please help can not remove winibluesoft?

View previous topic View next topic Go down

please help can not remove winibluesoft?

Post by vwbigj on 7th May 2009, 5:08 am

i downloaded Malwarebytes' Anti-Malware but it wil not open.

please help asap this is driving me crazy!!!!

justin

vwbigj
Beginner
Beginner

Posts Posts : 3
Joined Joined : 2009-05-07
OS OS : Vista
Points Points : 27745
# Likes # Likes : 0

View user profile

Back to top Go down

Re: please help can not remove winibluesoft?

Post by Doctor Inferno on 7th May 2009, 5:11 am

1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

Note: This tool was posted specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Leave the script box empty.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 11976
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104640
# Likes # Likes : 0

View user profile

Back to top Go down

results

Post by vwbigj on 7th May 2009, 5:25 am

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "gxvxcserv.sys" found!
ImagePath: \systemroot\system32\drivers\gxvxcpxbyfrbpsvquwpoqgqpedmtnivmschxx.sys
Start Type: 1 (System)

Rootkit scan completed.


Completed script processing.

*******************

Finished! Terminate.

vwbigj
Beginner
Beginner

Posts Posts : 3
Joined Joined : 2009-05-07
OS OS : Vista
Points Points : 27745
# Likes # Likes : 0

View user profile

Back to top Go down

updated results

Post by vwbigj on 7th May 2009, 5:36 am

i forgot to click the disable rootkits so i re did it... here are the new results...

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "gxvxcserv.sys" found!
ImagePath: \systemroot\system32\drivers\gxvxcpxbyfrbpsvquwpoqgqpedmtnivmschxx.sys
Driver disabled successfully.

Rootkit scan completed.


Completed script processing.

*******************

Finished! Terminate.

vwbigj
Beginner
Beginner

Posts Posts : 3
Joined Joined : 2009-05-07
OS OS : Vista
Points Points : 27745
# Likes # Likes : 0

View user profile

Back to top Go down

Re: please help can not remove winibluesoft?

Post by Belahzur on 7th May 2009, 3:32 pm

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying


Drivers to delete:
gxvxcserv.sys

Files to delete:
C:\WINDOWS\system32\drivers\gxvxcpxbyfrbpsvquwpoqgqpedmtnivmschxx.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: please help can not remove winibluesoft?

Post by vw_bigj on 7th May 2009, 9:14 pm

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "gxvxcserv.sys" deleted successfully.
File "C:\WINDOWS\system32\drivers\gxvxcpxbyfrbpsvquwpoqgqpedmtnivmschxx.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

vw_bigj
Beginner
Beginner

Posts Posts : 2
Joined Joined : 2009-05-07
Gender Gender : Male
OS OS : windows vista
Points Points : 27742
# Likes # Likes : 0

View user profile

Back to top Go down

Re: please help can not remove winibluesoft?

Post by Belahzur on 7th May 2009, 9:18 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: please help can not remove winibluesoft?

Post by vw_bigj on 7th May 2009, 9:48 pm

Malwarebytes' Anti-Malware 1.36
Database version: 2060
Windows 6.0.6001 Service Pack 1

5/7/2009 2:38:33 PM
mbam-log-2009-05-07 (14-38-33).txt

Scan type: Quick Scan
Objects scanned: 72270
Time elapsed: 9 minute(s), 26 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 2
Registry Data Items Infected: 16
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
C:\Windows\System32\setup2.exe (Trojan.FakeAlert) -> Failed to unload process.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\WiniBlueSoft (Rogue.WiniBlue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WiniBlueSoft (Rogue.WiniBlue) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{869e1b0f-8670-410f-b81f-2e03f41008f5}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{869e1b0f-8670-410f-b81f-2e03f41008f5}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{e7a70200-abbe-479a-baa8-bbd324036da9}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{869e1b0f-8670-410f-b81f-2e03f41008f5}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{869e1b0f-8670-410f-b81f-2e03f41008f5}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{e7a70200-abbe-479a-baa8-bbd324036da9}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{869e1b0f-8670-410f-b81f-2e03f41008f5}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{869e1b0f-8670-410f-b81f-2e03f41008f5}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{e7a70200-abbe-479a-baa8-bbd324036da9}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{869e1b0f-8670-410f-b81f-2e03f41008f5}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{869e1b0f-8670-410f-b81f-2e03f41008f5}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{e7a70200-abbe-479a-baa8-bbd324036da9}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.234,85.255.112.185 -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\setup2.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Users\Justin\AppData\Local\Temp\setup2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\16925hiefz080.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\gxvxccounter (Trojan.DNSchanger) -> Quarantined and deleted successfully.
C:\Windows\System32\gxvxcetngccbvyiqkobxruqivnwupptalfwwe.dll (Trojan.Agent) -> Quarantined and deleted successfully.


everything seems to be working okk now!

vw_bigj
Beginner
Beginner

Posts Posts : 2
Joined Joined : 2009-05-07
Gender Gender : Male
OS OS : windows vista
Points Points : 27742
# Likes # Likes : 0

View user profile

Back to top Go down

Re: please help can not remove winibluesoft?

Post by Belahzur on 7th May 2009, 9:52 pm

Hello.
Please open MBAM again and go into the update tab.
Press "Check for updates" and let the update be downloaded, so you should now have the newest database.

We will run another scan soon to make sure we got it all.

  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run
  • When complete, two logs will open. Save both of the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum