winbluesoft - help!! dissertation deadline!!

View previous topic View next topic Go down

winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 9:51 am

hi,

somehow i have winbluesoft on my computor and im trying to finish my dissertation for a deadline and its driving me insane! I tried to system restore but it wouldnt, and still wont let me, even in safe mode. It also wouldnt let me download and use any malware removal programs you recommend in other posts. i used a program called smitfraudfix in 'safe mode' and this stopped winbluesoft popping up every 2 seconds, but it still diverts my webpages a lot of the time and freezes my computor. ideally i want to completely wipe my computor anyway (start a fresh and all that) and 'clone' all my files onto my external hard drive. But now a program called 'hdclone' i downloaded to do this (which worked before the winbluesoft saga) wont recognise my hard drive or external hard drive! is there any other free cloning programs you recommend aswell? and can you please please help me to make everything work again!! also when following the steps you recommend before using hijakthis 'windowsupdate wouldnt work and it wouldnt let me on the website?!

heres the hijakthis file: THANKYOU SO MUCH, LEGENDS!!!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:34:54, on 30/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Glyn\Desktop\HiJack(GP)This.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\Glyn\tfcy.exe \s
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1noarp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - [You must be registered and logged in to see this link.]
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{0FDAE943-E5B0-43FC-9C38-29BE065A7C87}: NameServer = 85.255.112.206,85.255.112.116
O17 - HKLM\System\CCS\Services\Tcpip\..\{86E54812-F66F-414D-A849-031C372CB266}: NameServer = 85.255.112.206,85.255.112.116
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.206,85.255.112.116
O17 - HKLM\System\CS1\Services\Tcpip\..\{0FDAE943-E5B0-43FC-9C38-29BE065A7C87}: NameServer = 85.255.112.206,85.255.112.116
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.206,85.255.112.116
O17 - HKLM\System\CS2\Services\Tcpip\..\{0FDAE943-E5B0-43FC-9C38-29BE065A7C87}: NameServer = 85.255.112.206,85.255.112.116
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.206,85.255.112.116
O17 - HKLM\System\CS3\Services\Tcpip\..\{0FDAE943-E5B0-43FC-9C38-29BE065A7C87}: NameServer = 85.255.112.206,85.255.112.116
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.206,85.255.112.116
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 9688 bytes

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by Belahzur on Tue Jun 30, 2009 10:39 am

Hello.

  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\Glyn\tfcy.exe \s
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0FDAE943-E5B0-43FC-9C38-29BE065A7C87}: NameServer = 85.255.112.206,85.255.112.116
    O17 - HKLM\System\CCS\Services\Tcpip\..\{86E54812-F66F-414D-A849-031C372CB266}: NameServer = 85.255.112.206,85.255.112.116
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.206,85.255.112.116
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0FDAE943-E5B0-43FC-9C38-29BE065A7C87}: NameServer = 85.255.112.206,85.255.112.116
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.206,85.255.112.116
    O17 - HKLM\System\CS2\Services\Tcpip\..\{0FDAE943-E5B0-43FC-9C38-29BE065A7C87}: NameServer = 85.255.112.206,85.255.112.116
    O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.206,85.255.112.116
    O17 - HKLM\System\CS3\Services\Tcpip\..\{0FDAE943-E5B0-43FC-9C38-29BE065A7C87}: NameServer = 85.255.112.206,85.255.112.116
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.206,85.255.112.116


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 11:54 am

I performed hijackthis and checked the appropriate boxes you requested. anti malware wont run when i click or right click and open! aaaaaaaagh!

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by Belahzur on Tue Jun 30, 2009 12:33 pm

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV. (AVG8)
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 1:48 pm

here you go. it was too big to send as one part so its split across 3 posts! anything else i need to do to get it all fine again?

ComboFix 09-06-29.04 - Glyn 30/06/2009 14:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.618 [GMT 1]
Running from: c:\documents and settings\Glyn\My Documents\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Glyn\Start Menu\Programs\DigitalLabs
c:\documents and settings\Glyn\Start Menu\Programs\DigitalLabs\Uninstall.lnk
c:\program files\DigitalLabs
c:\program files\DigitalLabs\Uninstall.exe
c:\program files\seekmo
c:\windows\1029b5ckdoor3097z.exe
c:\windows\103839pa5bzt55.cpl
c:\windows\105529zy247.exe
c:\windows\1151not-a5zirusd9.exe
c:\windows\1175495rm4z8.bin
c:\windows\1181znot-a-vir9s4995.dll
c:\windows\1195vizus3db.dll
c:\windows\12309sp5mbzt62d.bin
c:\windows\12656sp5za19.cpl
c:\windows\12917not5a-vizuseb9.bin
c:\windows\12952not-z-viru975f.cpl
c:\windows\12z1ad5war9573.dll
c:\windows\12z55troj1039.cpl
c:\windows\13459spambot9f3z.cpl
c:\windows\13a9downzoad5r3190.bin
c:\windows\14015not5a-viru97zd.bin
c:\windows\14153not-a9vzrus1b1.bin
c:\windows\141zs5yware1958.ocx
c:\windows\14267sza5bot394.exe
c:\windows\14539zpy493.dll
c:\windows\15096sp9mboz1355.bin
c:\windows\1531z5ot-a-virus4d99.cpl
c:\windows\1584zspambo5490.ocx
c:\windows\15916not5a-virus631z.bin
c:\windows\15949t59j24z.ocx
c:\windows\16163wz5m39a9.dll
c:\windows\16783spa5bzt9e.ocx
c:\windows\17544spambzt793.dll
c:\windows\17582not-a-vz9us63a.ocx
c:\windows\1805trzj4529.ocx
c:\windows\1824ste9lz5945.dll
c:\windows\18512vzr9s245.exe
c:\windows\18518vir9z14d.cpl
c:\windows\1879zspambot509.exe
c:\windows\189269roz615.ocx
c:\windows\18d5pywarez093.bin
c:\windows\19055ir19z0.exe
c:\windows\1907zs9y159.dll
c:\windows\19151s5ambzt50e.exe
c:\windows\1915baczdoor9448.dll
c:\windows\19692sp5mzo9392.exe
c:\windows\19709spzmbot2559.exe
c:\windows\197259orm6adz.exe
c:\windows\19769spy51z5.bin
c:\windows\198fbazkdoo523619.bin
c:\windows\199195py1dbz.ocx
c:\windows\19919not-a-virzs755.ocx
c:\windows\199fste5l155z.ocx
c:\windows\19ebazkd5or1674.exe
c:\windows\19z96t59j418.cpl
c:\windows\1cb7threa91z052.exe
c:\windows\1cdf9teaz5707.exe
c:\windows\1de2sparz92596.ocx
c:\windows\1fc9zown5oader1808.cpl
c:\windows\1fz5vir9598.bin
c:\windows\1z059hackto5l199.cpl
c:\windows\1z29parse5357.dll
c:\windows\1z577spy397.bin
c:\windows\1z6espa9se751.exe
c:\windows\1z71not-a-virus9695.exe
c:\windows\209395i9zs697.cpl
c:\windows\211045orz729.bin
c:\windows\213no5-a-v9ruszda.dll
c:\windows\217035ackto9z664.ocx
c:\windows\2195hack5ooz689.dll
c:\windows\22539zi5us3ce.ocx
c:\windows\225645acztoo9585.exe
c:\windows\226bthze9t212795.exe
c:\windows\22909hacktool5az.ocx
c:\windows\232z4spy59c.exe
c:\windows\23566nz9-a-virus609.ocx
c:\windows\235bsz9rse3032.ocx
c:\windows\23829pyaz5.bin
c:\windows\23da95eal174z.cpl
c:\windows\23z98virus64b5.ocx
c:\windows\2416ztr9j1435.exe
c:\windows\25057zp5mbot7bf9.ocx
c:\windows\251819izus7df.exe
c:\windows\25359worm1z1.ocx
c:\windows\25426zp9mbot7285.dll
c:\windows\2559zworm29e.ocx
c:\windows\25606v5zus3c69.bin
c:\windows\2598zir1652.dll
c:\windows\2599tzoj75a.bin
c:\windows\25ee9ownloazer1192.bin
c:\windows\25z9worm17a.bin
c:\windows\2629s5ywarz2599.cpl
c:\windows\26315sz9208.ocx
c:\windows\2653zworm195.ocx
c:\windows\26779zro539.cpl
c:\windows\28331zot-a-vi9u5548.dll
c:\windows\2835znot-a-viru94a1.bin
c:\windows\288bdow9lozder2075.exe
c:\windows\28949vi5uzdc.exe
c:\windows\28acthizf9995.cpl
c:\windows\28b4baz9door2855.ocx
c:\windows\29186zirus6539.bin
c:\windows\293z2sp9mbo5194.cpl
c:\windows\2955spaz9e1056.ocx
c:\windows\29759vizus759.cpl
c:\windows\2992spy555z.dll
c:\windows\29998hackt5zl74a.ocx
c:\windows\29z75acktool3c6.bin
c:\windows\2c03backdooz25095.bin
c:\windows\2c0add95re497z.ocx
c:\windows\2c485ownloa9ez1705.bin
c:\windows\2d09spar5z2760.exe
c:\windows\2ed5thiez32479.ocx
c:\windows\2f26a9dwarz5283.dll
c:\windows\2fc9sp5zare9031.cpl
c:\windows\2z1259roj4ac5.ocx
c:\windows\2z171t9o540d.ocx
c:\windows\2z696spamb5t3009.bin
c:\windows\302895ackto9l60z.dll
c:\windows\30ddsp5r9e1702z.bin
c:\windows\31319vzrus5da.cpl
c:\windows\31549virus167z.bin
c:\windows\31927nzt-a-vir5s196.exe
c:\windows\319bdow5zoader1659.bin
c:\windows\31f4zh5ef1699.cpl
c:\windows\31z19tr9j3565.dll
c:\windows\3231backdozr5394.exe
c:\windows\32325spambzt5bd9.cpl
c:\windows\32580wo9z53c.dll
c:\windows\330sp95arz1885.dll
c:\windows\345at9ief40z.dll
c:\windows\3479d5wzloader2972.dll
c:\windows\3490t5iez953.bin
c:\windows\34z9not9a-vir5s1ba.dll
c:\windows\3559w9rm404z.ocx
c:\windows\356b9ownlzader1694.ocx
c:\windows\3577spamzo95c2.dll
c:\windows\3593addwarez8815.dll
c:\windows\3593doznloade92108.bin
c:\windows\35db9ackd5zr392.exe
c:\windows\35e7threat1z942.exe
c:\windows\3616threa9z589.cpl
c:\windows\3739stea9z7065.bin
c:\windows\38z49tea51168.exe
c:\windows\3b5eadd9are1816z.ocx
c:\windows\3c57zparse1095.ocx
c:\windows\3c5asteaz1095.bin
c:\windows\3cat9iez24505.cpl
c:\windows\3cd5a9dwarz2025.exe
c:\windows\3dbszy5ar91750.exe
c:\windows\3e29backdoor5434z.exe
c:\windows\3z46downloader3594.cpl
c:\windows\41495pyzare1978.bin
c:\windows\418czackdo9r5375.cpl
c:\windows\4599threatz2594.cpl
c:\windows\45devzr9575.bin
c:\windows\4633s5ambo945fz.bin
c:\windows\4681viru519cz.dll
c:\windows\48c5stez9926.exe
c:\windows\48zn5t-a-viru9352.cpl
c:\windows\498aspyware5z069.exe
c:\windows\49aatzr59t2318.cpl
c:\windows\4a0atzie95216.ocx
c:\windows\4a6athr5az33299.cpl
c:\windows\4az6addw95e987.cpl
c:\windows\4bbzthr9at78825.bin
c:\windows\4c5spywzr91424.dll
c:\windows\4d90zownloade95042.ocx
c:\windows\5003tro925z.bin
c:\windows\501nzt5a-vir9s2e5.bin
c:\windows\50b0backdozr8229.cpl
c:\windows\50fethr9at25857z.bin
c:\windows\50z0threa919946.cpl
c:\windows\50z19s9y71b.cpl
c:\windows\512bspzrse9705.bin
c:\windows\512z0spy1ed9.dll
c:\windows\512z59r146.cpl
c:\windows\51916wo9m377z.dll
c:\windows\51fcdo9nzoader2874.exe
c:\windows\5229zteal19815.cpl
c:\windows\52c5thr9atz325.exe
c:\windows\52z2virus591.exe
c:\windows\53079t5al1z19.exe
c:\windows\5352tzi9f1721.exe
c:\windows\53579virzs6e49.ocx
c:\windows\5366hackto59zb.dll
c:\windows\5386n9t-a-virus7za.ocx
c:\windows\53925ackdooz332.cpl
c:\windows\539bdownloadzr32265.bin
c:\windows\5401th95fz144.cpl
c:\windows\5454sp5rs92z3.dll
c:\windows\54559spambot33az.exe
c:\windows\5457vir9z2b6.cpl
c:\windows\546ath59at509z.cpl
c:\windows\54z99spambot2a0.cpl
c:\windows\55209py5z9.cpl
c:\windows\554c9hreat3134z.dll
c:\windows\5569spz1f1.bin
c:\windows\55addw9re2885z.cpl
c:\windows\55b9thiez1925.exe
c:\windows\5642zworm4b39.bin
c:\windows\567zspywar91675.bin
c:\windows\56afthreat282z9.dll
c:\windows\56bz9ddware3042.dll
c:\windows\56z9back59or1698.cpl
c:\windows\578dadd9are3z58.ocx
c:\windows\57988virusz15.dll
c:\windows\57998zpambota9.dll
c:\windows\57c1spar9ez76.ocx
c:\windows\57eddow9zoade5332.ocx
c:\windows\57z27troj4f9.bin
c:\windows\5832szarse903.cpl
c:\windows\586319izus9a.exe
c:\windows\59165parse1z2.dll
c:\windows\592z89irus71d.dll
c:\windows\5939tzief26545.cpl
c:\windows\59529spz6eb.dll
c:\windows\5953sza5bot176.dll
c:\windows\5959download5r1z31.dll
c:\windows\599c5hreat29z47.exe
c:\windows\59bbstea92z98.cpl
c:\windows\59des9azs51900.bin
c:\windows\59sz5ware9342.bin
c:\windows\59z19ddwa5e3048.dll
c:\windows\5a59thze91972.exe
c:\windows\5a91sp95zre1391.exe
c:\windows\5a9athzef1945.ocx
c:\windows\5b1szars55069.bin
c:\windows\5b2ftz9ef2922.exe
c:\windows\5b9d9ownlo5der543z.exe
c:\windows\5bc5addw9re30z9.dll
c:\windows\5czcsp5ware1269.exe
c:\windows\5d45t9iefz535.ocx
c:\windows\5ebdspy9arz2536.cpl
c:\windows\5ec4spyw9re15z1.dll
c:\windows\5f65d9wnzoader448.dll
c:\windows\5fbste9z55.bin
c:\windows\5ff0thiez9612.cpl
c:\windows\5fz5downloade916.exe
c:\windows\5z01spy30d9.ocx
c:\windows\5z29backdoor99.exe
c:\windows\609ctzie59839.dll
c:\windows\60a8zpy9are5579.dll
c:\windows\625edownloader99z5.exe
c:\windows\626spamb592az.ocx
c:\windows\6511spz975.ocx
c:\windows\653z5ackto9l3ac.exe
c:\windows\658zs9arse346.bin
c:\windows\65f5b5zkd9or1543.dll
c:\windows\65f9sparse155z.exe
c:\windows\6608vir596z.dll
c:\windows\68369acz5oor2162.ocx
c:\windows\69ae9pyzare2358.ocx
c:\windows\6b5sparsez5129.exe
c:\windows\6c54thief9750z.dll
c:\windows\6d29spywar5z59.exe
c:\windows\6e7do5n9oaderz754.ocx
c:\windows\6e9backd9o5456z.bin
c:\windows\6fd8sp9zs51529.cpl
c:\windows\7155not-z5virus6399.exe
c:\windows\72z9spyware2535.ocx
c:\windows\7358backdo9rz150.bin
c:\windows\73e29ownlo5derz948.dll
c:\windows\752bdow5l9aderz4.exe
c:\windows\7530steaz25595.exe
c:\windows\7555thie9z349.dll
c:\windows\75c2d5wnl9adez2776.bin
c:\windows\75f9d5wnloader3z69.cpl
c:\windows\765z9hief2152.ocx
c:\windows\76a4zhrea517991.ocx
c:\windows\774zdown9oade52630.exe
c:\windows\79v5r1495z.ocx
c:\windows\7e60adzwar91775.dll
c:\windows\7e72sp9w5rez502.bin
c:\windows\7za9b9c5door3240.dll
c:\windows\809troj257z.cpl
c:\windows\82fdownlo59erz871.bin
c:\windows\83ab9ckdoo5z105.cpl
c:\windows\8501w9rm6za.dll
c:\windows\8919zot-a-virus2a55.exe
c:\windows\8945zp5980.ocx
c:\windows\89z8trojd5.cpl
c:\windows\901spzwar52990.cpl
c:\windows\902z5tr5j10.exe
c:\windows\91250spy3faz.exe
c:\windows\9183threat3051z.cpl
c:\windows\91cszyware573.ocx
c:\windows\91dv5r27z9.ocx
c:\windows\91fadzw5re2778.dll
c:\windows\92037hackto5l5b4z.dll
c:\windows\928fspywarez65.cpl
c:\windows\92avi5z359.exe
c:\windows\93125oz-9-virus4a9.bin
c:\windows\9351worm4f9z.ocx
c:\windows\938zs5ambot5ff.ocx
c:\windows\93911tzoj575.exe
c:\windows\93fadzw5r91901.exe
c:\windows\953viz1995.bin
c:\windows\9557thiefz935.ocx
c:\windows\955spa5bot23z.bin
c:\windows\956virus19z5.ocx
c:\windows\95cc5hreatz8696.ocx
c:\windows\95fdthreat2245z.exe
c:\windows\95z0s5ydc.dll
c:\windows\95z8v9rus155.bin
c:\windows\9694z5py7ad.dll
c:\windows\98130vizus5c5.dll
c:\windows\98358zpy332.dll
c:\windows\98395zief517.cpl
c:\windows\98b4t5iez348.cpl
c:\windows\99089pambot5z3.ocx
c:\windows\9945hacktzol74e.dll
c:\windows\99675worm2z.dll
c:\windows\99z93s5ambot24a.dll
c:\windows\9a9es5ezl2919.dll
c:\windows\9bbfthreatz56235.exe
c:\windows\9e15steaz1132.dll
c:\windows\9e4down9oaderz25.cpl
c:\windows\9e945dzware2941.ocx
c:\windows\9f67backdoor1z85.dll
c:\windows\9z5pars91673.dll
c:\windows\b58dowzlo9der2773.bin
c:\windows\b95vir1z15.dll
c:\windows\c41bzck9oor21725.ocx
c:\windows\c63spyz9re1571.exe
c:\windows\ez85ir12929.dll
c:\windows\fc9b5ckdoor1z80.bin
c:\windows\fd39d5waze679.cpl
c:\windows\kb913800.exe


Last edited by glyn.cosford on Tue Jun 30, 2009 1:52 pm; edited 1 time in total

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 1:50 pm

c:\windows\system32\10391not-a-vir9z5fd.bin
c:\windows\system32\1078zs5y219.exe
c:\windows\system32\10869s95mzot488.ocx
c:\windows\system32\1096th95az26329.cpl
c:\windows\system32\10z83hac5tool1039.exe
c:\windows\system32\10z95spambo54899.cpl
c:\windows\system32\11620hackt9oz775.ocx
c:\windows\system32\11679zirus5f19.ocx
c:\windows\system32\11789not-5-virus62z.exe
c:\windows\system32\11959tzo5744.cpl
c:\windows\system32\12055wo9m4z4.dll
c:\windows\system32\12533viru95cez.dll
c:\windows\system32\127385zoj6c9.cpl
c:\windows\system32\1315ztr9j693.dll
c:\windows\system32\1338thi95297z.dll
c:\windows\system32\133z5hack5oo9497.exe
c:\windows\system32\13841s5y49dz.ocx
c:\windows\system32\13b7spyzare3975.exe
c:\windows\system32\14060hackt5oz4569.cpl
c:\windows\system32\1489zhac5tool96.bin
c:\windows\system32\14z15w9rm103.bin
c:\windows\system32\151bdoznloade92394.exe
c:\windows\system32\15488hacktool59z.exe
c:\windows\system32\1551s9y634z.exe
c:\windows\system32\15526wzrm98c5.cpl
c:\windows\system32\15557s9yd4z.bin
c:\windows\system32\15579tr5z495.dll
c:\windows\system32\15935trzj96d.exe
c:\windows\system32\15999pyzare1936.dll
c:\windows\system32\159fzpyware24.bin
c:\windows\system32\170z5te9l1866.ocx
c:\windows\system32\18039za5ktool359.bin
c:\windows\system32\1805addwaze5969.cpl
c:\windows\system32\184dszywar9755.cpl
c:\windows\system32\186649izus755.exe
c:\windows\system32\18e9zi512639.bin
c:\windows\system32\1905thzef1560.bin
c:\windows\system32\1911not9a-ziru559c.exe
c:\windows\system32\1915addware93z25.cpl
c:\windows\system32\19194hzcktool43d5.ocx
c:\windows\system32\1979tzief22455.ocx
c:\windows\system32\199z4s9y145.bin
c:\windows\system32\19c8d5znloader2337.exe
c:\windows\system32\1a35thie92z94.exe
c:\windows\system32\1b3av9z458.bin
c:\windows\system32\1b5bthzef2911.exe
c:\windows\system32\1c019pyware1354z.dll
c:\windows\system32\1d7athre5t948z3.cpl
c:\windows\system32\1de5th9eat91z1.bin
c:\windows\system32\1dzth5eat29949.cpl
c:\windows\system32\1e71bac9door59z5.exe
c:\windows\system32\1e7dthrzat5922.bin
c:\windows\system32\1e82viz25289.cpl
c:\windows\system32\1e9avir258z.ocx
c:\windows\system32\1f7dsp9rs5448z.bin
c:\windows\system32\1z2589pambot580.exe
c:\windows\system32\1z548h9ckt5ol65c.dll
c:\windows\system32\1z624s5y1529.bin
c:\windows\system32\1z699ddware257.exe
c:\windows\system32\1z775worm3029.cpl
c:\windows\system32\1z875tro56489.dll
c:\windows\system32\1z908virus25.dll
c:\windows\system32\1z942s5am9ot2f3.ocx
c:\windows\system32\1zd59own5oader2955.exe
c:\windows\system32\1ze69ddware5278.dll
c:\windows\system32\20285wzrm5569.exe
c:\windows\system32\20356spazbot6f9.dll
c:\windows\system32\20641not-azvir59216.dll
c:\windows\system32\20z73s9y575.cpl
c:\windows\system32\2166959yz8c.bin
c:\windows\system32\2186s59zbot60d.cpl
c:\windows\system32\219099pzmbo55f9.cpl
c:\windows\system32\21950n9z-a-virus769.dll
c:\windows\system32\2259zo9m95.dll
c:\windows\system32\225z05rojde9.cpl
c:\windows\system32\22799vz9us3b85.ocx
c:\windows\system32\22d9szarse20599.cpl
c:\windows\system32\2309z9r5j3fb.dll
c:\windows\system32\2369do5nlzader3915.bin
c:\windows\system32\23825not-9-virusz8f.bin
c:\windows\system32\23ddthr9az56381.dll
c:\windows\system32\2411az9ware8515.exe
c:\windows\system32\24537spz9aa.bin
c:\windows\system32\24927hacktozl5d5.cpl
c:\windows\system32\2504thz9at2275.exe
c:\windows\system32\2520ztroj99c.cpl
c:\windows\system32\254z85ackt9ol7ff.dll
c:\windows\system32\2555w9rm2az.cpl
c:\windows\system32\25645virusz379.dll
c:\windows\system32\256ba5k9oor244z.bin
c:\windows\system32\25839zr1761.exe
c:\windows\system32\25c9sparz9693.exe
c:\windows\system32\2600th9e5t15z0.bin
c:\windows\system32\26369zp55c2.ocx
c:\windows\system32\26392hacktoz92ee5.exe
c:\windows\system32\26418troz695.ocx
c:\windows\system32\26550notza9virus731.bin
c:\windows\system32\26596szambot1725.dll
c:\windows\system32\26597vizus42f.cpl
c:\windows\system32\267z5hacktool5c99.cpl
c:\windows\system32\271945ot-a-virus45fz.bin
c:\windows\system32\2753zwor939d.dll
c:\windows\system32\27574wz9m555.ocx
c:\windows\system32\28360vi95s7z2.ocx
c:\windows\system32\28598worm23z.bin
c:\windows\system32\28973n5t-a-viruz78e.dll
c:\windows\system32\28z12n5t-a9virus506.dll
c:\windows\system32\29090nz5-a-virus29d.exe
c:\windows\system32\29230spamzot5b5.bin
c:\windows\system32\2929spywarz1265.ocx
c:\windows\system32\292z0spambot543.dll
c:\windows\system32\2939viz3552.exe
c:\windows\system32\29751vir9s39z.ocx
c:\windows\system32\29942w5rz22a.exe
c:\windows\system32\2a9bbackz5or994.dll
c:\windows\system32\2b3f9iz2579.exe
c:\windows\system32\2b59thzeat319395.ocx
c:\windows\system32\2b66backd5o9z95.exe
c:\windows\system32\2b6fb5ckdzo9114.bin
c:\windows\system32\2cz3ad9ware5970.dll
c:\windows\system32\2debszywa5e2549.ocx
c:\windows\system32\2f5dth9efz525.cpl
c:\windows\system32\2z072not-a-5irus1f9.cpl
c:\windows\system32\2z433worma59.bin
c:\windows\system32\2z680vi9us5945.ocx
c:\windows\system32\2z896hac5tool69f.bin
c:\windows\system32\2z89virus25e.dll
c:\windows\system32\2z939spambot5ae.cpl
c:\windows\system32\301zsteal5259.dll
c:\windows\system32\3039downloa9er315z.ocx
c:\windows\system32\3079n5t-a-zirus68d.bin
c:\windows\system32\30835tr5jzfb9.bin
c:\windows\system32\31329noz-a-vir9s15b.dll
c:\windows\system32\31352zro963c.ocx
c:\windows\system32\31568hack9ozl254.cpl
c:\windows\system32\325185azkt9ol483.cpl
c:\windows\system32\32fzsteal29895.ocx
c:\windows\system32\32z91n9t-a-virus454.bin
c:\windows\system32\33wo9z517.exe
c:\windows\system32\3487spam59t34z.cpl
c:\windows\system32\348dbzckd9or265.exe
c:\windows\system32\34a8sz5war9347.exe
c:\windows\system32\35188worm679z.dll
c:\windows\system32\353fs5y9are2z98.bin
c:\windows\system32\3547szamb9t7aa.cpl
c:\windows\system32\3715sz59se443.cpl
c:\windows\system32\38369zo5689.dll
c:\windows\system32\389bthreatz0855.exe
c:\windows\system32\391z4virus353.cpl
c:\windows\system32\399zspywar52196.cpl
c:\windows\system32\39c5spyware2954z.ocx
c:\windows\system32\3b55zhief2592.dll
c:\windows\system32\3b99backdzor3522.ocx
c:\windows\system32\3cf7spz9ar5353.cpl
c:\windows\system32\3e8fzackdoo927845.bin
c:\windows\system32\3fbbdownlo9der35z0.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\4173spa9zot6585.cpl
c:\windows\system32\4194zir1495.dll
c:\windows\system32\4227st5zl393.exe
c:\windows\system32\4285ba5z9oor2205.cpl
c:\windows\system32\42z0stea59268.dll
c:\windows\system32\430zhac5tool990.exe
c:\windows\system32\4465bzck9oor3257.bin
c:\windows\system32\4493zddw5re208.ocx
c:\windows\system32\4505zpyware5319.bin
c:\windows\system32\451e9hief138z.bin
c:\windows\system32\47dz5t9al1786.cpl
c:\windows\system32\47f4azdwa9e5312.bin
c:\windows\system32\48155ddwarz2997.bin
c:\windows\system32\482espars52419z.ocx
c:\windows\system32\484fba9kdzor375.cpl
c:\windows\system32\4952thzef10.dll
c:\windows\system32\49645pzrse2035.bin
c:\windows\system32\4988add9ar5218z.exe
c:\windows\system32\49d35a9kdooz148.dll
c:\windows\system32\49f9vzr3095.dll
c:\windows\system32\49fe5pywaze2099.dll
c:\windows\system32\4aczsteal7935.ocx
c:\windows\system32\4cbdba5kdoo9463z.dll
c:\windows\system32\4d52dzwnloader2995.dll
c:\windows\system32\4d9d5parse316z.ocx
c:\windows\system32\4fc59zarse1807.cpl
c:\windows\system32\4z15thi9f2431.bin
c:\windows\system32\500not-azvirus4e9.ocx
c:\windows\system32\50667wozm259.ocx
c:\windows\system32\5078szam9oteb.ocx
c:\windows\system32\50b8th9ez2722.cpl
c:\windows\system32\515e9parse59z.bin
c:\windows\system32\5180zpars9858.dll
c:\windows\system32\522dvir94z5.exe
c:\windows\system32\52769zckdoo51749.dll
c:\windows\system32\5336st5a9732z.dll
c:\windows\system32\53z5v9rus30d.bin
c:\windows\system32\545zv5r1394.bin
c:\windows\system32\54995hi9z2454.bin
c:\windows\system32\54bcst5al9z93.dll
c:\windows\system32\5523thie9299z.bin
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\drivers\MSIVXqrssrfvkiesrriamqmobwrxqaluseila.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\kr_done1
c:\windows\system32\lsprst7.dll
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXlaiqqhymugwvjooebwapxrqaoejyuekw.dll
c:\windows\system32\MSIVXnvdvfriatbqyxweiaoqxytqlewrvpwxl.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\ssprs.dll
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
c:\windows\z02ft9ie525.ocx
c:\windows\z0579virus5e49.cpl
c:\windows\z097virus25.bin
c:\windows\z1085v9rus598.ocx
c:\windows\z1722hackt9ol35f.exe
c:\windows\z1779spy45d.dll
c:\windows\z18fd95nloader1207.ocx
c:\windows\z21059acktool6cd.ocx
c:\windows\z244backd5o91565.cpl
c:\windows\z255spyw5re25009.bin
c:\windows\z3491tr5j9a2.cpl
c:\windows\z4817tr9j115.cpl
c:\windows\z559steal2469.ocx
c:\windows\z581viru9113.dll
c:\windows\z5859hacktool8f9.dll
c:\windows\z596downloader134.dll
c:\windows\z5e5backd9or2125.ocx
c:\windows\z6a9addw5re153.bin
c:\windows\z7939p5mbot660.ocx
c:\windows\z8258not9a-virus4c15.cpl
c:\windows\z9096spy45.exe
c:\windows\z915not-9-virus4dc.ocx
c:\windows\z9248vi5us25b.cpl
c:\windows\z970downloa5er2146.ocx
c:\windows\z998s5y3ff.ocx
c:\windows\z9c5vir212.exe
c:\windows\za3b5ckdoor2039.cpl
c:\windows\zf05thi9f1820.dll
c:\windows\zfffv5r2995.exe

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 1:51 pm

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys


((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-30 )))))))))))))))))))))))))))))))
.

2009-12-22 02:08 . 2009-12-22 02:08 15792 ----a-w- c:\windows\system32\6a82v9r35z.bin
2009-12-02 07:15 . 2009-12-02 07:15 8871 ----a-w- c:\windows\system32\6c1cste9553z.bin
2009-11-20 20:08 . 2009-11-20 20:08 4092 ----a-w- c:\windows\system32\593ztroj1e9.exe
2009-11-20 05:33 . 2009-11-20 05:33 14169 ----a-w- c:\windows\system32\z4d7do9nloade52887.exe
2009-11-17 19:45 . 2009-11-17 19:45 2844 ----a-w- c:\windows\system32\58595ot-a-virusz90.dll
2009-11-14 20:15 . 2009-11-14 20:15 11178 ----a-w- c:\windows\system32\z9953s9am5ot21e.dll
2009-10-27 02:12 . 2009-10-27 02:12 14981 ----a-w- c:\windows\system32\z9350tr9519.dll
2009-10-25 22:29 . 2009-10-25 22:29 2853 ----a-w- c:\windows\system32\z6f3stea53197.bin
2009-10-05 21:38 . 2009-10-05 21:38 9069 ----a-w- c:\windows\system32\92z55hacktool73.exe
2009-09-20 02:11 . 2009-09-20 02:11 5243 ----a-w- c:\windows\system32\715fth9ezt27440.bin
2009-09-15 13:32 . 2009-09-15 13:32 16865 ----a-w- c:\windows\system32\z5849troj7d9.bin
2009-09-09 02:16 . 2009-09-09 02:16 16789 ----a-w- c:\windows\system32\zb9ethief5406.exe
2009-09-02 13:16 . 2009-09-02 13:16 6646 ----a-w- c:\windows\system32\9d75sparze2777.dll
2009-08-21 16:16 . 2009-08-21 16:16 3146 ----a-w- c:\windows\system32\7f79thre5tz2169.dll
2009-08-16 01:37 . 2009-08-16 01:37 5249 ----a-w- c:\windows\system32\6392sp5mbot5ze.bin
2009-08-13 23:24 . 2009-08-13 23:24 16388 ----a-w- c:\windows\system32\558az9ckd5or1278.dll
2009-08-05 10:42 . 2009-08-05 10:42 9855 ----a-w- c:\windows\system32\7e9zspar5e690.bin
2009-08-01 10:15 . 2009-08-01 10:15 13514 ----a-w- c:\windows\system32\60f5stzal1895.dll
2009-07-24 15:42 . 2009-07-24 15:42 10638 ----a-w- c:\windows\system32\5850tr9j4z7.bin
2009-07-19 22:00 . 2009-07-19 22:00 10116 ----a-w- c:\windows\system32\6690downlozder1528.exe
2009-07-03 01:59 . 2009-07-03 01:59 10919 ----a-w- c:\windows\system32\6b93tzief1854.bin
2009-06-30 11:51 . 2009-06-17 10:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-30 11:51 . 2009-06-30 11:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-30 11:51 . 2009-06-17 10:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-30 11:51 . 2009-06-30 11:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-30 09:22 . 2009-02-12 09:35 38208 ----a-w- c:\documents and settings\Glyn\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2009-06-30 09:22 . 2009-06-30 09:22 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-06-30 09:20 . 2009-06-30 09:20 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-06-30 09:20 . 2009-06-30 09:59 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-06-30 09:20 . 2009-06-30 09:59 -------- d-----w- c:\program files\NOS
2009-06-30 09:06 . 2009-06-30 09:09 -------- d-----w- c:\documents and settings\Glyn\.SunDownloadManager
2009-06-20 17:21 . 2009-06-20 17:21 1078 ----a-r- c:\documents and settings\Glyn\Application Data\Microsoft\Installer\{DB09C3D8-5ED0-42A3-8EC8-3B9F665971EF}\_A337FA7F14B1AA85BFA8A6.exe
2009-06-20 17:21 . 2009-06-20 17:21 1078 ----a-r- c:\documents and settings\Glyn\Application Data\Microsoft\Installer\{DB09C3D8-5ED0-42A3-8EC8-3B9F665971EF}\_7CFBC8C69E44C18F04FF2E.exe
2009-06-20 17:21 . 2009-06-20 17:21 10134 ----a-r- c:\documents and settings\Glyn\Application Data\Microsoft\Installer\{DB09C3D8-5ED0-42A3-8EC8-3B9F665971EF}\_3B0267A284AF1E1AD9D67E.exe
2009-06-20 17:19 . 2009-06-20 17:19 -------- d-----w- c:\program files\Western Digital Corp
2009-06-20 11:52 . 2009-06-20 13:24 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-20 11:48 . 2009-06-20 12:08 -------- d-----w- c:\documents and settings\Glyn\Application Data\GetRightToGo
2009-06-20 01:03 . 2009-06-20 01:03 25376 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-06-20 01:02 . 2009-06-20 01:42 -------- d-----w- c:\program files\Registry Defense
2009-06-13 15:35 . 2009-06-13 15:35 15863 ----a-w- c:\windows\system32\8bb5ackdoz93153.bin
2009-06-13 01:19 . 2009-06-13 01:19 16139 ----a-w- c:\windows\system32\9555zro95ca.exe
2009-06-05 05:56 . 2009-06-05 05:56 16726 ----a-w- c:\windows\system32\66fzbackdoo5169.dll
2009-06-04 21:21 . 2009-06-04 21:21 48 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-04 21:21 . 2009-06-20 17:30 -------- d-----w- c:\documents and settings\Glyn\Application Data\skypePM
2009-06-04 21:20 . 2009-06-20 23:02 -------- d-----w- c:\documents and settings\Glyn\Application Data\Skype
2009-06-04 21:20 . 2009-06-04 21:20 -------- d-----w- c:\program files\Common Files\Skype
2009-06-04 21:20 . 2009-06-04 21:20 -------- d-----r- c:\program files\Skype
2009-06-04 21:19 . 2009-06-04 21:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-06-04 12:18 . 2009-06-04 12:18 390664 ----a-w- c:\documents and settings\Glyn\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-06-04 02:59 . 2009-06-04 02:59 2846 ----a-w- c:\windows\system32\905ddowzloader2895.dll
2009-06-01 15:47 . 2009-06-01 15:47 2761 ----a-w- c:\windows\system32\7a9cspyzare1653.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-30 09:27 . 2007-05-22 04:27 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-20 01:03 . 2007-05-19 02:38 8224 ----a-w- c:\documents and settings\Glyn\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-20 00:52 . 2009-03-18 01:25 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-06-19 22:40 . 2008-02-07 22:50 -------- d-----w- c:\documents and settings\Glyn\Application Data\BitTorrent
2009-06-05 14:00 . 2007-10-30 23:40 -------- d-----w- c:\program files\Norton Security Scan
2009-05-21 14:12 . 2009-05-21 14:12 18341 ----a-w- c:\windows\system32\z6504not-a-virus3b59.bin
2009-05-14 08:03 . 2009-03-18 01:25 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-14 08:03 . 2007-05-18 13:48 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-14 08:03 . 2009-03-18 01:25 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-14 08:03 . 2009-03-18 01:25 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-07 15:32 . 2004-08-10 11:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 15:27 . 2009-05-01 15:27 5036 ----a-w- c:\windows\system32\585zspyware2509.bin
2009-04-29 04:56 . 2004-08-10 11:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-10 11:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-23 23:59 . 2009-04-23 23:59 6828 ----a-w- c:\windows\system32\z6aft95eat22055.bin
2009-04-17 12:26 . 2004-08-10 11:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-10 11:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-09 11:56 . 2009-04-09 11:56 152576 ------w- c:\documents and settings\Glyn\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-07 03:16 . 2009-04-07 03:16 2876 ----a-w- c:\windows\system32\959adzware2026.bin
2009-03-28 16:05 . 2007-09-24 01:11 67688 ------w- c:\program files\mozilla firefox\components\jar50.dll
2009-03-28 16:05 . 2007-09-24 01:11 54368 ------w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-03-28 16:05 . 2007-09-24 01:11 34944 ------w- c:\program files\mozilla firefox\components\myspell.dll
2009-03-28 16:05 . 2007-09-24 01:11 46712 ------w- c:\program files\mozilla firefox\components\spellchk.dll
2009-03-28 16:05 . 2007-09-24 01:11 172136 ------w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-05 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-14 1947928]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-11-16 397312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-14 08:03 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\Soulseek2\\slsk.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [18/03/2009 02:25 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [18/03/2009 02:25 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [18/03/2009 02:25 298776]
S3 ffSaffireLE_1394;ffSaffireLE_1394;c:\windows\system32\drivers\ffSaffireLE_1394.sys [18/05/2007 21:13 113664]
S3 ffSaffireLE_avs;ffSaffireLE_avs;c:\windows\system32\drivers\ffSaffireLE_avs.sys [18/05/2007 21:13 28672]
S3 photonau;photonau;c:\windows\system32\drivers\photonau.sys [30/05/2007 15:09 46080]
.
Contents of the 'Scheduled Tasks' folder

2009-04-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:34]

2009-06-05 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2007-04-19 22:42]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: microsoft.com\office
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Glyn\Application Data\Mozilla\Firefox\Profiles\vl614f5v.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - component: c:\progra~1\MOZILL~1\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-30 14:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(896)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-30 14:38
ComboFix-quarantined-files.txt 2009-06-30 13:38

Pre-Run: 42,113,691,648 bytes free
Post-Run: 44,699,648,000 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

782 --- E O F --- 2009-06-15 23:08

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by Belahzur on Tue Jun 30, 2009 3:47 pm

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\system32\6a82v9r35z.bin
c:\windows\system32\6c1cste9553z.bin
c:\windows\system32\593ztroj1e9.exe
c:\windows\system32\z4d7do9nloade52887.exe
c:\windows\system32\58595ot-a-virusz90.dll
c:\windows\system32\z9953s9am5ot21e.dll
c:\windows\system32\z9350tr9519.dll
c:\windows\system32\z6f3stea53197.bin
c:\windows\system32\92z55hacktool73.exe
c:\windows\system32\715fth9ezt27440.bin
c:\windows\system32\z5849troj7d9.bin
c:\windows\system32\zb9ethief5406.exe
c:\windows\system32\9d75sparze2777.dll
c:\windows\system32\7f79thre5tz2169.dll
c:\windows\system32\6392sp5mbot5ze.bin
c:\windows\system32\558az9ckd5or1278.dll
c:\windows\system32\7e9zspar5e690.bin
c:\windows\system32\60f5stzal1895.dll
c:\windows\system32\5850tr9j4z7.bin
c:\windows\system32\6690downlozder1528.exe
c:\windows\system32\6b93tzief1854.bin
c:\windows\system32\8bb5ackdoz93153.bin
c:\windows\system32\9555zro95ca.exe
c:\windows\system32\66fzbackdoo5169.dll
c:\windows\system32\905ddowzloader2895.dll
c:\windows\system32\7a9cspyzare1653.exe
c:\windows\system32\z6504not-a-virus3b59.bin
c:\windows\system32\585zspyware2509.bin
c:\windows\system32\z6aft95eat22055.bin
c:\windows\system32\959adzware2026.bin

Folder::
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 5:37 pm

here you go! 2 parts this time. anything else?....

ComboFix 09-06-29.07 - Glyn 30/06/2009 18:25.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.427 [GMT 1:00]
Running from: c:\documents and settings\Glyn\My Documents\Combo-Fix.exe
Command switches used :: c:\documents and settings\Glyn\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\system32\558az9ckd5or1278.dll"
"c:\windows\system32\5850tr9j4z7.bin"
"c:\windows\system32\58595ot-a-virusz90.dll"
"c:\windows\system32\585zspyware2509.bin"
"c:\windows\system32\593ztroj1e9.exe"
"c:\windows\system32\60f5stzal1895.dll"
"c:\windows\system32\6392sp5mbot5ze.bin"
"c:\windows\system32\6690downlozder1528.exe"
"c:\windows\system32\66fzbackdoo5169.dll"
"c:\windows\system32\6a82v9r35z.bin"
"c:\windows\system32\6b93tzief1854.bin"
"c:\windows\system32\6c1cste9553z.bin"
"c:\windows\system32\715fth9ezt27440.bin"
"c:\windows\system32\7a9cspyzare1653.exe"
"c:\windows\system32\7e9zspar5e690.bin"
"c:\windows\system32\7f79thre5tz2169.dll"
"c:\windows\system32\8bb5ackdoz93153.bin"
"c:\windows\system32\905ddowzloader2895.dll"
"c:\windows\system32\92z55hacktool73.exe"
"c:\windows\system32\9555zro95ca.exe"
"c:\windows\system32\959adzware2026.bin"
"c:\windows\system32\9d75sparze2777.dll"
"c:\windows\system32\z4d7do9nloade52887.exe"
"c:\windows\system32\z5849troj7d9.bin"
"c:\windows\system32\z6504not-a-virus3b59.bin"
"c:\windows\system32\z6aft95eat22055.bin"
"c:\windows\system32\z6f3stea53197.bin"
"c:\windows\system32\z9350tr9519.dll"
"c:\windows\system32\z9953s9am5ot21e.dll"
"c:\windows\system32\zb9ethief5406.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\install.rdf

.
((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-30 )))))))))))))))))))))))))))))))
.

2009-06-30 13:56 . 2009-06-30 13:56 -------- d-----w- c:\windows\system32\wbem\Repository
2009-06-30 11:51 . 2009-06-17 10:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-30 11:51 . 2009-06-30 11:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-30 11:51 . 2009-06-17 10:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-30 11:51 . 2009-06-30 11:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-30 09:22 . 2009-02-12 09:35 38208 ----a-w- c:\documents and settings\Glyn\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2009-06-30 09:22 . 2009-06-30 09:22 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-06-30 09:20 . 2009-06-30 09:20 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-06-30 09:20 . 2009-06-30 09:59 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-06-30 09:20 . 2009-06-30 09:59 -------- d-----w- c:\program files\NOS
2009-06-30 09:06 . 2009-06-30 09:09 -------- d-----w- c:\documents and settings\Glyn\.SunDownloadManager
2009-06-20 17:21 . 2009-06-20 17:21 1078 ----a-r- c:\documents and settings\Glyn\Application Data\Microsoft\Installer\{DB09C3D8-5ED0-42A3-8EC8-3B9F665971EF}\_A337FA7F14B1AA85BFA8A6.exe
2009-06-20 17:21 . 2009-06-20 17:21 1078 ----a-r- c:\documents and settings\Glyn\Application Data\Microsoft\Installer\{DB09C3D8-5ED0-42A3-8EC8-3B9F665971EF}\_7CFBC8C69E44C18F04FF2E.exe
2009-06-20 17:21 . 2009-06-20 17:21 10134 ----a-r- c:\documents and settings\Glyn\Application Data\Microsoft\Installer\{DB09C3D8-5ED0-42A3-8EC8-3B9F665971EF}\_3B0267A284AF1E1AD9D67E.exe
2009-06-20 17:19 . 2009-06-20 17:19 -------- d-----w- c:\program files\Western Digital Corp
2009-06-20 11:52 . 2009-06-20 13:24 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-20 11:48 . 2009-06-20 12:08 -------- d-----w- c:\documents and settings\Glyn\Application Data\GetRightToGo
2009-06-20 01:03 . 2009-06-20 01:03 25376 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-06-20 01:02 . 2009-06-20 01:42 -------- d-----w- c:\program files\Registry Defense
2009-06-04 21:21 . 2009-06-04 21:21 48 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-04 21:21 . 2009-06-30 15:00 -------- d-----w- c:\documents and settings\Glyn\Application Data\skypePM
2009-06-04 21:20 . 2009-06-30 16:59 -------- d-----w- c:\documents and settings\Glyn\Application Data\Skype
2009-06-04 21:20 . 2009-06-04 21:20 -------- d-----w- c:\program files\Common Files\Skype
2009-06-04 21:20 . 2009-06-04 21:20 -------- d-----r- c:\program files\Skype
2009-06-04 21:19 . 2009-06-04 21:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-06-04 12:18 . 2009-06-04 12:18 390664 ----a-w- c:\documents and settings\Glyn\Application Data\Real\RealPlayer\Update\RealPlayer11.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-30 13:55 . 2008-02-07 22:50 -------- d-----w- c:\documents and settings\Glyn\Application Data\BitTorrent
2009-06-30 09:27 . 2007-05-22 04:27 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-20 01:03 . 2007-05-19 02:38 8224 ----a-w- c:\documents and settings\Glyn\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-20 00:52 . 2009-03-18 01:25 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-06-05 14:00 . 2007-10-30 23:40 -------- d-----w- c:\program files\Norton Security Scan
2009-05-14 08:03 . 2009-03-18 01:25 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-14 08:03 . 2007-05-18 13:48 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-14 08:03 . 2009-03-18 01:25 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-14 08:03 . 2009-03-18 01:25 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-07 15:32 . 2004-08-10 11:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-10 11:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-10 11:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-17 12:26 . 2004-08-10 11:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-10 11:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-09 11:56 . 2009-04-09 11:56 152576 ------w- c:\documents and settings\Glyn\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-28 16:05 . 2007-09-24 01:11 67688 ------w- c:\program files\mozilla firefox\components\jar50.dll
2009-03-28 16:05 . 2007-09-24 01:11 54368 ------w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-03-28 16:05 . 2007-09-24 01:11 34944 ------w- c:\program files\mozilla firefox\components\myspell.dll
2009-03-28 16:05 . 2007-09-24 01:11 46712 ------w- c:\program files\mozilla firefox\components\spellchk.dll
2009-03-28 16:05 . 2007-09-24 01:11 172136 ------w- c:\program files\mozilla firefox\components\xpinstal.dll
.

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 5:37 pm

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-05-26 24264488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-05 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-14 1947928]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-11-16 397312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-14 08:03 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\Soulseek2\\slsk.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [18/03/2009 02:25 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [18/03/2009 02:25 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [18/03/2009 02:25 298776]
S3 ffSaffireLE_1394;ffSaffireLE_1394;c:\windows\system32\drivers\ffSaffireLE_1394.sys [18/05/2007 21:13 113664]
S3 ffSaffireLE_avs;ffSaffireLE_avs;c:\windows\system32\drivers\ffSaffireLE_avs.sys [18/05/2007 21:13 28672]
S3 photonau;photonau;c:\windows\system32\drivers\photonau.sys [30/05/2007 15:09 46080]
.
Contents of the 'Scheduled Tasks' folder

2009-04-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:34]

2009-06-05 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2007-04-19 22:42]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: microsoft.com\office
FF - ProfilePath - c:\documents and settings\Glyn\Application Data\Mozilla\Firefox\Profiles\vl614f5v.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - component: c:\progra~1\MOZILL~1\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-06-30 18:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(900)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-30 18:34
ComboFix-quarantined-files.txt 2009-06-30 17:34
ComboFix2.txt 2009-06-30 14:16
ComboFix3.txt 2009-06-30 13:38

Pre-Run: 44,637,085,696 bytes free
Post-Run: 44,625,838,080 bytes free

215 --- E O F --- 2009-06-15 23:08

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by Belahzur on Tue Jun 30, 2009 5:40 pm

Hello.
Nearly done now. Smile Just need to check one more log.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 5:44 pm

here you go. any more?...

Ableton Live v5.0.2
Ableton Live v7.0.2
Adobe Flash Player 10 ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.3
Adobe Shockwave Player 11
Adobe® Photoshop® Album Starter Edition 3.0
AnalogX AutoTune
AnalogX SayIt
Antares Autotune DX v4.12
Apple Mobile Device Support
Apple Software Update
Arturia Arp2600 V v1.0
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
AVG 8.5
Bome's Mouse Keyboard 2.00
Bonjour
Broadcom 440x 10/100 Integrated Controller
Canon S750
Conexant HDA D110 MDC V.92 Modem
Critical Update for Windows Media Player 11 (KB959772)
Dell ResourceCD
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
ESPNMotion
Firewire Family
FLV Player 2.0, build 23
FriendBlasterPro
GemMaster Mystic
Google Earth
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
HP Customer Participation Program 7.0
HP Imaging Device Functions 7.0
HP Photosmart Essential
HP Photosmart, Officejet and Deskjet 7.0.A
HP Solution Center 7.0
HP Update
ImgBurn
Intel(R) PROSet/Wireless Software
iPod for Windows 2005-10-12
iTunes
Java(TM) 6 Update 13
Korg Legacy Collection VSTi v1.0.02
Live 7.0.10
mCore
mDriver
mDrWiFi
mHlpDell
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Standard for Students and Teachers
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows XP Video Decoder Checkup Utility
MIDI-OX
mIWA
mLogView
mMHouse
Mozilla Firefox (2.0.0.20)
mPfMgr
mPfWiz
mProSafe
mSSO
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
mWlsSafe
mWMI
mXML
mZConfig
Native Instruments Battery v2.0
Native Instruments Reaktor 5
NI Service Center
Norton Security Scan
Otto
Photon X 25
QuickTime
RealPlayer
Saffire LE 1.2
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Shop for HP Supplies
SigmaTel Audio
Skype™ 4.0
Sonic Encoders
Sony Noise Reduction Plug-In 2.0e
Sony Sound Forge 8.0b
SoulSeek Client 156b
Speak and Spell 1978 Simulator
Steinberg Cubase SX v2.01
Steinberg Cubase SX v2.2.0.33
Synaptics Pointing Device Driver
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update Rollup 2 for Windows XP Media Center Edition 2005
Vintage Vocoder 1.03 Build 1
Win AVI HelixSDK
WinAVI Video Converter
Windows Driver Package - Ricoh Company Memorystick Host Controller (07/09/2005 1.00.01.12)
Windows Driver Package - Ricoh Company MMC Host Controller (07/14/2005 1.00.00.06)
Windows Driver Package - Ricoh Company xD-Picture Card/SmartMedia Host Controller (07/14/2005 1.00.02.04)
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Media Center Edition 2005 KB925766
Windows XP Service Pack 3
WinRAR archiver

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by Belahzur on Tue Jun 30, 2009 5:48 pm

Hello.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    Adobe Reader 8.1.3
    Java(TM) 6 Update 13
    Norton Security Scan

Updating Java:

  • Download the latest version of [You must be registered and logged in to see this link.].
  • Select the first option where it says "This release is Windows 7 support-ready and includes support for Internet Explorer 8...".
  • Click the "Download" button to the right.
  • In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Then from your desktop double-click on jre-6u14-windows-i586-p.exe that you downloaded to install the newest version.


Then download and install [You must be registered and logged in to see this link.]

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 6:05 pm

when i try and remove adobe 8.1.3 it keeps saying this?!

[You must be registered and logged in to see this link.]

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by Belahzur on Tue Jun 30, 2009 6:07 pm

Ok, leave the old version on and install the 9.1 version too.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: winbluesoft - help!! dissertation deadline!!

Post by glyn.cosford on Tue Jun 30, 2009 6:16 pm

ok, all done!! Smile its running a lot better now! Thank You! can my hard drive be cloned and then wiped now?

glyn.cosford
Novice
Novice

Posts Posts : 11
Joined Joined : 2009-06-21
OS OS : xp
Points Points : 27265
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum