- c:\windows\system32\9fzspar5e1717.bin
2009-05-07 15:32 . 2004-08-04 08:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-04 06:13 . 2009-05-04 06:13 18264 ----a-w- c:\windows\system32\6a4dt5i9f2187z.bin
2009-05-03 22:21 . 2009-05-03 22:21 17836 ----a-w- c:\windows\system32\665fviz1947.exe
2009-04-29 04:56 . 2004-08-04 08:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-22 11:52 . 2009-04-08 17:38 0 -c--a-w- c:\windows\Wqixivegohekev.bin
2009-04-19 15:13 . 2009-04-19 15:13 152576 -c--a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 12:26 . 2004-08-04 08:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-16 02:03 . 2009-04-08 17:38 408 -c--a-w- c:\windows\Uxekap.dat
2009-04-15 14:51 . 2004-08-04 08:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-12 00:07 . 2007-11-18 23:06 39336 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-11 19:30 . 2009-04-11 19:30 3740 ----a-w- c:\windows\system32\9z69st5al1343.dll
2009-04-10 18:02 . 2009-04-10 18:02 15746 ----a-w- c:\windows\system32\c62b9ckdoorz0015.bin
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-17 344064]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2006-01-04 219648]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2001-07-25 57344]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"FlyMonitor"="c:\program files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2008-05-13 664904]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-04 185872]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-01-28 1179648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-06-12 1181576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-20 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-6-27 113664]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2007-5-13 212992]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-14 169472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\CIMSVR.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Sony\\Media Manager for PSP\\MediaManager.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/19/2009 5:19 PM 130936]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/19/2009 5:19 PM 348752]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/25/2008 5:38 PM 18560]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [4/19/2007 11:09 AM 99200]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-24 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-WebCamRT.exe - (no file)
HKLM-Run-WinBlueSoft - (no file)


.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - [You must be registered and logged in to see this link.]
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-25 14:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2526081773-1975879490-3789279395-500\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
"Percents"="0 0.1262 0.2865 0.5488 0.7695 0.8496 0.8562 0.8562 "
"Increment"=".004630"
"FRT"="b/ng5VBtutJG3eua6DQZQ2+x4XweGqKOkDOUGEzy8Hqh9qIKaYBdfQ=="
"PLCK"="EH/lMORvPVE3PuVm/Pd4KsttqhMBugpG"
"PHSH"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-25 14:37
ComboFix-quarantined-files.txt 2009-06-25 19:37

Pre-Run: 62,068,150,272 bytes free
Post-Run: 62,304,940,032 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

692 --- E O F --- 2009-06-19 15:36

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Thu Jun 25, 2009 10:55 pm

Yeah so there's the log, so whats next? Oh and by the way thanks for helping well i guess its really just you getting this stupid thing off my computer, but at any rate thanks Thank You!

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by Belahzur on Fri Jun 26, 2009 12:14 am

Now open a new notepad file.
Input this into the notepad file:

c:\windows\system32\9045vzr541.exe
c:\windows\system32\57e9spyw5re2580z.bin
c:\windows\system32\5z744hackto9l2b6.dll
c:\windows\system32\7189v5r9s6ez.dll
c:\windows\system32\91539spamboz748.dll
c:\windows\system32\ea8tzi5f3924.bin
c:\windows\system32\581azackdoor2981.exe
c:\windows\system32\7dz7vir5190.exe
c:\windows\system32\759spz74b.bin
c:\windows\system32\5950virus75z.exe
c:\windows\system32\68z3backdoo514749.bin
c:\windows\system32\5379backdoor8z7.exe
c:\windows\system32\5956not-a-zirus422.exe
c:\windows\system32\7bz7spy9are2501.bin
c:\windows\system32\780b59zef161.exe
c:\windows\system32\50f9st5zl1507.dll
c:\windows\system32\91215ir1941z.dll
c:\windows\system32\6d29vi5z095.dll
c:\windows\system32\5239zoj553.bin
c:\windows\system32\5452dzwnloader3990.dll
c:\windows\system32\527z5not-a-9irus5e4.dll
c:\windows\system32\17286h5z9tool.bin
c:\windows\system32\92815nzt-a-vir5s73e.bin
c:\windows\system32\9042sp9m5oz9.bin
c:\windows\system32\z56c9ddware2465.dll
c:\windows\system32\z5335not-a-v59us11b.dll
c:\windows\system32\95160hacztool478.bin
c:\windows\system32\ef8v5z14539.bin
c:\windows\system32\8170spa9bot5z5.exe
c:\windows\system32\5e93downzo5der3114.bin
c:\windows\system32\z958worm15.dll
c:\windows\system32\ad6adz5are9007.bin
c:\windows\system32\9fzspar5e1717.bin
c:\windows\system32\6a4dt5i9f2187z.bin
c:\windows\system32\665fviz1947.exe
c:\windows\Wqixivegohekev.bin
c:\windows\Uxekap.dat
c:\windows\system32\9z69st5al1343.dll
c:\windows\system32\c62b9ckdoorz0015.bin

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=-
"UpdatesDisableNotify"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Fri Jun 26, 2009 2:16 pm

ComboFix 09-06-25.06 - Administrator 06/26/2009 8:50.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.536 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\chrome.manifest
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\chrome\content\_cfg.js
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\chrome\content\c.js
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\chrome\content\overlay.xul
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\install.rdf
c:\windows\system32\50f9st5zl1507.dll
c:\windows\system32\514s9zal87.cpl
c:\windows\system32\51690not-a-vizus59.exe
c:\windows\system32\520csparse19z95.ocx
c:\windows\system32\5239znot-a-vi9us50.exe
c:\windows\system32\5239zoj553.bin
c:\windows\system32\52508spy395z.ocx
c:\windows\system32\527z5not-a-9irus5e4.dll
c:\windows\system32\52zevir26599.cpl
c:\windows\system32\535zvir1982.cpl
c:\windows\system32\5379backdoor8z7.exe
c:\windows\system32\53fa9dd5aze22.cpl
c:\windows\system32\5439not-z-virus212.ocx
c:\windows\system32\5452dzwnloader3990.dll
c:\windows\system32\5496back5oor1z48.ocx
c:\windows\system32\55119pzrse732.ocx
c:\windows\system32\55348v9zus2ac.dll
c:\windows\system32\5546zr955d9.dll
c:\windows\system32\555d5t9az1425.dll
c:\windows\system32\5620tr5j1z9.cpl
c:\windows\system32\569fbackdoor190z.ocx
c:\windows\system32\569tr954bz.cpl
c:\windows\system32\56z7s9yware543.ocx
c:\windows\system32\5778zor9216.bin
c:\windows\system32\579cbackdzor557.cpl
c:\windows\system32\57e9spyw5re2580z.bin
c:\windows\system32\581azackdoor2981.exe
c:\windows\system32\5850t95j1az.bin
c:\windows\system32\5927downloade5549z.cpl
c:\windows\system32\5950virus75z.exe
c:\windows\system32\5956not-a-zirus422.exe
c:\windows\system32\5984spywa5e30z3.cpl
c:\windows\system32\59bzvir570.cpl
c:\windows\system32\59c1backdooz9672.dll
c:\windows\system32\5a18downlza9er2535.ocx
c:\windows\system32\5az89ir2185.bin
c:\windows\system32\5b41s5az9e2122.bin
c:\windows\system32\5b53sz5al819.ocx
c:\windows\system32\5b6zth9eat24544.ocx
c:\windows\system32\5c9c5ackdoor9796z.dll
c:\windows\system32\5ca7thizf894.cpl
c:\windows\system32\5ccba9kdoor25z5.exe
c:\windows\system32\5de4s5yware4z9.bin
c:\windows\system32\5e93downzo5der3114.bin
c:\windows\system32\5f65spzware2169.ocx
c:\windows\system32\5f7zhief983.dll
c:\windows\system32\5z735spy9b3.bin
c:\windows\system32\5z744hackto9l2b6.dll
c:\windows\system32\6085v9r2z98.cpl
c:\windows\system32\6087zddw9re26735.ocx
c:\windows\system32\61aas9ealz5.bin
c:\windows\system32\61edstzal26159.ocx
c:\windows\system32\65baddwarez359.cpl
c:\windows\system32\65es9eal3091z.cpl
c:\windows\system32\665fviz1947.exe
c:\windows\system32\68z3backdoo514749.bin
c:\windows\system32\68zbbac9door1542.ocx
c:\windows\system32\6954vir2z90.exe
c:\windows\system32\6993downloa5ez1779.ocx
c:\windows\system32\69z8b5ckdoor578.ocx
c:\windows\system32\6a4dt5i9f2187z.bin
c:\windows\system32\6b3bad9wa5z3186.cpl
c:\windows\system32\6c5athreat914z.ocx
c:\windows\system32\6d29vi5z095.dll
c:\windows\system32\6ec2tzrea52956.exe
c:\windows\system32\6f0ezack9oor13705.cpl
c:\windows\system32\6ff5z5re9t17633.dll
c:\windows\system32\6z9download9r865.cpl
c:\windows\system32\703z5ac9door2330.dll
c:\windows\system32\70c8b9ckdoor2597z.exe
c:\windows\system32\7189v5r9s6ez.dll
c:\windows\system32\755a5tzal15539.bin
c:\windows\system32\759spz74b.bin
c:\windows\system32\7720thi5z490.cpl
c:\windows\system32\7755backdzor569.ocx
c:\windows\system32\780b59zef161.exe
c:\windows\system32\7858backdoor15z9.bin
c:\windows\system32\78z0thie51907.cpl
c:\windows\system32\790zstea52591.dll
c:\windows\system32\7995wormz5c.ocx
c:\windows\system32\79z6d5wnloader14959.ocx
c:\windows\system32\7a12thr59t5z81.bin
c:\windows\system32\7bcbthr9az36465.ocx
c:\windows\system32\7bz7spy9are2501.bin
c:\windows\system32\7dz7vir5190.exe
c:\windows\system32\7e20bazkdoor539.exe
c:\windows\system32\7e55b9ckdzor456.dll
c:\windows\system32\801spzw95e2048.cpl
c:\windows\system32\8170spa9bot5z5.exe
c:\windows\system32\81s5ywar91z78.cpl
c:\windows\system32\8232zot-9-viru5b2.exe
c:\windows\system32\9042sp9m5oz9.bin
c:\windows\system32\9045vzr541.exe
c:\windows\system32\906115rzj233.cpl
c:\windows\system32\90853not-a-virzs28a5.cpl
c:\windows\system32\91215ir1941z.dll
c:\windows\system32\91539spamboz748.dll
c:\windows\system32\9171vzr2568.cpl
c:\windows\system32\92803hazkt5ol32c.bin
c:\windows\system32\92815nzt-a-vir5s73e.bin
c:\windows\system32\9399not-z-v9rus25.ocx
c:\windows\system32\9402zir2592.dll
c:\windows\system32\95160hacztool478.bin
c:\windows\system32\9536sp5zbot9bd.exe
c:\windows\system32\9553bzckdoor963.exe
c:\windows\system32\9553spam9ot5ze.cpl
c:\windows\system32\9599spyz10.ocx
c:\windows\system32\95z7addware1622.cpl
c:\windows\system32\9705zspy30a.dll
c:\windows\system32\9752ha9ktzol2dc.exe
c:\windows\system32\9755vir234z.ocx
c:\windows\system32\9775szeal1538.bin
c:\windows\system32\98z2vir10785.dll
c:\windows\system32\9928noz-a-vi5us35e.dll
c:\windows\system32\99eds5eal2895z.bin
c:\windows\system32\9abcs5azse1366.ocx
c:\windows\system32\9c14do5nloadzr2407.bin
c:\windows\system32\9c55addware2z28.cpl
c:\windows\system32\9d075hiez675.bin
c:\windows\system32\9e0ctzre5t7193.cpl
c:\windows\system32\9ezdspyware5449.ocx
c:\windows\system32\9f3zvi51013.ocx
c:\windows\system32\9fzspar5e1717.bin
c:\windows\system32\9z69st5al1343.dll
c:\windows\system32\9zbste95331.ocx
c:\windows\system32\a05s9ywarz814.dll
c:\windows\system32\ad6adz5are9007.bin
c:\windows\system32\b81sp95ze2325.dll
c:\windows\system32\c62b9ckdoorz0015.bin
c:\windows\system32\ea8tzi5f3924.bin
c:\windows\system32\ed65ddwzre3759.bin
c:\windows\system32\ef8v5z14539.bin
c:\windows\system32\ff35i9z159.cpl
c:\windows\system32\ffedownlo9dez543.ocx
c:\windows\system32\fzcs5ar9e309.ocx
c:\windows\system32\z0319vir95299.ocx
c:\windows\system32\z1873spambot7695.ocx
c:\windows\system32\z3936s5y4d2.ocx
c:\windows\system32\z3a5st9al1785.cpl
c:\windows\system32\z486add9are18255.cpl
c:\windows\system32\z4b1t5ief394.cpl
c:\windows\system32\z506vir9s269.exe
c:\windows\system32\z5089hacktool6c2.ocx
c:\windows\system32\z518backdoor5695.cpl
c:\windows\system32\z5335not-a-v59us11b.dll
c:\windows\system32\z56c9ddware2465.dll
c:\windows\system32\z5bsteal9350.cpl
c:\windows\system32\z61dth59f462.ocx
c:\windows\system32\z6a4v59183.ocx
c:\windows\system32\z7495teal1670.dll
c:\windows\system32\z89fthreat17585.dll
c:\windows\system32\z903downloader1995.ocx
c:\windows\system32\z95539pambot464.cpl
c:\windows\system32\z9553vi9us4ce5.bin
c:\windows\system32\z958worm15.dll
c:\windows\system32\z975vir3236.bin
c:\windows\system32\z9d1vir5466.cpl
c:\windows\system32\zd30sp59are1036.cpl

.
((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-06-26 )))))))))))))))))))))))))))))))
.

2009-06-25 23:04 . 2009-06-25 23:04 -------- d-----w- c:\documents and settings\LocalService\Application Data\Yahoo!
2009-06-25 23:02 . 2009-06-25 23:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-25 19:33 . 2009-06-25 19:33 -------- d-----w- c:\windows\system32\dllcache\cache
2009-06-23 21:41 . 2009-06-17 16:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-23 21:41 . 2009-06-17 16:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-20 17:00 . 2009-06-20 17:00 -------- d-----w- c:\program files\Sun
2009-06-19 23:48 . 2009-06-26 13:47 -------- d-----w- c:\windows\system32\CatRoot2
2009-06-19 22:20 . 2008-12-11 13:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-19 22:19 . 2009-04-03 16:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-19 22:19 . 2008-12-18 17:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-19 22:19 . 2009-06-25 23:05 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-19 22:19 . 2008-12-10 16:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-19 22:19 . 2009-06-24 14:23 -------- d-----w- c:\program files\Spyware Doctor
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools
2009-06-19 20:06 . 2009-06-19 20:06 8997 ----a-w- c:\windows\system32\17286h5z9tool.bin
2009-06-19 00:21 . 2009-06-19 00:21 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-06-18 23:22 . 2009-06-18 23:22 -------- d-----w- c:\program files\QuickTiming
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\3DVIA
2009-06-16 17:08 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-06-16 17:08 . 2006-09-28 21:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\windows\Logs
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\program files\Virtools
2009-05-30 21:17 . 2009-05-30 21:17 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2009-05-30 21:16 . 2009-05-30 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-30 21:15 . 2009-03-18 22:55 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-28 04:56 . 2009-06-19 23:49 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 19:05 . 2009-03-24 01:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-25 19:01 . 2009-03-24 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-25 18:53 . 2007-03-29 18:13 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-20 17:03 . 2007-03-29 18:10 -------- d-----w- c:\program files\Java
2009-06-20 16:59 . 2009-01-11 19:50 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-19 21:05 . 2007-10-08 14:30 -------- d-----w- c:\program files\ScanSoft
2009-06-19 21:01 . 2007-03-29 18:13 -------- d-----w- c:\program files\Google
2009-06-19 20:31 . 2007-03-29 18:16 -------- d-----w- c:\program files\Compaq
2009-06-19 20:24 . 2007-10-08 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\ScanSoft
2009-06-19 15:48 . 2007-11-24 15:38 -------- d-----w- c:\program files\Yahoo!
2009-05-30 21:15 . 2007-11-24 15:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-07 15:32 . 2004-08-04 08:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-04 08:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-22 11:52 . 2009-04-08 17:38 0 -c--a-w- c:\windows\Wqixivegohekev.bin
2009-04-19 15:13 . 2009-04-19 15:13 152576 -c--a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 12:26 . 2004-08-04 08:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-16 02:03 . 2009-04-08 17:38 408 -c--a-w- c:\windows\Uxekap.dat
2009-04-15 14:51 . 2004-08-04 08:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-12 00:07 . 2007-11-18 23:06 39336 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Fri Jun 26, 2009 2:16 pm

.
+ 2009-06-25 19:33 . 2008-10-16 20:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-06-25 19:33 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-06-25 19:33 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-06-25 19:33 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-06-25 19:33 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-06-25 19:33 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-06-25 19:33 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe
+ 2009-06-25 19:33 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-06-25 19:33 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 167936 c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-06-25 19:33 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-06-25 19:33 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-17 344064]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2006-01-04 219648]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2001-07-25 57344]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"FlyMonitor"="c:\program files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2008-05-13 664904]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-04 185872]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-01-28 1179648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-06-12 1181576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-20 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-6-27 113664]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2007-5-13 212992]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-14 169472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\CIMSVR.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Sony\\Media Manager for PSP\\MediaManager.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/19/2009 5:19 PM 130936]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/19/2009 5:19 PM 348752]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/25/2008 5:38 PM 18560]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [4/19/2007 11:09 AM 99200]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-25 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ty36svtv.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-26 09:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2526081773-1975879490-3789279395-500\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
"Percents"="0 0.1262 0.2865 0.5488 0.7695 0.8496 0.8562 0.8562 "
"Increment"=".004630"
"FRT"="b/ng5VBtutJG3eua6DQZQ2+x4XweGqKOkDOUGEzy8Hqh9qIKaYBdfQ=="
"PLCK"="EH/lMORvPVE3PuVm/Pd4KsttqhMBugpG"
"PHSH"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-26 9:11
ComboFix-quarantined-files.txt 2009-06-26 14:11
ComboFix2.txt 2009-06-25 19:38

Pre-Run: 62,282,964,992 bytes free
Post-Run: 62,270,201,856 bytes free

369 --- E O F --- 2009-06-19 15:36

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by Belahzur on Sat Jun 27, 2009 1:15 am

Hello.
Still more work to do.

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\Wqixivegohekev.bin
c:\windows\Uxekap.dat

Folder::
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}

Firefox::
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ty36svtv.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Sat Jun 27, 2009 2:30 am

Ok so here is the log, are we close it doesnt seem to be as bad as it was.
ComboFix 09-06-26.02 - Administrator 06/26/2009 21:10.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.643 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

FILE ::
"c:\windows\Uxekap.dat"
"c:\windows\Wqixivegohekev.bin"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\install.rdf
c:\windows\Uxekap.dat
c:\windows\Wqixivegohekev.bin

.
((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-06-27 )))))))))))))))))))))))))))))))
.

2009-06-25 23:04 . 2009-06-25 23:04 -------- d-----w- c:\documents and settings\LocalService\Application Data\Yahoo!
2009-06-25 23:02 . 2009-06-25 23:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-25 19:33 . 2009-06-25 19:33 -------- d-----w- c:\windows\system32\dllcache\cache
2009-06-23 21:41 . 2009-06-17 16:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-23 21:41 . 2009-06-17 16:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-20 17:00 . 2009-06-20 17:00 -------- d-----w- c:\program files\Sun
2009-06-19 23:48 . 2009-06-27 02:06 -------- d-----w- c:\windows\system32\CatRoot2
2009-06-19 22:20 . 2008-12-11 13:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-19 22:19 . 2009-04-03 16:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-19 22:19 . 2008-12-18 17:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-19 22:19 . 2009-06-26 18:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-19 22:19 . 2008-12-10 16:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-19 22:19 . 2009-06-26 18:19 -------- d-----w- c:\program files\Spyware Doctor
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools
2009-06-19 20:06 . 2009-06-19 20:06 8997 ----a-w- c:\windows\system32\17286h5z9tool.bin
2009-06-18 23:22 . 2009-06-18 23:22 -------- d-----w- c:\program files\QuickTiming
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\3DVIA
2009-06-16 17:08 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-06-16 17:08 . 2006-09-28 21:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\windows\Logs
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\program files\Virtools
2009-05-30 21:17 . 2009-05-30 21:17 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2009-05-30 21:16 . 2009-05-30 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-30 21:15 . 2009-03-18 22:55 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-28 04:56 . 2009-06-19 23:49 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 19:05 . 2009-03-24 01:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-25 19:01 . 2009-03-24 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-25 18:53 . 2007-03-29 18:13 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-20 17:03 . 2007-03-29 18:10 -------- d-----w- c:\program files\Java
2009-06-20 16:59 . 2009-01-11 19:50 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-19 21:05 . 2007-10-08 14:30 -------- d-----w- c:\program files\ScanSoft
2009-06-19 21:01 . 2007-03-29 18:13 -------- d-----w- c:\program files\Google
2009-06-19 20:31 . 2007-03-29 18:16 -------- d-----w- c:\program files\Compaq
2009-06-19 20:24 . 2007-10-08 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\ScanSoft
2009-06-19 15:48 . 2007-11-24 15:38 -------- d-----w- c:\program files\Yahoo!
2009-05-30 21:15 . 2007-11-24 15:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-07 15:32 . 2004-08-04 08:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-04 08:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-19 15:13 . 2009-04-19 15:13 152576 -c--a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 12:26 . 2004-08-04 08:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 08:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-12 00:07 . 2007-11-18 23:06 39336 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-25 19:33 . 2008-10-16 20:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-06-25 19:33 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-06-25 19:33 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-06-25 19:33 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-06-25 19:33 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-06-25 19:33 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-06-25 19:33 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe
+ 2009-06-25 19:33 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-06-25 19:33 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 167936 c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-06-25 19:33 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-06-25 19:33 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe
.

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Sat Jun 27, 2009 2:31 am

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-17 344064]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2006-01-04 219648]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2001-07-25 57344]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"FlyMonitor"="c:\program files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2008-05-13 664904]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-04 185872]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-01-28 1179648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-06-12 1181576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-20 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-6-27 113664]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2007-5-13 212992]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-14 169472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\CIMSVR.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Sony\\Media Manager for PSP\\MediaManager.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/19/2009 5:19 PM 130936]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/19/2009 5:19 PM 348752]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/25/2008 5:38 PM 18560]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [4/19/2007 11:09 AM 99200]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-27 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ty36svtv.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-26 21:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2526081773-1975879490-3789279395-500\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
"Percents"="0 0.1262 0.2865 0.5488 0.7695 0.8496 0.8562 0.8562 "
"Increment"=".004630"
"FRT"="b/ng5VBtutJG3eua6DQZQ2+x4XweGqKOkDOUGEzy8Hqh9qIKaYBdfQ=="
"PLCK"="EH/lMORvPVE3PuVm/Pd4KsttqhMBugpG"
"PHSH"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-27 21:28
ComboFix-quarantined-files.txt 2009-06-27 02:27
ComboFix2.txt 2009-06-26 14:11
ComboFix3.txt 2009-06-25 19:38

Pre-Run: 62,252,212,224 bytes free
Post-Run: 62,236,213,248 bytes free

219 --- E O F --- 2009-06-19 15:36

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by Belahzur on Sat Jun 27, 2009 4:45 pm

Hello.
I missed something about this infection, there's more than one folder.

Now open a new notepad file.
Input this into the notepad file:

Folder::
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Sat Jun 27, 2009 6:23 pm

ComboFix 09-06-26.02 - Administrator 06/27/2009 13:01.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.538 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\install.rdf

.
((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-06-27 )))))))))))))))))))))))))))))))
.

2009-06-25 23:04 . 2009-06-25 23:04 -------- d-----w- c:\documents and settings\LocalService\Application Data\Yahoo!
2009-06-25 23:02 . 2009-06-25 23:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-25 19:33 . 2009-06-25 19:33 -------- d-----w- c:\windows\system32\dllcache\cache
2009-06-23 21:41 . 2009-06-17 16:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-23 21:41 . 2009-06-17 16:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-20 17:00 . 2009-06-20 17:00 -------- d-----w- c:\program files\Sun
2009-06-19 23:48 . 2009-06-27 02:32 -------- d-----w- c:\windows\system32\CatRoot2
2009-06-19 22:20 . 2008-12-11 13:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-19 22:19 . 2009-04-03 16:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-19 22:19 . 2008-12-18 17:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-19 22:19 . 2009-06-27 17:11 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-19 22:19 . 2008-12-10 16:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-19 22:19 . 2009-06-26 18:19 -------- d-----w- c:\program files\Spyware Doctor
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools
2009-06-19 20:06 . 2009-06-19 20:06 8997 ----a-w- c:\windows\system32\17286h5z9tool.bin
2009-06-18 23:22 . 2009-06-18 23:22 -------- d-----w- c:\program files\QuickTiming
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\3DVIA
2009-06-16 17:08 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-06-16 17:08 . 2006-09-28 21:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\windows\Logs
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\program files\Virtools
2009-05-30 21:17 . 2009-05-30 21:17 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2009-05-30 21:16 . 2009-05-30 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-30 21:15 . 2009-03-18 22:55 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Sat Jun 27, 2009 6:25 pm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 19:05 . 2009-03-24 01:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-25 19:01 . 2009-03-24 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-25 18:53 . 2007-03-29 18:13 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-20 17:03 . 2007-03-29 18:10 -------- d-----w- c:\program files\Java
2009-06-20 16:59 . 2009-01-11 19:50 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-19 21:05 . 2007-10-08 14:30 -------- d-----w- c:\program files\ScanSoft
2009-06-19 21:01 . 2007-03-29 18:13 -------- d-----w- c:\program files\Google
2009-06-19 20:31 . 2007-03-29 18:16 -------- d-----w- c:\program files\Compaq
2009-06-19 20:24 . 2007-10-08 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\ScanSoft
2009-06-19 15:48 . 2007-11-24 15:38 -------- d-----w- c:\program files\Yahoo!
2009-05-30 21:15 . 2007-11-24 15:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-07 15:32 . 2004-08-04 08:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-04 08:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-19 15:13 . 2009-04-19 15:13 152576 -c--a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 12:26 . 2004-08-04 08:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 08:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-12 00:07 . 2007-11-18 23:06 39336 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-27 15:31 . 2009-06-27 15:31 16384 c:\windows\Temp\Perflib_Perfdata_66c.dat
+ 2009-06-25 19:33 . 2008-10-16 20:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-06-25 19:33 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-06-25 19:33 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-06-25 19:33 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-06-25 19:33 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-06-25 19:33 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-06-25 19:33 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe
+ 2009-06-25 19:33 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-06-25 19:33 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 167936 c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-06-25 19:33 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-06-25 19:33 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-17 344064]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2006-01-04 219648]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2001-07-25 57344]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"FlyMonitor"="c:\program files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2008-05-13 664904]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-04 185872]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-01-28 1179648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-06-12 1181576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-20 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-6-27 113664]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2007-5-13 212992]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-14 169472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\CIMSVR.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Sony\\Media Manager for PSP\\MediaManager.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/19/2009 5:19 PM 130936]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/19/2009 5:19 PM 348752]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/25/2008 5:38 PM 18560]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [4/19/2007 11:09 AM 99200]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-27 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ty36svtv.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-27 13:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2526081773-1975879490-3789279395-500\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
"Percents"="0 0.1262 0.2865 0.5488 0.7695 0.8496 0.8562 0.8562 "
"Increment"=".004630"
"FRT"="b/ng5VBtutJG3eua6DQZQ2+x4XweGqKOkDOUGEzy8Hqh9qIKaYBdfQ=="
"PLCK"="EH/lMORvPVE3PuVm/Pd4KsttqhMBugpG"
"PHSH"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-27 13:19
ComboFix-quarantined-files.txt 2009-06-27 18:19
ComboFix2.txt 2009-06-27 02:28
ComboFix3.txt 2009-06-26 14:11
ComboFix4.txt 2009-06-25 19:38

Pre-Run: 62,213,152,768 bytes free
Post-Run: 62,231,228,416 bytes free

242 --- E O F --- 2009-06-19 15:36

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by Belahzur on Sat Jun 27, 2009 6:28 pm

Hello.
Please delete this file in bold:

c:\windows\system32\17286h5z9tool.bin

You aren't running Anti Virus Software

Please install Avira antivirus otherwise you won't be protected.

1) [You must be registered and logged in to see this link.]
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: WinBlue Soft..PLEASE help

Post by in deep trouble on Sat Jun 27, 2009 10:53 pm

Much Better! Thank very much, your the best Hooray!

in deep trouble
Novice
Novice

Status :
Online
Offline

Posts : 20
Joined : 2009-06-23
OS : XP

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum