Help needed regarding winibluesoft!!!!!

View previous topic View next topic Go down

Help needed regarding winibluesoft!!!!!

Post by gtp1 on Sun May 10, 2009 8:36 am

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:24:05 PM, on 5/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
E:\downloads\windows\crystalxp\visual\VisualToolTip.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\setup2.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1A7D97A7-6D0A-4A25-91B1-1757D0E917E1} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
O2 - BHO: (no name) - {C1B58917-66F7-42A6-B068-1A166E45FB37} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [VisualTooltip] E:\downloads\windows\crystalxp\visual\VisualToolTip.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RegTool] C:\Program Files\RegTool\RegTool.exe -boot
O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
O4 - HKUS\S-1-5-21-1659004503-2146901713-839522115-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'ace')
O4 - HKUS\S-1-5-21-1659004503-2146901713-839522115-1003\..\Run: [Google Update] "C:\Documents and Settings\ace\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c (User 'ace')
O4 - HKUS\S-1-5-21-1659004503-2146901713-839522115-1003\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H (User 'ace')
O4 - HKUS\S-1-5-21-1659004503-2146901713-839522115-501\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Guest')
O4 - S-1-5-18 Startup: BSEGadget.lnk = ? (User 'SYSTEM')
O4 - S-1-5-18 Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: BSEGadget.lnk = ? (User 'Default user')
O4 - .DEFAULT Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe (User 'Default user')
O4 - Startup: BSEGadget.lnk = ?
O4 - Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - [You must be registered and logged in to see this link.]
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - [You must be registered and logged in to see this link.]
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - [You must be registered and logged in to see this link.]
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} (F-Secure Health Check 1.1) - [You must be registered and logged in to see this link.]
O16 - DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} (DinerDash Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) -
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{BDF43518-8EE6-418C-9110-714B8BF8B4EA}: NameServer = 85.255.112.89;85.255.112.97
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. [You must be registered and logged in to see this link.] - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

--
End of file - 11423 bytes

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Sun May 10, 2009 8:39 am

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Sun May 10, 2009 8:47 am

i have read the other threads with similar problems and followed the instructions...it helped me in removing security alert which was showing that antivirus is turned off....but i am still not sure whether winibluesoft is removed or not Let me think .. how to confirm that so please help!!!

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Sun May 10, 2009 8:55 am

now not receiving any pop-ups also from winibluesoft... Smile

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Sun May 10, 2009 9:00 am

i fixed the following files using hijackthis :
O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.128,85.255.112.142
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.128,85.255.112.142
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)

is that was the right way?? but it certainly helped me, still confused please help..

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Sun May 10, 2009 11:34 am

Hello.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Mon May 11, 2009 8:04 am

Malwarebytes' Anti-Malware 1.36
Database version: 2107
Windows 5.1.2600 Service Pack 2

5/11/2009 1:23:48 PM
mbam-log-2009-05-11 (13-23-47).txt

Scan type: Quick Scan
Objects scanned: 112904
Time elapsed: 8 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 15
Files Infected: 465

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\RegTool (Rogue.RegTool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\RealTime Gaming Software\Gold VIP Club Casino (Adware.Casino) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\ace\Application Data\Privacy center (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\dbases (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\keys (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\temp (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\Logs (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210 (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\fonts (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\temp (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\_patch (Adware.Casino) -> Quarantined and deleted successfully.


Files Infected:
C:\Documents and Settings\Gautam\Local Settings\Temporary Internet Files\Content.IE5\9EV34PPR\setup[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\dbases\cg.dat (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\dbases\mw.dat (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\dbases\rd.dat (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\dbases\sc.dat (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\dbases\sm.dat (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\dbases\sp.dat (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\keys\cg.key (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\keys\rd.key (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\keys\sc.key (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\keys\sp.key (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\temp\settings.ini (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Application Data\Privacy center\temp\spfilter (Rogue.PrivacyCenter) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\resultsw.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\Logs\2009-02-15 00-36-470.log (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\Logs\2009-02-15 00-39-510.log (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\filelist.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-0.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-1.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-10.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-100.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-101.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-102.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-103.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-104.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-105.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-106.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-107.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-108.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-109.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-11.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-110.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-111.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-112.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-113.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-114.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-115.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-116.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-117.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-118.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-119.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-12.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-120.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-121.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-122.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-123.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-124.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-125.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-126.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-127.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-128.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-129.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-13.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-130.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-131.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-132.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-133.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-134.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-135.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-136.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-137.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-138.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-139.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-14.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-140.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-141.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-142.db (Rogue.RegTool) -> Quarantined and deleted successfully.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Mon May 11, 2009 8:08 am

files infected(cont.)
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-143.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-144.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-145.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-146.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-147.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-148.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-149.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-15.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-150.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-151.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-152.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-153.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-154.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-155.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-156.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-157.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-158.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-159.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-16.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-160.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-161.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-162.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-163.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-164.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-165.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-166.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-167.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-168.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-169.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-17.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-170.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-171.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-172.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-173.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-174.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-175.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-176.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-177.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-178.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-179.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-18.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-180.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-181.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-182.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-183.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-184.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-185.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-186.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-187.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-188.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-189.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-19.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-190.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-191.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-192.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-193.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-194.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-195.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-196.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-197.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-198.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-199.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-2.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-20.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-200.db (Rogue.RegTool) -> Quarantined and deleted successfully.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Mon May 11, 2009 8:10 am

C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-201.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-202.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-203.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-204.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-205.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-206.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-207.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-208.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-209.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-21.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-210.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-211.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-212.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-213.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-214.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-215.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-216.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-217.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-218.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-219.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-22.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-220.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-221.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-222.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-223.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-224.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-225.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-226.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-227.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-228.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-229.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-23.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-230.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-231.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-232.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-233.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-234.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-235.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-236.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-237.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-238.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-239.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-24.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-240.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-241.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-242.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-243.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-244.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-245.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-246.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-247.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-248.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-249.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-25.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-250.db (Rogue.RegTool) -> Quarantined and deleted successfully.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Mon May 11, 2009 8:11 am

C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-251.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-252.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-253.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-254.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-255.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-256.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-257.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-258.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-259.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-26.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-260.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-261.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-262.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-263.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-264.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-265.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-266.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-267.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-268.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-269.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-27.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-270.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-271.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-272.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-273.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-274.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-275.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-276.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-277.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-278.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-279.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-28.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-280.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-281.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-282.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-283.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-284.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-285.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-286.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-287.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-288.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-289.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-29.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-290.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-291.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-292.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-293.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-294.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-3.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-30.db (Rogue.RegTool) -> Quarantined and deleted successfully.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Mon May 11, 2009 8:11 am

C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-31.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-32.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-33.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-34.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-35.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-36.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-37.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-38.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-39.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-4.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-40.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-41.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-42.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-43.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-44.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-45.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-46.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-47.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-48.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-49.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-5.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-50.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-51.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-52.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-53.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-54.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-55.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-56.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-57.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-58.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-59.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-6.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-60.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-61.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-62.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-63.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-64.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-65.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-66.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-67.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-68.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-69.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-7.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-70.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-71.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-72.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-73.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-74.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-75.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-76.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-77.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-78.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-79.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-8.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-80.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-81.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-82.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-83.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-84.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-85.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-86.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-87.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-88.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-89.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-9.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-90.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-91.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-92.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-93.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-94.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-95.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-96.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-97.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-98.db (Rogue.RegTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Gautam\Application Data\RegTool\QuarantineW\2009-02-15 00-38-210\regb-99.db (Rogue.RegTool) -> Quarantined and deleted successfully.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Mon May 11, 2009 8:12 am

C:\Program Files\Gold VIP Club Casino\bj.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\casino.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\casino.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\casino.ico (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\casino.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\directsound.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\extgame.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\Gold VIP Club Casino.ico (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\lbyinst.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\lobby.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\lobby.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\marquee.txt (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\menu.txt (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\Microsoft.VC80.CRT.manifest (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\miniprocess.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\msvcm80.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\msvcp60.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\msvcp80.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\msvcr80.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\msvcrt.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\plibc32.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\tcpoker.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\unicows.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\winsound.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\zlib.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\fonts\albw.ttf (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Blackjack - Common (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Blackjack - Common.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Blackjack - Standard (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Blackjack - Standard.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Extgame (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Extgame.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Fonts - Latin (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Fonts - Latin.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Lobby (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Lobby.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\packages (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\SmartDownload (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\SmartDownload.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Tri-Card Common (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Tri-Card Common.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Tri-Card Poker (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\installed\Tri-Card Poker.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\action_button.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\bj.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\blackjack32.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\card.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\cards32.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.bd1.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.chf.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.cny.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.eur.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.gbp.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.myr.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.pen.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.php.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.usd.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino.zar.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino32.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\casino32.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.bd1.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.chf.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.cny.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.eur.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.gbp.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.myr.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.pen.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.php.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.usd.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips.zar.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.chf.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.cny.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.eur.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.myr.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.pen.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.php.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.usd.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\chips32.zar.rsc (Adware.Casino) -> Quarantined and deleted successfully.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Mon May 11, 2009 8:12 am

C:\Program Files\Gold VIP Club Casino\rsc\exit.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\extgame.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\history.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\lobby.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\lobby.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\logos.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\options.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\rings.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\table.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\table.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\tables32.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\tbslot.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\tcpoker.en.st.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\rsc\tcpoker32.en.rsc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Blackjack.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Bust.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn000.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn001.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn002.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn003.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn004.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn005.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\cmn006.wav (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_00.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_01.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_02.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_03.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_04.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_05.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_06.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_07.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_08.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_09.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_10.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_11.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_12.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_13.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_14.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_15.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_16.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_17.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_18.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_19.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_20.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_21.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_22.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_23.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_24.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_25.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_26.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_27.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_28.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_29.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_30.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_31.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_32.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_33.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_34.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_35.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\HandScore_36.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Insurance.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\PlayerWins.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Push.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\ShoeCardSound.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\sounds\Win.ogg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\temp\loading.html (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\_patch\package_list.ini (Adware.Casino) -> Quarantined and deleted successfully.
C:\Program Files\Gold VIP Club Casino\_patch\package_list.ini.crc (Adware.Casino) -> Quarantined and deleted successfully.
C:\Documents and Settings\ace\Desktop\9_Malwarebytes_Anti-Malware_1.36_Serial_Key.rar (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\libavi-dd-1.1.1.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\libmpeg2-enc-1.2.5.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\libimg-2.2.9.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\RegTool Scan.job (Rogue.RegTool) -> Quarantined and deleted successfully.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Mon May 11, 2009 12:02 pm


  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run
  • When complete, two logs will open. Save both of the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Tue May 12, 2009 12:25 pm

DDS (Ver_09-03-16.01) - NTFSx86
Run by ace at 17:52:17.37 on Tue 05/12/2009
Internet Explorer: 8.0.6001.18241 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.126 [GMT 5.5:30]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
E:\downloads\windows\crystalxp\visual\VisualToolTip.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ace\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
C:\Documents and Settings\ace\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = [You must be registered and logged in to see this link.]
uSearch Page = [You must be registered and logged in to see this link.]
uSearch Bar = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
mSearchAssistant = [You must be registered and logged in to see this link.]
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {1A7D97A7-6D0A-4A25-91B1-1757D0E917E1} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: {a057a204-bacc-4d26-c39e-35f1d2a32ec8} - Megaupload Toolbar
BHO: {C1B58917-66F7-42A6-B068-1A166E45FB37} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: {F4D76F09-7896-458A-890F-E1F05C46069F} - No File
TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File
TB: {4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC} - No File
TB: Megaupload Toolbar: {a057a204-bacc-4d26-c39e-35f1d2a32ec8} -
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Sony Ericsson PC Suite] "c:\program files\sony ericsson\mobile2\application launcher\Application Launcher.exe" /startoptions
mRun: [VisualTooltip] e:\downloads\windows\crystalxp\visual\VisualToolTip.exe
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} - [You must be registered and logged in to see this link.]
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - [You must be registered and logged in to see this link.]
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - [You must be registered and logged in to see this link.]
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - [You must be registered and logged in to see this link.]
DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} - [You must be registered and logged in to see this link.]
DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} - [You must be registered and logged in to see this link.]
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - [You must be registered and logged in to see this link.]
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - [You must be registered and logged in to see this link.]
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - [You must be registered and logged in to see this link.]
DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} - [You must be registered and logged in to see this link.]
DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - [You must be registered and logged in to see this link.]
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - [You must be registered and logged in to see this link.]
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - [You must be registered and logged in to see this link.]
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [You must be registered and logged in to see this link.]
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - [You must be registered and logged in to see this link.]
DPF: {94299420-321F-4FF9-A247-62A23EBB640B} - [You must be registered and logged in to see this link.]
DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} - [You must be registered and logged in to see this link.]
DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} - [You must be registered and logged in to see this link.]
DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} - [You must be registered and logged in to see this link.]
DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54}
DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} - [You must be registered and logged in to see this link.]
TCP: {BDF43518-8EE6-418C-9110-714B8BF8B4EA} = 202.56.215.54,202.56.215.55
Notify: igfxcui - igfxdev.dll
SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - No File
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ace\applic~1\mozilla\firefox\profiles\ua3ndsa6.default\
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\ace\application data\mozilla\firefox\profiles\ua3ndsa6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - plugin: c:\documents and settings\ace\application data\mozilla\firefox\profiles\ua3ndsa6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\documents and settings\ace\application data\mozilla\firefox\profiles\ua3ndsa6.default\extensions\iaplayer@instantaction.com\plugins\npiaplayer.dll
FF - plugin: c:\documents and settings\ace\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\ace\local settings\application data\google\update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\progra~1\mozill~1\plugins\np_gp.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npExentCtl.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\vlc\npvlc.dll

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Tue May 12, 2009 12:25 pm

============= SERVICES / DRIVERS ===============

R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-4 14336]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-10-5 33752]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-3-19 13352]
S3 Ndisprot;ArcNet NDIS Protocol Driver;c:\windows\system32\drivers\ndisprot.sys [2008-12-1 27904]
S3 ntportio;ntportio; [x]

=============== Created Last 30 ================

2009-05-11 16:25 --d----- c:\docume~1\ace\applic~1\QuickScan
2009-05-11 12:54 --d----- c:\program files\CleanMyPC
2009-05-11 11:34 --d----- c:\docume~1\ace\applic~1\Malwarebytes
2009-05-10 17:24 104,328 a------- c:\windows\system32\drivers\bdfndisf.sys.upd
2009-05-10 16:11 --d----- c:\windows\SxsCaPendDel
2009-05-10 16:04 535 a------- c:\windows\system32\BDUpdateV1.xml
2009-05-10 14:19 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-05-10 12:15 --d----- c:\program files\CCleaner
2009-05-10 11:55 --d----- c:\docume~1\ace\applic~1\PC Tools
2009-05-10 10:59 42 a------- c:\windows\system32\Jiii_PNUCT.pnc
2009-05-10 10:27 42 a------- c:\windows\system32\AK083E209605E394C.lie
2009-05-10 10:26 --d----- c:\program files\Perfect Uninstaller
2009-05-10 09:18 --d----- c:\program files\Trend Micro
2009-05-10 00:27 --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-05-09 22:22 4,100 a------- c:\windows\1452spy3zd9.exe
2009-05-07 05:19 16,299 a------- c:\windows\6bazback9oor23735.bin
2009-05-06 23:49 --d----- c:\program files\PHP
2009-05-06 01:27 15,259 a------- c:\windows\15c0zir1598.ocx
2009-05-05 22:02 16,791 a------- c:\windows\system32\1z999spy351.exe
2009-05-04 16:31 2,585 a------- c:\windows\6d449ac5dzor1538.ocx
2009-05-04 13:29 8,194 a------- c:\windows\system32\54f7thrza935429.cpl
2009-05-02 22:20 --d----- c:\program files\Yahoo SiteBuilder
2009-05-01 18:47 18,377 a------- c:\windows\7ad2thr9atz30655.cpl
2009-05-01 15:04 4,615 a------- c:\windows\zf59down9oader465.cpl
2009-04-25 23:05 6,966 a------- c:\windows\system32\4985zwnload9r986.exe
2009-04-24 11:41 9,184 a------- c:\windows\system32\5b9cvirz299.exe
2009-04-24 09:22 9,518 a------- c:\windows\10fbs9e5l1618z.bin
2009-04-23 12:36 4,912 a------- c:\windows\ze10b5ckdoor7449.cpl
2009-04-22 23:14 --d----- c:\docume~1\alluse~1\applic~1\Metacafe
2009-04-22 19:23 12,077 a------- c:\windows\system32\3451zhrea912706.ocx
2009-04-22 15:33 8,195 a------- c:\windows\system32\1z000no9-5-virus7bd.bin
2009-04-20 03:55 13,125 a------- c:\windows\2041z59oj506.cpl
2009-04-20 02:33 15,715 a------- c:\windows\9z699virus585.bin
2009-04-19 20:45 9,576 a------- c:\windows\z5694vir5s299.bin
2009-04-19 07:15 4,410 a------- c:\windows\system32\50bbzhi9f1097.dll
2009-04-16 04:46 8,035 a------- c:\windows\2689zspambot53d.bin
2009-04-15 19:33 3,101 a------- c:\windows\51289ot-z-5irus528.dll
2009-04-14 19:22 10,145 a------- c:\windows\system32\755bthizf7789.bin
2009-04-14 05:46 17,183 a------- c:\windows\54zf5ddware79.bin
2009-04-14 05:44 11,722 a------- c:\windows\system32\6d99th5eat17309z.cpl

==================== Find3M ====================

2009-05-12 16:45 81,984 a------- c:\windows\system32\bdod.bin
2009-04-12 11:35 15,369 a------- c:\windows\22z90tr5j38b.exe
2009-04-10 19:49 14,705 a------- c:\windows\system32\5a70a9dwzre929.exe
2009-04-10 19:13 22,328 a------- c:\windows\system32\drivers\PnkBstrK.sys
2009-04-10 19:13 22,328 a------- c:\docume~1\ace\applic~1\PnkBstrK.sys
2009-04-10 19:13 107,832 -------- c:\windows\system32\PnkBstrB.exe
2009-04-10 19:13 682,280 a------- c:\windows\system32\pbsvc.exe
2009-04-10 19:13 66,872 -------- c:\windows\system32\PnkBstrA.exe
2009-04-09 20:07 2,855 a------- c:\windows\pif\rld-fi9k.PIF
2009-04-07 18:10 17,779 a------- c:\windows\9c55threaz8458.bin
2009-04-07 13:12 14,855 a------- c:\windows\7150thi5f11z29.dll
2009-04-07 11:37 15,142 a------- c:\windows\system32\18acad9ware2350z.exe
2009-04-06 23:39 5,653 a------- c:\windows\system32\59ecthie5373z.bin
2009-04-06 08:27 10,059 a------- c:\windows\system32\fz8stea95084.dll
2009-04-04 00:27 11,349 a------- c:\windows\system32\5068backd5o9z53.bin
2009-04-03 21:57 15,440 a------- c:\windows\system32\18z695py19a9.exe
2009-04-02 14:44 15,672 a------- c:\windows\system32\3850z9y559.exe
2009-03-27 16:43 10,799 a------- c:\windows\system32\3594not-a-virusz35.exe
2009-03-27 04:29 3,827 a------- c:\windows\a3zth9ef56.bin
2009-03-26 07:05 9,242 a------- c:\windows\system32\2dc9do5nloadez128.bin
2009-03-26 01:53 6,214 a------- c:\windows\system32\9d52backzoor425.exe
2009-03-25 01:54 5,551 a------- c:\windows\96s9ywarez153.exe
2009-03-19 11:12 14,662 a------- c:\windows\z80bac5do9r3018.dll
2009-03-18 12:58 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-18 08:04 17,472 a------- c:\windows\system32\2f5zddw9re254.bin
2009-03-16 22:48 8,266 a------- c:\windows\2700zp59bot2a0.dll
2009-03-16 04:20 3,481 a------- c:\windows\25079virus255z.bin
2009-03-12 12:49 8,141 a------- c:\windows\system32\18816not-azvirus985.dll
2009-03-05 15:19 4,412 a------- c:\windows\93069ot-5-virus7a1z.dll
2009-02-27 15:11 7,546 a------- c:\windows\54ezvir2930.exe
2009-02-27 04:32 17,133 a------- c:\windows\system32\1b69spyzare2598.exe
2009-02-25 21:28 17,092 a------- c:\windows\system32\4559zroj3fe.bin
2009-02-21 04:20 4,087 a------- c:\windows\3z819ackdoo52902.dll
2009-02-21 01:02 8,958 a------- c:\windows\1z996spy5f7.dll
2009-02-19 15:04 10,566 a------- c:\windows\system32\1745tz5ef3759.bin
2009-02-18 10:42 3,144 a------- c:\windows\53452ha9ztool69d.bin
2009-02-18 02:09 128,840 a------- c:\windows\system32\Metacafe.scr
2009-01-15 19:03 26,472 a------- c:\docume~1\ace\applic~1\GDIPFONTCACHEV1.DAT

============= FINISH: 17:52:48.53 ===============

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Wed May 13, 2009 11:57 am


  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Wed May 13, 2009 3:53 pm

Running from: c:\documents and settings\ace\Desktop\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated)
FW: BitDefender Firewall *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ace\LOCALS~1\Temp\tmp2.tmp
E:\resycled
e:\resycled\boot.com
F:\resycled
f:\resycled\boot.com

.
((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-12-27 15:14 . 2009-12-27 15:14 7992 ----a-w c:\windows\320129ot-5-virusz1.dll
2009-12-26 16:21 . 2009-12-26 16:21 7855 ----a-w c:\windows\system32\2697sp95ze2027.exe
2009-12-25 22:01 . 2009-12-25 22:01 16229 ----a-w c:\windows\77b2st9al1550z.bin
2009-12-25 02:09 . 2009-12-25 02:09 13009 ----a-w c:\windows\system32\13369hz5ktool7a6.dll
2009-12-24 19:47 . 2009-12-24 19:47 11435 ----a-w c:\windows\4487zh9eat312365.dll
2009-12-23 07:58 . 2009-12-23 07:58 6175 ----a-w c:\windows\15z91viru56d59.exe
2009-12-22 03:37 . 2009-12-22 03:37 3793 ----a-w c:\windows\1b67spy5a9e21z9.dll
2009-12-18 13:29 . 2009-12-18 13:29 5221 ----a-w c:\windows\system32\159fsteaz30879.exe
2009-12-17 22:29 . 2009-12-17 22:29 8657 ----a-w c:\windows\system32\31zavir5092.bin
2009-12-15 15:46 . 2009-12-15 15:46 10236 ----a-w c:\windows\252eztea91509.exe
2009-12-13 06:07 . 2009-12-13 06:07 2760 ----a-w c:\windows\63z5vir5689.dll
2009-12-12 08:17 . 2009-12-12 08:17 4259 ----a-w c:\windows\9293downloaz5r1942.bin
2009-12-11 15:50 . 2009-12-11 15:50 3828 ----a-w c:\windows\system32\28e2spz59e1821.exe
2009-12-10 17:26 . 2009-12-10 17:26 2578 ----a-w c:\windows\system32\777zs5eal13059.dll
2009-12-09 05:47 . 2009-12-09 05:47 3477 ----a-w c:\windows\system32\5718hzck9o5l4c5.exe
2009-12-07 21:41 . 2009-12-07 21:41 13935 ----a-w c:\windows\system32\2126spywzr53159.dll
2009-12-07 16:52 . 2009-12-07 16:52 9583 ----a-w c:\windows\system32\3d51thrza914155.bin
2009-12-06 18:14 . 2009-12-06 18:14 16379 ----a-w c:\windows\system32\20517noz-a-virus195.exe
2009-12-04 11:12 . 2009-12-04 11:12 3674 ----a-w c:\windows\system32\41azp95are1557.exe
2009-11-28 21:51 . 2009-11-28 21:51 9982 ----a-w c:\windows\system32\8179hackz9ol757.exe
2009-11-27 01:24 . 2009-11-27 01:24 16813 ----a-w c:\windows\system32\819trzj5d5.bin
2009-11-25 20:30 . 2009-11-25 20:30 11774 ----a-w c:\windows\205z6wor9545.exe
2009-11-23 09:06 . 2009-11-23 09:06 17808 ----a-w c:\windows\system32\95z07not-a-virus439.bin
2009-11-21 14:22 . 2009-11-21 14:22 2602 ----a-w c:\windows\548d5hreat28z659.exe
2009-11-21 08:09 . 2009-11-21 08:09 15374 ----a-w c:\windows\system32\15z50troj25f9.dll
2009-11-15 17:19 . 2009-11-15 17:19 13340 ----a-w c:\windows\34a9ad5waze155.bin
2009-11-15 07:03 . 2009-11-15 07:03 17778 ----a-w c:\windows\21802not-a-9iru548z.exe
2009-11-15 02:36 . 2009-11-15 02:36 3259 ----a-w c:\windows\zfa6threat1599.dll
2009-11-14 02:51 . 2009-11-14 02:51 9283 ----a-w c:\windows\system32\9ea5threat2z044.bin
2009-11-14 01:08 . 2009-11-14 01:08 16955 ----a-w c:\windows\5da559ezl477.exe
2009-11-12 05:40 . 2009-11-12 05:40 5201 ----a-w c:\windows\system32\eb8spzwa5e1109.bin
2009-11-09 19:12 . 2009-11-09 19:12 18043 ----a-w c:\windows\system32\92535hreat30467z.exe
2009-11-09 09:08 . 2009-11-09 09:08 17458 ----a-w c:\windows\25z79virus5705.bin
2009-11-08 15:10 . 2009-11-08 15:10 7232 ----a-w c:\windows\system32\12545worm7cz9.exe
2009-11-07 04:17 . 2009-11-07 04:17 7871 ----a-w c:\windows\449zhi5f387.dll
2009-11-06 16:21 . 2009-11-06 16:21 5071 ----a-w c:\windows\system32\1654zs5ambo9787.bin
2009-11-03 01:29 . 2009-11-03 01:29 10568 ----a-w c:\windows\2194h5cktozl761.exe
2009-11-02 21:16 . 2009-11-02 21:16 5489 ----a-w c:\windows\3b90z5r5579.exe
2009-11-02 20:09 . 2009-11-02 20:09 16999 ----a-w c:\windows\19286zpambot7c5.exe
2009-11-01 16:51 . 2009-11-01 16:51 15093 ----a-w c:\windows\59268troj4z1.bin
2009-11-01 08:19 . 2009-11-01 08:19 16406 ----a-w c:\windows\system32\3537worz97.dll
2009-11-01 02:04 . 2009-11-01 02:04 6001 ----a-w c:\windows\59395irusz9.exe
2009-10-28 20:22 . 2009-10-28 20:22 10077 ----a-w c:\windows\system32\25f1backdozr2919.exe
2009-10-25 11:20 . 2009-10-25 11:20 8114 ----a-w c:\windows\system32\49f1t59ef353z.bin
2009-10-24 22:56 . 2009-10-24 22:56 6108 ----a-w c:\windows\1490wz5md8.dll
2009-10-24 10:09 . 2009-10-24 10:09 15098 ----a-w c:\windows\486cza5kdoor129.exe
2009-10-23 02:47 . 2009-10-23 02:47 13585 ----a-w c:\windows\system32\6599backdoor95z.dll
2009-10-15 02:17 . 2009-10-15 02:17 10287 ----a-w c:\windows\system32\31296sp5m9otzf6.dll
2009-10-14 08:26 . 2009-10-14 08:26 10069 ----a-w c:\windows\system32\390zteal5956.dll
2009-10-13 04:00 . 2009-10-13 04:00 4097 ----a-w c:\windows\system32\4df0spywaze5129.dll
2009-10-12 15:21 . 2009-10-12 15:21 9476 ----a-w c:\windows\system32\32499zr5j567.bin
2009-10-12 02:43 . 2009-10-12 02:43 11312 ----a-w c:\windows\system32\29257szy9f3.dll
2009-10-11 15:02 . 2009-10-11 15:02 7903 ----a-w c:\windows\system32\22635zckdoor6999.bin
2009-10-11 11:00 . 2009-10-11 11:00 14896 ----a-w c:\windows\6c3e59zal1037.dll
2009-10-11 01:20 . 2009-10-11 01:20 2766 ----a-w c:\windows\system32\19565spamzot5b3.exe
2009-10-09 05:38 . 2009-10-09 05:38 17287 ----a-w c:\windows\24511wo9m7z5.bin
2009-10-08 14:45 . 2009-10-08 14:45 3285 ----a-w c:\windows\95924not-a-vir5s1cz.bin
2009-10-06 20:14 . 2009-10-06 20:14 4623 ----a-w c:\windows\system32\5b6astea92497z.exe
2009-10-04 17:57 . 2009-10-04 17:57 4111 ----a-w c:\windows\2e935teal159z.dll
2009-10-04 14:00 . 2009-10-04 14:00 9699 ----a-w c:\windows\5z425spy9da.bin
2009-09-25 22:35 . 2009-09-25 22:35 7211 ----a-w c:\windows\system32\545zbac5door559.dll
2009-09-25 12:16 . 2009-09-25 12:16 6255 ----a-w c:\windows\59a4thz5at23219.exe
2009-09-25 05:59 . 2009-09-25 05:59 7418 ----a-w c:\windows\system32\z8486s5y199.dll
2009-09-22 13:55 . 2009-09-22 13:55 10580 ----a-w c:\windows\17z689pambot385.dll
2009-09-20 20:39 . 2009-09-20 20:39 6960 ----a-w c:\windows\2ae4zpywa9e1295.exe
2009-09-19 14:37 . 2009-09-19 14:37 5291 ----a-w c:\windows\system32\2czft5ief9164.exe
2009-09-19 01:11 . 2009-09-19 01:11 13113 ----a-w c:\windows\system32\30352wozm5769.exe
2009-09-17 11:49 . 2009-09-17 11:49 11641 ----a-w c:\windows\system32\33z8th9ef3561.bin
2009-09-13 08:41 . 2009-09-13 08:41 14190 ----a-w c:\windows\system32\497bbazkdoor29835.exe
2009-09-10 23:35 . 2009-09-10 23:35 10400 ----a-w c:\windows\9e9csteal51z0.bin
2009-09-10 22:57 . 2009-09-10 22:57 11788 ----a-w c:\windows\95a7addwa5e8z7.dll
2009-09-07 00:07 . 2009-09-07 00:07 6217 ----a-w c:\windows\system32\9z740spy556.bin
2009-09-06 19:49 . 2009-09-06 19:49 8627 ----a-w c:\windows\system32\6595zddware547.bin
2009-09-04 13:03 . 2009-09-04 13:03 16700 ----a-w c:\windows\1z0c5hie9781.bin
2009-09-01 11:13 . 2009-09-01 11:13 3218 ----a-w c:\windows\4553troj7z9.bin
2009-08-28 15:41 . 2009-08-28 15:41 13791 ----a-w c:\windows\141s9eal564z.dll
2009-08-28 15:16 . 2009-08-28 15:16 17641 ----a-w c:\windows\system32\653bst9zl957.dll
2009-08-26 21:31 . 2009-08-26 21:31 13435 ----a-w c:\windows\6d59vir20z1.dll
2009-08-26 06:56 . 2009-08-26 06:56 5570 ----a-w c:\windows\system32\219095rojz9f.dll
2009-08-22 11:04 . 2009-08-22 11:04 3478 ----a-w c:\windows\system32\27z119roj195.bin
2009-08-21 05:29 . 2009-08-21 05:29 11788 ----a-w c:\windows\system32\2793a95ware3244z.dll
2009-08-12 13:07 . 2009-08-12 13:07 7102 ----a-w c:\windows\368z5dd9are2670.dll
2009-08-10 01:06 . 2009-08-10 01:06 11874 ----a-w c:\windows\59580zpy7d.exe
2009-08-09 14:43 . 2009-08-09 14:43 15118 ----a-w c:\windows\215399ormz2f.exe
2009-08-09 11:07 . 2009-08-09 11:07 3350 ----a-w c:\windows\13sparse9z52.dll
2009-08-04 15:54 . 2009-08-04 15:54 17878 ----a-w c:\windows\4959addwa5z2992.dll
2009-08-02 08:38 . 2009-08-02 08:38 5068 ----a-w c:\windows\system32\56971trzj5e89.dll
2009-07-26 10:37 . 2009-07-26 10:37 4134 ----a-w c:\windows\system32\zde0d5wnloader5519.exe
2009-07-25 12:40 . 2009-07-25 12:40 2697 ----a-w c:\windows\system32\9047downlo5dzr579.dll
2009-07-25 09:37 . 2009-07-25 09:37 15463 ----a-w c:\windows\system32\1095t5reat3772z.bin
2009-07-24 23:33 . 2009-07-24 23:33 3870 ----a-w c:\windows\system32\22d5a9dwarz1589.dll
2009-07-22 15:56 . 2009-07-22 15:56 2794 ----a-w c:\windows\system32\65d9spy5aze14119.bin
2009-07-18 18:06 . 2009-07-18 18:06 13279 ----a-w c:\windows\9za0threat29953.bin
2009-07-15 23:26 . 2009-07-15 23:26 14475 ----a-w c:\windows\system32\5945thrzat24713.bin
2009-07-15 00:39 . 2009-07-15 00:39 15030 ----a-w c:\windows\system32\11351hackz9ol42b.exe
2009-07-12 15:48 . 2009-07-12 15:48 10140 ----a-w c:\windows\system32\3z806hacktool905.bin
2009-07-10 04:32 . 2009-07-10 04:32 11519 ----a-w c:\windows\system32\698ddownloade529z7.dll
2009-07-08 23:21 . 2009-07-08 23:21 6692 ----a-w c:\windows\system32\282925ot-azvirus594.exe
2009-07-05 18:57 . 2009-07-05 18:57 3382 ----a-w c:\windows\19309not-a-virzs935.dll
2009-07-05 00:08 . 2009-07-05 00:08 8692 ----a-w c:\windows\system32\315599pz1d4.exe
2009-07-04 16:57 . 2009-07-04 16:57 15910 ----a-w c:\windows\system32\30629ownl5adez2869.exe
2009-07-02 18:05 . 2009-07-02 18:05 13746 ----a-w c:\windows\2438znot-9-vir5s25.dll
2009-06-28 10:57 . 2009-06-28 10:57 17590 ----a-w c:\windows\35355teal9z9.exe
2009-06-23 22:40 . 2009-06-23 22:40 3776 ----a-w c:\windows\4f5tzreat25953.dll
2009-06-23 13:49 . 2009-06-23 13:49 10916 ----a-w c:\windows\54aath9ez1548.dll
2009-06-22 20:21 . 2009-06-22 20:21 13242 ----a-w c:\windows\system32\43z75roj44e9.bin
2009-06-22 00:15 . 2009-06-22 00:15 14281 ----a-w c:\windows\system32\1bddsp95se254z.dll
2009-06-20 03:53 . 2009-06-20 03:53 13170 ----a-w c:\windows\490athrezt294275.bin
2009-06-19 12:24 . 2009-06-19 12:24 5499 ----a-w c:\windows\9349spamb5tzbe.exe
2009-06-17 20:47 . 2009-06-17 20:47 7140 ----a-w c:\windows\79cspa5se1915z.dll
2009-06-16 01:42 . 2009-06-16 01:42 12761 ----a-w c:\windows\54d7bac9door1z25.dll
2009-06-15 18:33 . 2009-06-15 18:33 7996 ----a-w c:\windows\5597spamzo95e4.dll
2009-06-13 17:54 . 2009-06-13 17:54 3219 ----a-w c:\windows\7fz2b9ckdoor9645.exe
2009-06-11 11:47 . 2009-06-11 11:47 11886 ----a-w c:\windows\15429szam95t5bb.exe
2009-06-07 03:13 . 2009-06-07 03:13 13120 ----a-w c:\windows\5bcfazdwa9e17235.bin
2009-06-04 18:43 . 2009-06-04 18:43 3778 ----a-w c:\windows\system32\55518spa9bzt264.dll
2009-05-28 08:08 . 2009-05-28 08:08 17705 ----a-w c:\windows\system32\36az9teal2385.dll
2009-05-24 18:34 . 2009-05-24 18:34 6752 ----a-w c:\windows\27z5b9ckdoor2474.bin
2009-05-21 15:51 . 2009-05-21 15:51 7171 ----a-w c:\windows\920dsteal1951z.bin
2009-05-20 20:30 . 2009-05-20 20:30 12429 ----a-w c:\windows\3051znot-a-virus2b9.exe
2009-05-17 13:08 . 2009-05-17 13:08 4116 ----a-w c:\windows\f35tzi5f196.bin
2009-05-16 17:44 . 2009-05-16 17:44 3352 ----a-w c:\windows\2za9s9ea52970.dll
2009-05-15 18:59 . 2009-05-15 18:59 14286 ----a-w c:\windows\23a5download9rz306.bin
2009-05-14 07:38 . 2009-05-14 07:38 9330 ----a-w c:\windows\77945hreat1z293.exe
2009-05-13 17:51 . 2009-05-13 17:51 7905 ----a-w c:\windows\6dz0vir19305.bin

.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Wed May 13, 2009 3:54 pm

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-13 13:10 . 2009-02-21 18:06 -------- d-----w c:\program files\Common Files\Akamai
2009-05-13 05:53 . 2008-01-19 12:57 -------- d-----w c:\program files\Microsoft Silverlight
2009-05-12 14:14 . 2009-02-04 04:33 81984 ----a-w c:\windows\system32\bdod.bin
2009-05-12 13:38 . 2009-02-03 18:40 -------- d-----w c:\program files\BitDefender
2009-05-10 11:54 . 2009-05-10 11:54 104328 ----a-w c:\windows\system32\drivers\bdfndisf.sys.upd
2009-05-10 04:35 . 2008-09-18 11:50 -------- d-----w c:\program files\DNA
2009-04-17 10:20 . 2008-08-19 13:27 -------- d-----w c:\program files\EA GAMES
2009-04-12 06:05 . 2009-04-12 06:05 15369 ----a-w c:\windows\22z90tr5j38b.exe
2009-04-10 14:19 . 2009-04-10 14:19 14705 ----a-w c:\windows\system32\5a70a9dwzre929.exe
2009-04-10 13:43 . 2009-04-10 13:43 22328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-04-10 13:43 . 2009-04-10 13:43 22328 ----a-w c:\documents and settings\ace\Application Data\PnkBstrK.sys
2009-04-10 13:43 . 2009-04-10 13:43 107832 ------w c:\windows\system32\PnkBstrB.exe
2009-04-10 13:43 . 2009-04-10 13:43 682280 ----a-w c:\windows\system32\pbsvc.exe
2009-04-10 13:43 . 2009-04-10 13:43 66872 ------w c:\windows\system32\PnkBstrA.exe
2009-04-09 17:15 . 2008-08-17 18:19 -------- d-----w c:\program files\EA Sports
2009-04-09 16:49 . 2008-01-15 11:00 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-09 14:37 . 2009-04-09 14:37 2855 ----a-w c:\windows\PIF\rld-fi9k.PIF
2009-04-07 12:40 . 2009-04-07 12:40 17779 ----a-w c:\windows\9c55threaz8458.bin
2009-04-07 07:42 . 2009-04-07 07:42 14855 ----a-w c:\windows\7150thi5f11z29.dll
2009-04-07 06:07 . 2009-04-07 06:07 15142 ----a-w c:\windows\system32\18acad9ware2350z.exe
2009-04-06 18:09 . 2009-04-06 18:09 5653 ----a-w c:\windows\system32\59ecthie5373z.bin
2009-04-06 02:57 . 2009-04-06 02:57 10059 ----a-w c:\windows\system32\fz8stea95084.dll
2009-04-03 18:57 . 2009-04-03 18:57 11349 ----a-w c:\windows\system32\5068backd5o9z53.bin
2009-04-03 16:27 . 2009-04-03 16:27 15440 ----a-w c:\windows\system32\18z695py19a9.exe
2009-04-02 16:26 . 2009-03-28 07:59 -------- d-----w c:\program files\3GP Player
2009-04-02 09:14 . 2009-04-02 09:14 15672 ----a-w c:\windows\system32\3850z9y559.exe
2009-03-29 17:55 . 2009-03-29 17:55 -------- d-----w c:\program files\mTC
2009-03-27 11:13 . 2009-03-27 11:13 10799 ----a-w c:\windows\system32\3594not-a-virusz35.exe
2009-03-26 22:59 . 2009-03-26 22:59 3827 ----a-w c:\windows\a3zth9ef56.bin
2009-03-26 01:35 . 2009-03-26 01:35 9242 ----a-w c:\windows\system32\2dc9do5nloadez128.bin
2009-03-25 20:23 . 2009-03-25 20:23 6214 ----a-w c:\windows\system32\9d52backzoor425.exe
2009-03-24 20:24 . 2009-03-24 20:24 5551 ----a-w c:\windows\96s9ywarez153.exe
2009-03-19 05:42 . 2009-03-19 05:42 14662 ----a-w c:\windows\z80bac5do9r3018.dll
2009-03-18 07:28 . 2009-02-05 15:42 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-18 07:28 . 2008-01-17 13:32 -------- d-----w c:\program files\Java
2009-03-18 02:34 . 2009-03-18 02:34 17472 ----a-w c:\windows\system32\2f5zddw9re254.bin
2009-03-16 17:18 . 2009-03-16 17:18 8266 ----a-w c:\windows\2700zp59bot2a0.dll
2009-03-15 22:50 . 2009-03-15 22:50 3481 ----a-w c:\windows\25079virus255z.bin
2009-03-12 07:19 . 2009-03-12 07:19 8141 ----a-w c:\windows\system32\18816not-azvirus985.dll
2009-03-06 14:44 . 2004-08-04 04:56 283648 ----a-w c:\windows\system32\pdh.dll
2009-03-05 09:49 . 2009-03-05 09:49 4412 ----a-w c:\windows\93069ot-5-virus7a1z.dll
2009-02-27 09:41 . 2009-02-27 09:41 7546 ----a-w c:\windows\54ezvir2930.exe
2009-02-26 23:02 . 2009-02-26 23:02 17133 ----a-w c:\windows\system32\1b69spyzare2598.exe
2009-02-25 15:58 . 2009-02-25 15:58 17092 ----a-w c:\windows\system32\4559zroj3fe.bin
2009-02-20 22:50 . 2009-02-20 22:50 4087 ----a-w c:\windows\3z819ackdoo52902.dll
2009-02-20 19:32 . 2009-02-20 19:32 8958 ----a-w c:\windows\1z996spy5f7.dll
2009-02-19 09:34 . 2009-02-19 09:34 10566 ----a-w c:\windows\system32\1745tz5ef3759.bin
2009-02-18 05:12 . 2009-02-18 05:12 3144 ----a-w c:\windows\53452ha9ztool69d.bin
2009-02-17 20:39 . 2009-02-17 20:39 128840 ----a-w c:\windows\system32\Metacafe.scr
2009-01-29 15:18 . 2009-01-29 15:18 27976 ----a-w c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-01-29 15:18 . 2009-01-29 15:18 126360 ----a-w c:\program files\mozilla firefox\plugins\atgpcext.dll
2009-01-29 15:25 . 2009-01-29 15:28 46408 ----a-w c:\program files\mozilla firefox\plugins\atmccli.dll
2009-01-29 16:59 . 2009-01-29 15:28 98712 ----a-w c:\program files\mozilla firefox\plugins\ieatgpc.dll
2009-01-29 15:35 . 2009-01-29 15:35 32768 ----a-w c:\program files\mozilla firefox\plugins\ptexmeet.dll
2009-03-05 12:38 . 2009-05-12 13:46 49664 ----a-w c:\program files\mozilla firefox\components\FFComm.dll
.

------- Sigcheck -------

[-] 2004-08-04 04:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\system32\svchost.exe
[-] 2004-08-04 04:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\system32\dllcache\svchost.exe

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2004-08-04 04:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\dllcache\user32.dll

[-] 2004-08-04 04:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\system32\ws2_32.dll
[-] 2004-08-04 04:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\system32\dllcache\ws2_32.dll

[-] 2007-10-11 05:57 666112 80D660A49E0D118144423099B2A9F5DA c:\windows\$hf_mig$\KB942615\SP2QFE\wininet.dll
[-] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2007-12-07 00:44 666112 085A7C37F9C6EDE1BA870B7DBEC06399 c:\windows\$hf_mig$\KB944533\SP2QFE\wininet.dll
[-] 2007-12-07 02:01 825344 B5B411BB229AE6EAD7652A32ED47BFB9 c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[-] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[-] 2008-04-23 03:35 827392 41546B396A526918DA7995A02EA04E51 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[-] 2008-06-23 16:01 827904 C66402A06B83B036C195242C0C8CF83C c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
[-] 2004-08-04 04:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\$NtUninstallKB942615$\wininet.dll
[-] 2007-10-11 06:13 659456 2005AD86A22AEE68E21EE59F9CCB77F2 c:\windows\$NtUninstallKB944533$\wininet.dll
[-] 2007-12-07 01:07 659456 57D1B5150CF6331FAC6B3E04C1FCB966 c:\windows\ie7\wininet.dll
[-] 2007-08-13 13:24 818688 A4A0FC92358F39538A6494C42EF99FE9 c:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\ie7updates\KB944533-IE7\wininet.dll
[-] 2007-12-07 02:21 824832 806D274C9A6C3AAEA5EAE8E4AF841E04 c:\windows\ie7updates\KB947864-IE7\wininet.dll
[-] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\ie7updates\KB950759-IE7\wininet.dll
[-] 2008-04-23 04:16 817152 F82DC979E1F334DF0C893B3BFDEB404E c:\windows\ie7updates\KB953838-IE7\wininet.dll
[-] 2008-06-23 16:57 826368 8C13D4A7479FA0A026EDA8ABCE82C0ED c:\windows\ie8\wininet.dll
[-] 1999-04-23 23:52 459024 A632F824282A1F84BD1E3798978030C7 c:\windows\system\WININET.DLL
[-] 2008-08-21 21:38 878592 DF1CB456ED1E038B276123365A1A93C4 c:\windows\system32\wininet.dll
[-] 2008-08-21 21:38 878592 DF1CB456ED1E038B276123365A1A93C4 c:\windows\system32\dllcache\wininet.dll

[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2004-08-04 03:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-04 04:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\system32\winlogon.exe
[-] 2004-08-04 04:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\system32\dllcache\winlogon.exe

[-] 2004-08-04 03:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-04 03:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\drivers\ndis.sys

[-] 2004-08-04 03:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-04 03:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\drivers\ip6fw.sys

[-] 2005-03-02 00:36 2056832 D8ABA3EAB509627E707A3B14F00FBB6B c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2007-02-28 09:15 2059392 4D3DBDCCBF97F5BA1E74F322B155C3BA c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[-] 2009-02-06 09:49 2062976 9D832AF3FD1917DB0E1E8B2F000A2E3A c:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe
[-] 2009-02-07 13:32 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe
[-] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2008-08-14 09:18 2062976 63EC865DFF6CCFC7BEF94B5C50297CAD c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
[-] 2008-08-14 09:33 2066048 4AC58F03EB94A72809949D757FC39D80 c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
[-] 2008-08-14 10:09 2066048 A25E9B86EFFB2AF33BF51E676B68BFB0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[-] 2004-08-04 05:05 2015232 FB142B7007CA2EEA76966C6C5CC12150 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
[-] 2005-03-02 00:34 2015232 3CD941E472DDF3534E53038535719771 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[-] 2008-08-14 09:22 2015744 DC097A896A03B8277457D228FD12D4E6 c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[-] 2007-02-28 08:38 2015744 A58AC1C6199EF34228ABEE7FC057AE09 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\ntkrnlpa.exe
[-] 2009-02-06 09:49 2062976 9D832AF3FD1917DB0E1E8B2F000A2E3A c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\ntkrnlpa.exe
[-] 2009-02-07 13:32 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\ntkrnlpa.exe
[-] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\ntkrnlpa.exe
[-] 2009-02-06 16:49 2015744 B238AB60093BABFE76AEC8F34B4D399D c:\windows\system32\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\system32\dllcache\ntkrnlpa.exe

[-] 2005-03-02 01:04 2179456 28187802B7C368C0D3AEF7D4C382AABB c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2007-02-28 09:55 2182144 5A5C8DB4AA962C714C8371FBDF189FC9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 10:32 2186112 6A936E9D7BADAF3CAAEED1E1966EC1B0 c:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe
[-] 2009-02-07 14:05 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[-] 2008-08-14 09:57 2185984 CE69DBD54221F2D40E49FF6DB77C6507 c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
[-] 2008-08-14 10:11 2189184 EEAF32F8E15A24F62BECB1BD403BB5C5 c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
[-] 2008-08-14 10:41 2189184 31914172342BFF330063F343AC6958FE c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[-] 2004-08-04 03:18 2148352 626309040459C3915997EF98EC1C8D40 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
[-] 2005-03-02 00:57 2135552 48B3E89AF7074CEE0314A3E0C7FAFFDB c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[-] 2008-08-14 09:58 2136064 DD31AB4B91C2605601A3C108AF57A0C9 c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[-] 2007-02-28 09:08 2136064 1220FAF071DEA8653EE21DE7DCDA8BFD c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\ntoskrnl.exe
[-] 2009-02-06 10:32 2186112 6A936E9D7BADAF3CAAEED1E1966EC1B0 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\ntoskrnl.exe
[-] 2009-02-07 14:05 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\ntoskrnl.exe
[-] 2009-02-06 17:22 2136064 16B5EBE97F243441264A8F8694C2F2AA c:\windows\system32\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\system32\dllcache\ntoskrnl.exe

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Wed May 13, 2009 3:55 pm

[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2004-08-04 04:56 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2007-06-13 10:23 975360 9784E0719124E4A23989AEF9E7CA02D6 c:\windows\system32\dllcache\explorer.exe

[-] 2009-02-06 10:22 110592 4712531AB7A01B7EE059853CA17D39BD c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe
[-] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2004-08-04 04:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\$NtUninstallKB956572$\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\services.exe
[-] 2009-02-06 10:22 110592 4712531AB7A01B7EE059853CA17D39BD c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\services.exe
[-] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\system32\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\system32\dllcache\services.exe

[-] 2004-08-04 04:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\system32\lsass.exe
[-] 2004-08-04 04:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\system32\dllcache\lsass.exe

[-] 2004-08-04 04:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\system32\ctfmon.exe
[-] 2004-08-04 04:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\system32\dllcache\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2004-08-04 04:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\dllcache\spoolsv.exe

[-] 2004-08-04 04:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\system32\userinit.exe
[-] 2004-08-04 04:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\system32\dllcache\userinit.exe

[-] 2004-08-04 04:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\system32\termsrv.dll
[-] 2004-08-04 04:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\system32\dllcache\termsrv.dll

[-] 2004-08-04 04:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\system32\powrprof.dll
[-] 2004-08-04 04:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\system32\dllcache\powrprof.dll

[-] 2004-08-04 04:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\system32\imm32.dll
[-] 2004-08-04 04:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\system32\dllcache\imm32.dll

[-] 2004-08-04 04:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\system32\sfcfiles.dll
[-] 2004-08-04 04:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\system32\dllcache\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"VisualTooltip"="e:\downloads\windows\crystalxp\visual\VisualToolTip.exe" [2007-04-25 956928]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-18 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-08 778240]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Metacafe.lnk - c:\program files\Metacafe\MetacafeAgent.exe [2009-2-18 145736]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\ace\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\ace\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3676:TCP"= 3676:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
"1033:TCP"= 1033:TCP:Akamai NetSession Interface
"1044:TCP"= 1044:TCP:Akamai NetSession Interface
"1041:TCP"= 1041:TCP:Akamai NetSession Interface
"1032:TCP"= 1032:TCP:Akamai NetSession Interface
"1523:TCP"= 1523:TCP:Akamai NetSession Interface
"1043:TCP"= 1043:TCP:Akamai NetSession Interface
"2672:TCP"= 2672:TCP:Akamai NetSession Interface
"1047:TCP"= 1047:TCP:Akamai NetSession Interface
"1040:TCP"= 1040:TCP:Akamai NetSession Interface
"1045:TCP"= 1045:TCP:Akamai NetSession Interface
"1039:TCP"= 1039:TCP:Akamai NetSession Interface
"2705:TCP"= 2705:TCP:Akamai NetSession Interface
"1076:TCP"= 1076:TCP:Akamai NetSession Interface
"1050:TCP"= 1050:TCP:Akamai NetSession Interface
"1051:TCP"= 1051:TCP:Akamai NetSession Interface
"1042:TCP"= 1042:TCP:Akamai NetSession Interface
"1071:TCP"= 1071:TCP:Akamai NetSession Interface
"1036:TCP"= 1036:TCP:Akamai NetSession Interface
"1031:TCP"= 1031:TCP:Akamai NetSession Interface
"1034:TCP"= 1034:TCP:Akamai NetSession Interface
"2567:TCP"= 2567:TCP:Akamai NetSession Interface
"1083:TCP"= 1083:TCP:Akamai NetSession Interface
"3649:TCP"= 3649:TCP:Akamai NetSession Interface
"1048:TCP"= 1048:TCP:Akamai NetSession Interface
"1049:TCP"= 1049:TCP:Akamai NetSession Interface
"1063:TCP"= 1063:TCP:Akamai NetSession Interface
"1038:TCP"= 1038:TCP:Akamai NetSession Interface
"1115:TCP"= 1115:TCP:Akamai NetSession Interface
"1079:TCP"= 1079:TCP:Akamai NetSession Interface
"1046:TCP"= 1046:TCP:Akamai NetSession Interface
"1087:TCP"= 1087:TCP:Akamai NetSession Interface
"3087:TCP"= 3087:TCP:Akamai NetSession Interface
"1037:TCP"= 1037:TCP:Akamai NetSession Interface
"4404:TCP"= 4404:TCP:Akamai NetSession Interface
"1388:TCP"= 1388:TCP:Akamai NetSession Interface
"1342:TCP"= 1342:TCP:Akamai NetSession Interface
"1072:TCP"= 1072:TCP:Akamai NetSession Interface
"1469:TCP"= 1469:TCP:Akamai NetSession Interface
"2853:TCP"= 2853:TCP:Akamai NetSession Interface
"1460:TCP"= 1460:TCP:Akamai NetSession Interface

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Wed May 13, 2009 3:56 pm

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [8/4/2004 10:26 AM 14336]
R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [10/6/2008 6:16 PM 82696]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [9/18/2008 12:09 PM 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2/12/2009 4:52 PM 104328]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [1/20/2009 7:16 PM 172032]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [10/5/2008 8:15 PM 33752]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [3/19/2008 11:11 PM 13352]
S3 Ndisprot;ArcNet NDIS Protocol Driver;c:\windows\system32\drivers\ndisprot.sys [12/1/2008 7:08 PM 27904]
S3 ntportio;ntportio; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
Akamai REG_MULTI_SZ Akamai

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90ab394e-99cd-11dd-aefa-001bb9bc6506}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com g:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc15549d-c432-11dc-bf87-001bb9bc6506}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com g:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc15549e-c432-11dc-bf87-001bb9bc6506}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com h:
.
Contents of the 'Scheduled Tasks' folder

2009-05-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-2146901713-839522115-1003.job
- c:\documents and settings\ace\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-25 11:12]

2009-05-13 c:\windows\Tasks\User_Feed_Synchronization-{8FF5E086-A276-4C2E-8EE8-A375FE0F689A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 21:35]
.
- - - - ORPHANS REMOVED - - - -

BHO-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
BHO-{C1B58917-66F7-42A6-B068-1A166E45FB37} - (no file)
WebBrowser-{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC} - (no file)
WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)
Notify-WgaLogon - (no file)


.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {BDF43518-8EE6-418C-9110-714B8BF8B4EA} = 202.56.215.54,202.56.215.55
DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - plugin: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\iaplayer@instantaction.com\plugins\npiaplayer.dll
FF - plugin: c:\documents and settings\ace\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\ace\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\progra~1\MOZILL~1\plugins\np_gp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npExentCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\VLC\npvlc.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-05-13 19:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-2146901713-839522115-1003\Software\YourCompanyName\YourProductName\Version*]
"VersionData"=hex:0c,42,46,f6,23,bc,3e,2d,7a,2e,97,ca,8b,29,77,15,00,f2,c3,72,
58,b5,be,94,1f,90,16,e0,3a,99,33,1e,44,b0,15,57,a9,8e,58,50,89,88,82,88,9d,\
.
Completion time: 2009-05-13 19:14
ComboFix-quarantined-files.txt 2009-05-13 13:44

Pre-Run: 10,819,313,664 bytes free
Post-Run: 12,204,498,944 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

466 --- E O F --- 2009-05-12 15:12

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Wed May 13, 2009 4:03 pm

Hello.
These logs look confusing, did you install BitDefender AFTER running DDS and BEFORE running Combofix?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Thu May 14, 2009 6:48 am

yes i did but i disabled antivirus/and other protection....now i will first uninstall bit defender and than run combofix again, after that i will post combofix log again..is that ok?

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Thu May 14, 2009 8:42 am

No, don't do that. Shocking Whoa

For now, just keep BitDefender disabled.

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
Ndisprot
ntportio

File::
c:\windows\system32\drivers\ndisprot.sys
c:\windows\320129ot-5-virusz1.dll
c:\windows\system32\2697sp95ze2027.exe
c:\windows\77b2st9al1550z.bin
c:\windows\system32\13369hz5ktool7a6.dll
c:\windows\4487zh9eat312365.dll
c:\windows\15z91viru56d59.exe
c:\windows\1b67spy5a9e21z9.dll
c:\windows\system32\159fsteaz30879.exe
c:\windows\system32\31zavir5092.bin
c:\windows\252eztea91509.exe
c:\windows\63z5vir5689.dll
c:\windows\9293downloaz5r1942.bin
c:\windows\system32\28e2spz59e1821.exe
c:\windows\system32\777zs5eal13059.dll
c:\windows\system32\5718hzck9o5l4c5.exe
c:\windows\system32\2126spywzr53159.dll
c:\windows\system32\3d51thrza914155.bin
c:\windows\system32\20517noz-a-virus195.exe
c:\windows\system32\41azp95are1557.exe
c:\windows\system32\8179hackz9ol757.exe
c:\windows\system32\819trzj5d5.bin
c:\windows\205z6wor9545.exe
c:\windows\system32\95z07not-a-virus439.bin
c:\windows\548d5hreat28z659.exe
c:\windows\system32\15z50troj25f9.dll
c:\windows\34a9ad5waze155.bin
c:\windows\21802not-a-9iru548z.exe
c:\windows\zfa6threat1599.dll
c:\windows\system32\9ea5threat2z044.bin
c:\windows\5da559ezl477.exe
c:\windows\system32\eb8spzwa5e1109.bin
c:\windows\system32\92535hreat30467z.exe
c:\windows\25z79virus5705.bin
c:\windows\system32\12545worm7cz9.exe
c:\windows\449zhi5f387.dll
c:\windows\system32\1654zs5ambo9787.bin
c:\windows\2194h5cktozl761.exe
c:\windows\3b90z5r5579.exe
c:\windows\19286zpambot7c5.exe
c:\windows\59268troj4z1.bin
c:\windows\system32\3537worz97.dll
c:\windows\59395irusz9.exe
c:\windows\system32\25f1backdozr2919.exe
c:\windows\system32\49f1t59ef353z.bin
c:\windows\1490wz5md8.dll
c:\windows\486cza5kdoor129.exe
c:\windows\system32\6599backdoor95z.dll
c:\windows\system32\31296sp5m9otzf6.dll
c:\windows\system32\390zteal5956.dll
c:\windows\system32\4df0spywaze5129.dll
c:\windows\system32\32499zr5j567.bin
c:\windows\system32\29257szy9f3.dll
c:\windows\system32\22635zckdoor6999.bin
c:\windows\6c3e59zal1037.dll
c:\windows\system32\19565spamzot5b3.exe
c:\windows\24511wo9m7z5.bin
c:\windows\95924not-a-vir5s1cz.bin
c:\windows\system32\5b6astea92497z.exe
c:\windows\2e935teal159z.dll
c:\windows\5z425spy9da.bin
c:\windows\system32\545zbac5door559.dll
c:\windows\59a4thz5at23219.exe
c:\windows\system32\z8486s5y199.dll
c:\windows\17z689pambot385.dll
c:\windows\2ae4zpywa9e1295.exe
c:\windows\system32\2czft5ief9164.exe
c:\windows\system32\30352wozm5769.exe
c:\windows\system32\33z8th9ef3561.bin
c:\windows\system32\497bbazkdoor29835.exe
c:\windows\9e9csteal51z0.bin
c:\windows\95a7addwa5e8z7.dll
c:\windows\system32\9z740spy556.bin
c:\windows\system32\6595zddware547.bin
c:\windows\1z0c5hie9781.bin
c:\windows\4553troj7z9.bin
c:\windows\141s9eal564z.dll
c:\windows\system32\653bst9zl957.dll
c:\windows\6d59vir20z1.dll
c:\windows\system32\219095rojz9f.dll
c:\windows\system32\27z119roj195.bin
c:\windows\system32\2793a95ware3244z.dll
c:\windows\368z5dd9are2670.dll
c:\windows\59580zpy7d.exe
c:\windows\215399ormz2f.exe
c:\windows\13sparse9z52.dll
c:\windows\4959addwa5z2992.dll
c:\windows\system32\56971trzj5e89.dll
c:\windows\system32\zde0d5wnloader5519.exe
c:\windows\system32\9047downlo5dzr579.dll
c:\windows\system32\1095t5reat3772z.bin
c:\windows\system32\22d5a9dwarz1589.dll
c:\windows\system32\65d9spy5aze14119.bin
c:\windows\9za0threat29953.bin
c:\windows\system32\5945thrzat24713.bin
c:\windows\system32\11351hackz9ol42b.exe
c:\windows\system32\3z806hacktool905.bin
c:\windows\system32\698ddownloade529z7.dll
c:\windows\system32\282925ot-azvirus594.exe
c:\windows\19309not-a-virzs935.dll
c:\windows\system32\315599pz1d4.exe
c:\windows\system32\30629ownl5adez2869.exe
c:\windows\2438znot-9-vir5s25.dll
c:\windows\35355teal9z9.exe
c:\windows\4f5tzreat25953.dll
c:\windows\54aath9ez1548.dll
c:\windows\system32\43z75roj44e9.bin
c:\windows\system32\1bddsp95se254z.dll
c:\windows\490athrezt294275.bin
c:\windows\9349spamb5tzbe.exe
c:\windows\79cspa5se1915z.dll
c:\windows\54d7bac9door1z25.dll
c:\windows\5597spamzo95e4.dll
c:\windows\7fz2b9ckdoor9645.exe
c:\windows\15429szam95t5bb.exe
c:\windows\5bcfazdwa9e17235.bin
c:\windows\system32\55518spa9bzt264.dll
c:\windows\system32\36az9teal2385.dll
c:\windows\27z5b9ckdoor2474.bin
c:\windows\920dsteal1951z.bin
c:\windows\3051znot-a-virus2b9.exe
c:\windows\f35tzi5f196.bin
c:\windows\2za9s9ea52970.dll
c:\windows\23a5download9rz306.bin
c:\windows\77945hreat1z293.exe
c:\windows\6dz0vir19305.bin

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90ab394e-99cd-11dd-aefa-001bb9bc6506}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc15549e-c432-11dc-bf87-001bb9bc6506}]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Thu May 14, 2009 1:21 pm

done....but my system took a hell lot of a time to shut down so i pressed the restart button...i hope i have not done anything wrong....

here are the log files:

ComboFix 09-05-13.02 - ace 05/14/2009 18:32.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.221 [GMT 5.5:30]
Running from: c:\documents and settings\ace\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\ace\Desktop\CFScript.txt
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
* Created a new restore point

FILE ::
c:\windows\13sparse9z52.dll
c:\windows\141s9eal564z.dll
c:\windows\1490wz5md8.dll
c:\windows\15429szam95t5bb.exe
c:\windows\15z91viru56d59.exe
c:\windows\17z689pambot385.dll
c:\windows\19286zpambot7c5.exe
c:\windows\19309not-a-virzs935.dll
c:\windows\1b67spy5a9e21z9.dll
c:\windows\1z0c5hie9781.bin
c:\windows\205z6wor9545.exe
c:\windows\215399ormz2f.exe
c:\windows\21802not-a-9iru548z.exe
c:\windows\2194h5cktozl761.exe
c:\windows\23a5download9rz306.bin
c:\windows\2438znot-9-vir5s25.dll
c:\windows\24511wo9m7z5.bin
c:\windows\252eztea91509.exe
c:\windows\25z79virus5705.bin
c:\windows\27z5b9ckdoor2474.bin
c:\windows\2ae4zpywa9e1295.exe
c:\windows\2e935teal159z.dll
c:\windows\2za9s9ea52970.dll
c:\windows\3051znot-a-virus2b9.exe
c:\windows\320129ot-5-virusz1.dll
c:\windows\34a9ad5waze155.bin
c:\windows\35355teal9z9.exe
c:\windows\368z5dd9are2670.dll
c:\windows\3b90z5r5579.exe
c:\windows\4487zh9eat312365.dll
c:\windows\449zhi5f387.dll
c:\windows\4553troj7z9.bin
c:\windows\486cza5kdoor129.exe
c:\windows\490athrezt294275.bin
c:\windows\4959addwa5z2992.dll
c:\windows\4f5tzreat25953.dll
c:\windows\548d5hreat28z659.exe
c:\windows\54aath9ez1548.dll
c:\windows\54d7bac9door1z25.dll
c:\windows\5597spamzo95e4.dll
c:\windows\59268troj4z1.bin
c:\windows\59395irusz9.exe
c:\windows\59580zpy7d.exe
c:\windows\59a4thz5at23219.exe
c:\windows\5bcfazdwa9e17235.bin
c:\windows\5da559ezl477.exe
c:\windows\5z425spy9da.bin
c:\windows\63z5vir5689.dll
c:\windows\6c3e59zal1037.dll
c:\windows\6d59vir20z1.dll
c:\windows\6dz0vir19305.bin
c:\windows\77945hreat1z293.exe
c:\windows\77b2st9al1550z.bin
c:\windows\79cspa5se1915z.dll
c:\windows\7fz2b9ckdoor9645.exe
c:\windows\920dsteal1951z.bin
c:\windows\9293downloaz5r1942.bin
c:\windows\9349spamb5tzbe.exe
c:\windows\95924not-a-vir5s1cz.bin
c:\windows\95a7addwa5e8z7.dll
c:\windows\9e9csteal51z0.bin
c:\windows\9za0threat29953.bin
c:\windows\f35tzi5f196.bin
c:\windows\system32\1095t5reat3772z.bin
c:\windows\system32\11351hackz9ol42b.exe
c:\windows\system32\12545worm7cz9.exe
c:\windows\system32\13369hz5ktool7a6.dll
c:\windows\system32\159fsteaz30879.exe
c:\windows\system32\15z50troj25f9.dll
c:\windows\system32\1654zs5ambo9787.bin
c:\windows\system32\19565spamzot5b3.exe
c:\windows\system32\1bddsp95se254z.dll
c:\windows\system32\20517noz-a-virus195.exe
c:\windows\system32\2126spywzr53159.dll
c:\windows\system32\219095rojz9f.dll
c:\windows\system32\22635zckdoor6999.bin
c:\windows\system32\22d5a9dwarz1589.dll
c:\windows\system32\25f1backdozr2919.exe
c:\windows\system32\2697sp95ze2027.exe
c:\windows\system32\2793a95ware3244z.dll
c:\windows\system32\27z119roj195.bin
c:\windows\system32\282925ot-azvirus594.exe
c:\windows\system32\28e2spz59e1821.exe
c:\windows\system32\29257szy9f3.dll
c:\windows\system32\2czft5ief9164.exe
c:\windows\system32\30352wozm5769.exe
c:\windows\system32\30629ownl5adez2869.exe
c:\windows\system32\31296sp5m9otzf6.dll
c:\windows\system32\315599pz1d4.exe
c:\windows\system32\31zavir5092.bin
c:\windows\system32\32499zr5j567.bin
c:\windows\system32\33z8th9ef3561.bin
c:\windows\system32\3537worz97.dll
c:\windows\system32\36az9teal2385.dll
c:\windows\system32\390zteal5956.dll
c:\windows\system32\3d51thrza914155.bin
c:\windows\system32\3z806hacktool905.bin
c:\windows\system32\41azp95are1557.exe
c:\windows\system32\43z75roj44e9.bin
c:\windows\system32\497bbazkdoor29835.exe
c:\windows\system32\49f1t59ef353z.bin
c:\windows\system32\4df0spywaze5129.dll
c:\windows\system32\545zbac5door559.dll
c:\windows\system32\55518spa9bzt264.dll
c:\windows\system32\56971trzj5e89.dll
c:\windows\system32\5718hzck9o5l4c5.exe
c:\windows\system32\5945thrzat24713.bin
c:\windows\system32\5b6astea92497z.exe
c:\windows\system32\653bst9zl957.dll
c:\windows\system32\6595zddware547.bin
c:\windows\system32\6599backdoor95z.dll
c:\windows\system32\65d9spy5aze14119.bin
c:\windows\system32\698ddownloade529z7.dll
c:\windows\system32\777zs5eal13059.dll
c:\windows\system32\8179hackz9ol757.exe
c:\windows\system32\819trzj5d5.bin
c:\windows\system32\9047downlo5dzr579.dll
c:\windows\system32\92535hreat30467z.exe
c:\windows\system32\95z07not-a-virus439.bin
c:\windows\system32\9ea5threat2z044.bin
c:\windows\system32\9z740spy556.bin
c:\windows\system32\drivers\ndisprot.sys
c:\windows\system32\eb8spzwa5e1109.bin
c:\windows\system32\z8486s5y199.dll
c:\windows\system32\zde0d5wnloader5519.exe
c:\windows\zfa6threat1599.dll
.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Thu May 14, 2009 1:22 pm

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\13sparse9z52.dll
c:\windows\141s9eal564z.dll
c:\windows\1490wz5md8.dll
c:\windows\15429szam95t5bb.exe
c:\windows\15z91viru56d59.exe
c:\windows\17z689pambot385.dll
c:\windows\19286zpambot7c5.exe
c:\windows\19309not-a-virzs935.dll
c:\windows\1b67spy5a9e21z9.dll
c:\windows\1z0c5hie9781.bin
c:\windows\205z6wor9545.exe
c:\windows\215399ormz2f.exe
c:\windows\21802not-a-9iru548z.exe
c:\windows\2194h5cktozl761.exe
c:\windows\23a5download9rz306.bin
c:\windows\2438znot-9-vir5s25.dll
c:\windows\24511wo9m7z5.bin
c:\windows\252eztea91509.exe
c:\windows\25z79virus5705.bin
c:\windows\27z5b9ckdoor2474.bin
c:\windows\2ae4zpywa9e1295.exe
c:\windows\2e935teal159z.dll
c:\windows\2za9s9ea52970.dll
c:\windows\3051znot-a-virus2b9.exe
c:\windows\320129ot-5-virusz1.dll
c:\windows\34a9ad5waze155.bin
c:\windows\35355teal9z9.exe
c:\windows\368z5dd9are2670.dll
c:\windows\3b90z5r5579.exe
c:\windows\4487zh9eat312365.dll
c:\windows\449zhi5f387.dll
c:\windows\4553troj7z9.bin
c:\windows\486cza5kdoor129.exe
c:\windows\490athrezt294275.bin
c:\windows\4959addwa5z2992.dll
c:\windows\4f5tzreat25953.dll
c:\windows\548d5hreat28z659.exe
c:\windows\54aath9ez1548.dll
c:\windows\54d7bac9door1z25.dll
c:\windows\5597spamzo95e4.dll
c:\windows\59268troj4z1.bin
c:\windows\59395irusz9.exe
c:\windows\59580zpy7d.exe
c:\windows\59a4thz5at23219.exe
c:\windows\5bcfazdwa9e17235.bin
c:\windows\5da559ezl477.exe
c:\windows\5z425spy9da.bin
c:\windows\63z5vir5689.dll
c:\windows\6c3e59zal1037.dll
c:\windows\6d59vir20z1.dll
c:\windows\6dz0vir19305.bin
c:\windows\77945hreat1z293.exe
c:\windows\77b2st9al1550z.bin
c:\windows\79cspa5se1915z.dll
c:\windows\7fz2b9ckdoor9645.exe
c:\windows\920dsteal1951z.bin
c:\windows\9293downloaz5r1942.bin
c:\windows\9349spamb5tzbe.exe
c:\windows\95924not-a-vir5s1cz.bin
c:\windows\95a7addwa5e8z7.dll
c:\windows\9e9csteal51z0.bin
c:\windows\9za0threat29953.bin
c:\windows\f35tzi5f196.bin
c:\windows\system32\1095t5reat3772z.bin
c:\windows\system32\11351hackz9ol42b.exe
c:\windows\system32\12545worm7cz9.exe
c:\windows\system32\13369hz5ktool7a6.dll
c:\windows\system32\159fsteaz30879.exe
c:\windows\system32\15z50troj25f9.dll
c:\windows\system32\1654zs5ambo9787.bin
c:\windows\system32\19565spamzot5b3.exe
c:\windows\system32\1bddsp95se254z.dll
c:\windows\system32\20517noz-a-virus195.exe
c:\windows\system32\2126spywzr53159.dll
c:\windows\system32\219095rojz9f.dll
c:\windows\system32\22635zckdoor6999.bin
c:\windows\system32\22d5a9dwarz1589.dll
c:\windows\system32\25f1backdozr2919.exe
c:\windows\system32\2697sp95ze2027.exe
c:\windows\system32\2793a95ware3244z.dll
c:\windows\system32\27z119roj195.bin
c:\windows\system32\282925ot-azvirus594.exe
c:\windows\system32\28e2spz59e1821.exe
c:\windows\system32\29257szy9f3.dll
c:\windows\system32\2czft5ief9164.exe
c:\windows\system32\30352wozm5769.exe
c:\windows\system32\30629ownl5adez2869.exe
c:\windows\system32\31296sp5m9otzf6.dll
c:\windows\system32\315599pz1d4.exe
c:\windows\system32\31zavir5092.bin
c:\windows\system32\32499zr5j567.bin
c:\windows\system32\33z8th9ef3561.bin
c:\windows\system32\3537worz97.dll
c:\windows\system32\36az9teal2385.dll
c:\windows\system32\390zteal5956.dll
c:\windows\system32\3d51thrza914155.bin
c:\windows\system32\3z806hacktool905.bin
c:\windows\system32\41azp95are1557.exe
c:\windows\system32\43z75roj44e9.bin
c:\windows\system32\497bbazkdoor29835.exe
c:\windows\system32\49f1t59ef353z.bin
c:\windows\system32\4df0spywaze5129.dll
c:\windows\system32\545zbac5door559.dll
c:\windows\system32\55518spa9bzt264.dll
c:\windows\system32\56971trzj5e89.dll
c:\windows\system32\5718hzck9o5l4c5.exe
c:\windows\system32\5945thrzat24713.bin
c:\windows\system32\5b6astea92497z.exe
c:\windows\system32\653bst9zl957.dll
c:\windows\system32\6595zddware547.bin
c:\windows\system32\6599backdoor95z.dll
c:\windows\system32\65d9spy5aze14119.bin
c:\windows\system32\698ddownloade529z7.dll
c:\windows\system32\777zs5eal13059.dll
c:\windows\system32\8179hackz9ol757.exe
c:\windows\system32\819trzj5d5.bin
c:\windows\system32\9047downlo5dzr579.dll
c:\windows\system32\92535hreat30467z.exe
c:\windows\system32\95z07not-a-virus439.bin
c:\windows\system32\9ea5threat2z044.bin
c:\windows\system32\9z740spy556.bin
c:\windows\system32\drivers\ndisprot.sys
c:\windows\system32\eb8spzwa5e1109.bin
c:\windows\system32\z8486s5y199.dll
c:\windows\system32\zde0d5wnloader5519.exe
c:\windows\zfa6threat1599.dll

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Thu May 14, 2009 1:22 pm

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NDISPROT
-------\Service_Ndisprot
-------\Service_ntportio


((((((((((((((((((((((((( Files Created from 2009-04-14 to 2009-05-14 )))))))))))))))))))))))))))))))
.

2009-05-14 08:26 . 2009-05-14 08:26 -------- d-----w c:\program files\PHP Editor
2009-05-14 07:55 . 2009-05-14 07:55 -------- d-----w c:\program files\Web Page Maker V2
2009-05-13 16:42 . 2009-05-13 16:42 -------- d-----w c:\documents and settings\ace\Local Settings\Application Data\Cooliris
2009-05-13 05:54 . 2009-05-13 05:54 -------- d-----w c:\documents and settings\Gautam\Application Data\BitDefender
2009-05-12 15:12 . 2009-05-12 15:12 -------- d-----w c:\windows\ie8updates
2009-05-12 13:38 . 2009-05-12 13:38 -------- d-----w c:\documents and settings\ace\Application Data\BitDefender
2009-05-12 13:37 . 2009-05-12 13:45 -------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-05-12 13:35 . 2009-05-12 13:38 -------- d-----w c:\program files\Common Files\BitDefender
2009-05-11 10:55 . 2009-05-14 06:58 -------- d-----w c:\documents and settings\ace\Application Data\QuickScan
2009-05-11 09:40 . 2009-05-11 10:46 -------- d-----w c:\windows\BDOSCAN8
2009-05-11 07:24 . 2009-05-11 07:24 -------- d-----w c:\program files\CleanMyPC
2009-05-11 06:04 . 2009-05-11 06:04 -------- d-----w c:\documents and settings\ace\Application Data\Malwarebytes
2009-05-10 10:41 . 2009-05-10 11:22 -------- d-----w c:\windows\SxsCaPendDel
2009-05-10 09:21 . 2009-05-10 09:21 -------- d-----w c:\documents and settings\Gautam\Application Data\Yahoo!
2009-05-10 08:49 . 2009-05-10 08:49 -------- d-----w c:\documents and settings\Gautam\Application Data\Malwarebytes
2009-05-10 08:49 . 2009-05-10 08:49 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-10 06:45 . 2009-05-10 07:08 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-10 06:45 . 2009-05-10 06:46 -------- d-----w c:\program files\CCleaner
2009-05-10 06:25 . 2009-05-10 06:25 -------- d-----w c:\documents and settings\ace\Application Data\PC Tools
2009-05-10 04:56 . 2009-05-10 06:00 -------- d-----w c:\program files\Perfect Uninstaller
2009-05-10 04:02 . 2009-05-10 04:02 -------- d-----w c:\program files\Windows Live Safety Center
2009-05-10 03:48 . 2009-05-10 03:48 -------- d-----w c:\program files\Trend Micro
2009-05-09 18:57 . 2009-05-09 18:57 -------- d-----w c:\documents and settings\Gautam\Application Data\PC Tools
2009-05-09 18:57 . 2009-05-09 18:57 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2009-05-09 16:52 . 2009-05-09 16:52 4100 ----a-w c:\windows\1452spy3zd9.exe
2009-05-06 23:49 . 2009-05-06 23:49 16299 ----a-w c:\windows\6bazback9oor23735.bin
2009-05-06 18:19 . 2009-05-06 18:28 -------- d-----w c:\program files\PHP
2009-05-05 16:32 . 2009-05-05 16:32 16791 ----a-w c:\windows\system32\1z999spy351.exe
2009-05-02 16:50 . 2009-05-02 17:18 -------- d-----w c:\program files\Yahoo SiteBuilder
2009-04-25 17:35 . 2009-04-25 17:35 6966 ----a-w c:\windows\system32\4985zwnload9r986.exe
2009-04-24 06:11 . 2009-04-24 06:11 9184 ----a-w c:\windows\system32\5b9cvirz299.exe
2009-04-24 03:52 . 2009-04-24 03:52 9518 ----a-w c:\windows\10fbs9e5l1618z.bin
2009-04-22 17:44 . 2009-04-22 17:44 -------- d-----w c:\documents and settings\All Users\Application Data\Metacafe
2009-04-22 10:03 . 2009-04-22 10:03 8195 ----a-w c:\windows\system32\1z000no9-5-virus7bd.bin
2009-04-19 21:03 . 2009-04-19 21:03 15715 ----a-w c:\windows\9z699virus585.bin
2009-04-19 15:15 . 2009-04-19 15:15 9576 ----a-w c:\windows\z5694vir5s299.bin
2009-04-19 01:45 . 2009-04-19 01:45 4410 ----a-w c:\windows\system32\50bbzhi9f1097.dll
2009-04-15 23:16 . 2009-04-15 23:16 8035 ----a-w c:\windows\2689zspambot53d.bin
2009-04-15 14:03 . 2009-04-15 14:03 3101 ----a-w c:\windows\51289ot-z-5irus528.dll
2009-04-14 13:52 . 2009-04-14 13:52 10145 ----a-w c:\windows\system32\755bthizf7789.bin

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-14 13:11 . 2009-02-21 18:06 -------- d-----w c:\program files\Common Files\Akamai
2009-05-14 13:05 . 2009-02-04 04:33 81984 ----a-w c:\windows\system32\bdod.bin
2009-05-13 05:53 . 2008-01-19 12:57 -------- d-----w c:\program files\Microsoft Silverlight
2009-05-12 13:38 . 2009-02-03 18:40 -------- d-----w c:\program files\BitDefender
2009-05-10 11:54 . 2009-05-10 11:54 104328 ----a-w c:\windows\system32\drivers\bdfndisf.sys.upd
2009-05-10 04:35 . 2008-09-18 11:50 -------- d-----w c:\program files\DNA
2009-04-17 10:20 . 2008-08-19 13:27 -------- d-----w c:\program files\EA GAMES
2009-04-14 00:16 . 2009-04-14 00:16 17183 ----a-w c:\windows\54zf5ddware79.bin
2009-04-12 06:05 . 2009-04-12 06:05 15369 ----a-w c:\windows\22z90tr5j38b.exe
2009-04-10 14:19 . 2009-04-10 14:19 14705 ----a-w c:\windows\system32\5a70a9dwzre929.exe
2009-04-10 13:43 . 2009-04-10 13:43 22328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-04-10 13:43 . 2009-04-10 13:43 22328 ----a-w c:\documents and settings\ace\Application Data\PnkBstrK.sys
2009-04-10 13:43 . 2009-04-10 13:43 107832 ------w c:\windows\system32\PnkBstrB.exe
2009-04-10 13:43 . 2009-04-10 13:43 682280 ----a-w c:\windows\system32\pbsvc.exe
2009-04-10 13:43 . 2009-04-10 13:43 66872 ------w c:\windows\system32\PnkBstrA.exe
2009-04-09 17:15 . 2008-08-17 18:19 -------- d-----w c:\program files\EA Sports
2009-04-09 16:49 . 2008-01-15 11:00 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-09 14:37 . 2009-04-09 14:37 2855 ----a-w c:\windows\PIF\rld-fi9k.PIF
2009-04-07 12:40 . 2009-04-07 12:40 17779 ----a-w c:\windows\9c55threaz8458.bin
2009-04-07 07:42 . 2009-04-07 07:42 14855 ----a-w c:\windows\7150thi5f11z29.dll
2009-04-07 06:07 . 2009-04-07 06:07 15142 ----a-w c:\windows\system32\18acad9ware2350z.exe
2009-04-06 18:09 . 2009-04-06 18:09 5653 ----a-w c:\windows\system32\59ecthie5373z.bin
2009-04-06 02:57 . 2009-04-06 02:57 10059 ----a-w c:\windows\system32\fz8stea95084.dll
2009-04-03 18:57 . 2009-04-03 18:57 11349 ----a-w c:\windows\system32\5068backd5o9z53.bin
2009-04-03 16:27 . 2009-04-03 16:27 15440 ----a-w c:\windows\system32\18z695py19a9.exe
2009-04-02 16:26 . 2009-03-28 07:59 -------- d-----w c:\program files\3GP Player
2009-04-02 09:14 . 2009-04-02 09:14 15672 ----a-w c:\windows\system32\3850z9y559.exe
2009-03-29 17:55 . 2009-03-29 17:55 -------- d-----w c:\program files\mTC
2009-03-27 11:13 . 2009-03-27 11:13 10799 ----a-w c:\windows\system32\3594not-a-virusz35.exe
2009-03-26 22:59 . 2009-03-26 22:59 3827 ----a-w c:\windows\a3zth9ef56.bin
2009-03-26 01:35 . 2009-03-26 01:35 9242 ----a-w c:\windows\system32\2dc9do5nloadez128.bin
2009-03-25 20:23 . 2009-03-25 20:23 6214 ----a-w c:\windows\system32\9d52backzoor425.exe
2009-03-24 20:24 . 2009-03-24 20:24 5551 ----a-w c:\windows\96s9ywarez153.exe
2009-03-19 05:42 . 2009-03-19 05:42 14662 ----a-w c:\windows\z80bac5do9r3018.dll
2009-03-18 07:28 . 2009-02-05 15:42 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-18 07:28 . 2008-01-17 13:32 -------- d-----w c:\program files\Java
2009-03-18 02:34 . 2009-03-18 02:34 17472 ----a-w c:\windows\system32\2f5zddw9re254.bin
2009-03-16 17:18 . 2009-03-16 17:18 8266 ----a-w c:\windows\2700zp59bot2a0.dll
2009-03-15 22:50 . 2009-03-15 22:50 3481 ----a-w c:\windows\25079virus255z.bin
2009-03-12 07:19 . 2009-03-12 07:19 8141 ----a-w c:\windows\system32\18816not-azvirus985.dll
2009-03-06 14:44 . 2004-08-04 04:56 283648 ----a-w c:\windows\system32\pdh.dll
2009-03-05 09:49 . 2009-03-05 09:49 4412 ----a-w c:\windows\93069ot-5-virus7a1z.dll
2009-02-27 09:41 . 2009-02-27 09:41 7546 ----a-w c:\windows\54ezvir2930.exe
2009-02-26 23:02 . 2009-02-26 23:02 17133 ----a-w c:\windows\system32\1b69spyzare2598.exe
2009-02-25 15:58 . 2009-02-25 15:58 17092 ----a-w c:\windows\system32\4559zroj3fe.bin
2009-02-20 22:50 . 2009-02-20 22:50 4087 ----a-w c:\windows\3z819ackdoo52902.dll
2009-02-20 19:32 . 2009-02-20 19:32 8958 ----a-w c:\windows\1z996spy5f7.dll
2009-02-19 09:34 . 2009-02-19 09:34 10566 ----a-w c:\windows\system32\1745tz5ef3759.bin
2009-02-18 05:12 . 2009-02-18 05:12 3144 ----a-w c:\windows\53452ha9ztool69d.bin
2009-02-17 20:39 . 2009-02-17 20:39 128840 ----a-w c:\windows\system32\Metacafe.scr
2009-01-29 15:18 . 2009-01-29 15:18 27976 ----a-w c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-01-29 15:18 . 2009-01-29 15:18 126360 ----a-w c:\program files\mozilla firefox\plugins\atgpcext.dll
2009-01-29 15:25 . 2009-01-29 15:28 46408 ----a-w c:\program files\mozilla firefox\plugins\atmccli.dll
2009-01-29 16:59 . 2009-01-29 15:28 98712 ----a-w c:\program files\mozilla firefox\plugins\ieatgpc.dll
2009-01-29 15:35 . 2009-01-29 15:35 32768 ----a-w c:\program files\mozilla firefox\plugins\ptexmeet.dll
2009-03-05 12:38 . 2009-05-12 13:46 49664 ----a-w c:\program files\mozilla firefox\components\FFComm.dll

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Thu May 14, 2009 1:23 pm

------- Sigcheck -------

[-] 2004-08-04 04:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\system32\svchost.exe
[-] 2004-08-04 04:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\system32\dllcache\svchost.exe

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2004-08-04 04:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\dllcache\user32.dll

[-] 2004-08-04 04:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\system32\ws2_32.dll
[-] 2004-08-04 04:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\system32\dllcache\ws2_32.dll

[-] 2007-10-11 05:57 666112 80D660A49E0D118144423099B2A9F5DA c:\windows\$hf_mig$\KB942615\SP2QFE\wininet.dll
[-] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2007-12-07 00:44 666112 085A7C37F9C6EDE1BA870B7DBEC06399 c:\windows\$hf_mig$\KB944533\SP2QFE\wininet.dll
[-] 2007-12-07 02:01 825344 B5B411BB229AE6EAD7652A32ED47BFB9 c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[-] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[-] 2008-04-23 03:35 827392 41546B396A526918DA7995A02EA04E51 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[-] 2008-06-23 16:01 827904 C66402A06B83B036C195242C0C8CF83C c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
[-] 2004-08-04 04:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\$NtUninstallKB942615$\wininet.dll
[-] 2007-10-11 06:13 659456 2005AD86A22AEE68E21EE59F9CCB77F2 c:\windows\$NtUninstallKB944533$\wininet.dll
[-] 2007-12-07 01:07 659456 57D1B5150CF6331FAC6B3E04C1FCB966 c:\windows\ie7\wininet.dll
[-] 2007-08-13 13:24 818688 A4A0FC92358F39538A6494C42EF99FE9 c:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\ie7updates\KB944533-IE7\wininet.dll
[-] 2007-12-07 02:21 824832 806D274C9A6C3AAEA5EAE8E4AF841E04 c:\windows\ie7updates\KB947864-IE7\wininet.dll
[-] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\ie7updates\KB950759-IE7\wininet.dll
[-] 2008-04-23 04:16 817152 F82DC979E1F334DF0C893B3BFDEB404E c:\windows\ie7updates\KB953838-IE7\wininet.dll
[-] 2008-06-23 16:57 826368 8C13D4A7479FA0A026EDA8ABCE82C0ED c:\windows\ie8\wininet.dll
[-] 1999-04-23 23:52 459024 A632F824282A1F84BD1E3798978030C7 c:\windows\system\WININET.DLL
[-] 2008-08-21 21:38 878592 DF1CB456ED1E038B276123365A1A93C4 c:\windows\system32\wininet.dll
[-] 2008-08-21 21:38 878592 DF1CB456ED1E038B276123365A1A93C4 c:\windows\system32\dllcache\wininet.dll

[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2004-08-04 03:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-04 04:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\system32\winlogon.exe
[-] 2004-08-04 04:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\system32\dllcache\winlogon.exe

[-] 2004-08-04 03:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-04 03:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\drivers\ndis.sys

[-] 2004-08-04 03:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-04 03:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\drivers\ip6fw.sys

[-] 2005-03-02 00:36 2056832 D8ABA3EAB509627E707A3B14F00FBB6B c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2007-02-28 09:15 2059392 4D3DBDCCBF97F5BA1E74F322B155C3BA c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[-] 2009-02-06 09:49 2062976 9D832AF3FD1917DB0E1E8B2F000A2E3A c:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe
[-] 2009-02-07 13:32 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe
[-] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2008-08-14 09:18 2062976 63EC865DFF6CCFC7BEF94B5C50297CAD c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
[-] 2008-08-14 09:33 2066048 4AC58F03EB94A72809949D757FC39D80 c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
[-] 2008-08-14 10:09 2066048 A25E9B86EFFB2AF33BF51E676B68BFB0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[-] 2004-08-04 05:05 2015232 FB142B7007CA2EEA76966C6C5CC12150 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
[-] 2005-03-02 00:34 2015232 3CD941E472DDF3534E53038535719771 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[-] 2008-08-14 09:22 2015744 DC097A896A03B8277457D228FD12D4E6 c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[-] 2007-02-28 08:38 2015744 A58AC1C6199EF34228ABEE7FC057AE09 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\ntkrnlpa.exe
[-] 2009-02-06 09:49 2062976 9D832AF3FD1917DB0E1E8B2F000A2E3A c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\ntkrnlpa.exe
[-] 2009-02-07 13:32 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\ntkrnlpa.exe
[-] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\ntkrnlpa.exe
[-] 2009-02-06 16:49 2015744 B238AB60093BABFE76AEC8F34B4D399D c:\windows\system32\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\system32\dllcache\ntkrnlpa.exe

[-] 2005-03-02 01:04 2179456 28187802B7C368C0D3AEF7D4C382AABB c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2007-02-28 09:55 2182144 5A5C8DB4AA962C714C8371FBDF189FC9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 10:32 2186112 6A936E9D7BADAF3CAAEED1E1966EC1B0 c:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe
[-] 2009-02-07 14:05 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[-] 2008-08-14 09:57 2185984 CE69DBD54221F2D40E49FF6DB77C6507 c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
[-] 2008-08-14 10:11 2189184 EEAF32F8E15A24F62BECB1BD403BB5C5 c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
[-] 2008-08-14 10:41 2189184 31914172342BFF330063F343AC6958FE c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[-] 2004-08-04 03:18 2148352 626309040459C3915997EF98EC1C8D40 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
[-] 2005-03-02 00:57 2135552 48B3E89AF7074CEE0314A3E0C7FAFFDB c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[-] 2008-08-14 09:58 2136064 DD31AB4B91C2605601A3C108AF57A0C9 c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[-] 2007-02-28 09:08 2136064 1220FAF071DEA8653EE21DE7DCDA8BFD c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\ntoskrnl.exe
[-] 2009-02-06 10:32 2186112 6A936E9D7BADAF3CAAEED1E1966EC1B0 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\ntoskrnl.exe
[-] 2009-02-07 14:05 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\ntoskrnl.exe
[-] 2009-02-06 17:22 2136064 16B5EBE97F243441264A8F8694C2F2AA c:\windows\system32\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\system32\dllcache\ntoskrnl.exe

[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2004-08-04 04:56 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2007-06-13 10:23 975360 9784E0719124E4A23989AEF9E7CA02D6 c:\windows\system32\dllcache\explorer.exe

[-] 2009-02-06 10:22 110592 4712531AB7A01B7EE059853CA17D39BD c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe
[-] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2004-08-04 04:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\$NtUninstallKB956572$\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\services.exe
[-] 2009-02-06 10:22 110592 4712531AB7A01B7EE059853CA17D39BD c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\services.exe
[-] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\system32\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\system32\dllcache\services.exe

[-] 2004-08-04 04:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\system32\lsass.exe
[-] 2004-08-04 04:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\system32\dllcache\lsass.exe

[-] 2004-08-04 04:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\system32\ctfmon.exe
[-] 2004-08-04 04:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\system32\dllcache\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2004-08-04 04:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\dllcache\spoolsv.exe

[-] 2004-08-04 04:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\system32\userinit.exe
[-] 2004-08-04 04:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\system32\dllcache\userinit.exe

[-] 2004-08-04 04:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\system32\termsrv.dll
[-] 2004-08-04 04:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\system32\dllcache\termsrv.dll

[-] 2004-08-04 04:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\system32\powrprof.dll
[-] 2004-08-04 04:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\system32\dllcache\powrprof.dll

[-] 2004-08-04 04:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\system32\imm32.dll
[-] 2004-08-04 04:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\system32\dllcache\imm32.dll

[-] 2004-08-04 04:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\system32\sfcfiles.dll
[-] 2004-08-04 04:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\system32\dllcache\sfcfiles.dll
.
((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-14 13:10 . 2009-05-14 13:10 16384 c:\windows\Temp\Perflib_Perfdata_7c4.dat
+ 2009-05-14 13:10 . 2009-05-14 13:10 16384 c:\windows\Temp\Perflib_Perfdata_774.dat
.

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Thu May 14, 2009 1:24 pm

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"VisualTooltip"="e:\downloads\windows\crystalxp\visual\VisualToolTip.exe" [2007-04-25 956928]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-18 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-08 778240]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Metacafe.lnk - c:\program files\Metacafe\MetacafeAgent.exe [2009-2-18 145736]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\ace\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\ace\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3676:TCP"= 3676:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
"1033:TCP"= 1033:TCP:Akamai NetSession Interface
"1044:TCP"= 1044:TCP:Akamai NetSession Interface
"1041:TCP"= 1041:TCP:Akamai NetSession Interface
"1032:TCP"= 1032:TCP:Akamai NetSession Interface
"1523:TCP"= 1523:TCP:Akamai NetSession Interface
"1043:TCP"= 1043:TCP:Akamai NetSession Interface
"2672:TCP"= 2672:TCP:Akamai NetSession Interface
"1047:TCP"= 1047:TCP:Akamai NetSession Interface
"1040:TCP"= 1040:TCP:Akamai NetSession Interface
"1045:TCP"= 1045:TCP:Akamai NetSession Interface
"1039:TCP"= 1039:TCP:Akamai NetSession Interface
"2705:TCP"= 2705:TCP:Akamai NetSession Interface
"1076:TCP"= 1076:TCP:Akamai NetSession Interface
"1050:TCP"= 1050:TCP:Akamai NetSession Interface
"1051:TCP"= 1051:TCP:Akamai NetSession Interface
"1042:TCP"= 1042:TCP:Akamai NetSession Interface
"1071:TCP"= 1071:TCP:Akamai NetSession Interface
"1036:TCP"= 1036:TCP:Akamai NetSession Interface
"1031:TCP"= 1031:TCP:Akamai NetSession Interface
"1034:TCP"= 1034:TCP:Akamai NetSession Interface
"2567:TCP"= 2567:TCP:Akamai NetSession Interface
"1083:TCP"= 1083:TCP:Akamai NetSession Interface
"3649:TCP"= 3649:TCP:Akamai NetSession Interface
"1048:TCP"= 1048:TCP:Akamai NetSession Interface
"1049:TCP"= 1049:TCP:Akamai NetSession Interface
"1063:TCP"= 1063:TCP:Akamai NetSession Interface
"1038:TCP"= 1038:TCP:Akamai NetSession Interface
"1115:TCP"= 1115:TCP:Akamai NetSession Interface
"1079:TCP"= 1079:TCP:Akamai NetSession Interface
"1046:TCP"= 1046:TCP:Akamai NetSession Interface
"1087:TCP"= 1087:TCP:Akamai NetSession Interface
"3087:TCP"= 3087:TCP:Akamai NetSession Interface
"1037:TCP"= 1037:TCP:Akamai NetSession Interface
"4404:TCP"= 4404:TCP:Akamai NetSession Interface
"1388:TCP"= 1388:TCP:Akamai NetSession Interface
"1342:TCP"= 1342:TCP:Akamai NetSession Interface
"1072:TCP"= 1072:TCP:Akamai NetSession Interface
"1469:TCP"= 1469:TCP:Akamai NetSession Interface
"2853:TCP"= 2853:TCP:Akamai NetSession Interface
"1460:TCP"= 1460:TCP:Akamai NetSession Interface

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [8/4/2004 10:26 AM 14336]
R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [10/6/2008 6:16 PM 82696]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [9/18/2008 12:09 PM 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2/12/2009 4:52 PM 104328]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [1/20/2009 7:16 PM 172032]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [10/5/2008 8:15 PM 33752]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [3/19/2008 11:11 PM 13352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
Akamai REG_MULTI_SZ Akamai

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc15549d-c432-11dc-bf87-001bb9bc6506}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com g:
.
Contents of the 'Scheduled Tasks' folder

2009-05-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-2146901713-839522115-1003.job
- c:\documents and settings\ace\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-25 11:12]

2009-05-14 c:\windows\Tasks\User_Feed_Synchronization-{8FF5E086-A276-4C2E-8EE8-A375FE0F689A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 21:35]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {BDF43518-8EE6-418C-9110-714B8BF8B4EA} = 202.56.215.54,202.56.215.55
DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - component: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - plugin: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\iaplayer@instantaction.com\plugins\npiaplayer.dll
FF - plugin: c:\documents and settings\ace\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\ace\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npExentCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\VLC\npvlc.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-05-14 18:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-2146901713-839522115-1003\Software\YourCompanyName\YourProductName\Version*]
"VersionData"=hex:0c,42,46,f6,23,bc,3e,2d,7a,2e,97,ca,8b,29,77,15,00,f2,c3,72,
58,b5,be,94,1f,90,16,e0,3a,99,33,1e,44,b0,15,57,a9,8e,58,50,89,88,82,88,9d,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3248)
e:\downloads\windows\crystalxp\visual\VisualTooltip.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\BitDefender\BitDefender 2009\bdfvsctx.dll
c:\windows\system32\txmlutil.dll
c:\program files\BitDefender\BitDefender 2009\ENU\bdfvsctx.ui
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\windows\system32\wodShellMenu.dll
c:\windows\system32\igfxpph.dll
c:\windows\system32\hccutils.DLL
c:\windows\system32\igfxres.dll
c:\windows\system32\igfxress.dll
c:\windows\system32\igfxsrvc.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\SigmaTel\C-Major Audio\WDM\stacsv.exe
c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
c:\program files\Common Files\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Completion time: 2009-05-14 18:47 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-14 13:17
ComboFix2.txt 2009-05-13 13:44

Pre-Run: 12,083,908,608 bytes free
Post-Run: 11,980,795,904 bytes free

662 --- E O F --- 2009-05-12 15:12

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Thu May 14, 2009 3:30 pm

One more round.

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

File::
c:\windows\1452spy3zd9.exe
c:\windows\6bazback9oor23735.bin
c:\windows\system32\1z999spy351.exe
c:\windows\system32\4985zwnload9r986.exe
c:\windows\system32\5b9cvirz299.exe
c:\windows\10fbs9e5l1618z.bin
c:\windows\system32\1z000no9-5-virus7bd.bin
c:\windows\9z699virus585.bin
c:\windows\z5694vir5s299.bin
c:\windows\system32\50bbzhi9f1097.dll
c:\windows\2689zspambot53d.bin
c:\windows\51289ot-z-5irus528.dll
c:\windows\system32\755bthizf7789.bin
c:\windows\54zf5ddware79.bin
c:\windows\22z90tr5j38b.exe
c:\windows\system32\5a70a9dwzre929.exe
c:\windows\9c55threaz8458.bin
c:\windows\7150thi5f11z29.dll
c:\windows\system32\18acad9ware2350z.exe
c:\windows\system32\59ecthie5373z.bin
c:\windows\system32\fz8stea95084.dll
c:\windows\system32\5068backd5o9z53.bin
c:\windows\system32\18z695py19a9.exe
c:\windows\system32\3850z9y559.exe
c:\windows\system32\3594not-a-virusz35.exe
c:\windows\a3zth9ef56.bin
c:\windows\system32\2dc9do5nloadez128.bin
c:\windows\system32\9d52backzoor425.exe
c:\windows\96s9ywarez153.exe
c:\windows\z80bac5do9r3018.dll
c:\windows\system32\2f5zddw9re254.bin
c:\windows\2700zp59bot2a0.dll
c:\windows\25079virus255z.bin
c:\windows\system32\18816not-azvirus985.dll
c:\windows\93069ot-5-virus7a1z.dll
c:\windows\54ezvir2930.exe
c:\windows\system32\1b69spyzare2598.exe
c:\windows\system32\4559zroj3fe.bin
c:\windows\3z819ackdoo52902.dll
c:\windows\1z996spy5f7.dll
c:\windows\system32\1745tz5ef3759.bin
c:\windows\53452ha9ztool69d.bin

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc15549d-c432-11dc-bf87-001bb9bc6506}]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Fri May 15, 2009 6:48 am

When my computer restarted it showed the following pop-up:
"Windows cannot find HIDEC.exe make sure you typed the name correctly"

and after a while it disappeared automatically......

Here is the log file:

ComboFix 09-05-14.03 - ace 05/15/2009 11:56.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.224 [GMT 5.5:30]
Running from: c:\documents and settings\ace\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\ace\Desktop\CFScript.txt
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Firewall *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

FILE ::
c:\windows\10fbs9e5l1618z.bin
c:\windows\1452spy3zd9.exe
c:\windows\1z996spy5f7.dll
c:\windows\22z90tr5j38b.exe
c:\windows\25079virus255z.bin
c:\windows\2689zspambot53d.bin
c:\windows\2700zp59bot2a0.dll
c:\windows\3z819ackdoo52902.dll
c:\windows\51289ot-z-5irus528.dll
c:\windows\53452ha9ztool69d.bin
c:\windows\54ezvir2930.exe
c:\windows\54zf5ddware79.bin
c:\windows\6bazback9oor23735.bin
c:\windows\7150thi5f11z29.dll
c:\windows\93069ot-5-virus7a1z.dll
c:\windows\96s9ywarez153.exe
c:\windows\9c55threaz8458.bin
c:\windows\9z699virus585.bin
c:\windows\a3zth9ef56.bin
c:\windows\system32\1745tz5ef3759.bin
c:\windows\system32\18816not-azvirus985.dll
c:\windows\system32\18acad9ware2350z.exe
c:\windows\system32\18z695py19a9.exe
c:\windows\system32\1b69spyzare2598.exe
c:\windows\system32\1z000no9-5-virus7bd.bin
c:\windows\system32\1z999spy351.exe
c:\windows\system32\2dc9do5nloadez128.bin
c:\windows\system32\2f5zddw9re254.bin
c:\windows\system32\3594not-a-virusz35.exe
c:\windows\system32\3850z9y559.exe
c:\windows\system32\4559zroj3fe.bin
c:\windows\system32\4985zwnload9r986.exe
c:\windows\system32\5068backd5o9z53.bin
c:\windows\system32\50bbzhi9f1097.dll
c:\windows\system32\59ecthie5373z.bin
c:\windows\system32\5a70a9dwzre929.exe
c:\windows\system32\5b9cvirz299.exe
c:\windows\system32\755bthizf7789.bin
c:\windows\system32\9d52backzoor425.exe
c:\windows\system32\fz8stea95084.dll
c:\windows\z5694vir5s299.bin
c:\windows\z80bac5do9r3018.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\10fbs9e5l1618z.bin
c:\windows\1452spy3zd9.exe
c:\windows\1z996spy5f7.dll
c:\windows\22z90tr5j38b.exe
c:\windows\25079virus255z.bin
c:\windows\2689zspambot53d.bin
c:\windows\2700zp59bot2a0.dll
c:\windows\3z819ackdoo52902.dll
c:\windows\51289ot-z-5irus528.dll
c:\windows\53452ha9ztool69d.bin
c:\windows\54ezvir2930.exe
c:\windows\54zf5ddware79.bin
c:\windows\6bazback9oor23735.bin
c:\windows\7150thi5f11z29.dll
c:\windows\93069ot-5-virus7a1z.dll
c:\windows\96s9ywarez153.exe
c:\windows\9c55threaz8458.bin
c:\windows\9z699virus585.bin
c:\windows\a3zth9ef56.bin
c:\windows\system32\1745tz5ef3759.bin
c:\windows\system32\18816not-azvirus985.dll
c:\windows\system32\18acad9ware2350z.exe
c:\windows\system32\18z695py19a9.exe
c:\windows\system32\1b69spyzare2598.exe
c:\windows\system32\1z000no9-5-virus7bd.bin
c:\windows\system32\1z999spy351.exe
c:\windows\system32\2dc9do5nloadez128.bin
c:\windows\system32\2f5zddw9re254.bin
c:\windows\system32\3594not-a-virusz35.exe
c:\windows\system32\3850z9y559.exe
c:\windows\system32\4559zroj3fe.bin
c:\windows\system32\4985zwnload9r986.exe
c:\windows\system32\5068backd5o9z53.bin
c:\windows\system32\50bbzhi9f1097.dll
c:\windows\system32\59ecthie5373z.bin
c:\windows\system32\5a70a9dwzre929.exe
c:\windows\system32\5b9cvirz299.exe
c:\windows\system32\755bthizf7789.bin
c:\windows\system32\9d52backzoor425.exe
c:\windows\system32\fz8stea95084.dll
c:\windows\z5694vir5s299.bin
c:\windows\z80bac5do9r3018.dll

.
((((((((((((((((((((((((( Files Created from 2009-04-15 to 2009-05-15 )))))))))))))))))))))))))))))))
.

2009-05-14 08:26 . 2009-05-14 08:26 -------- d-----w c:\program files\PHP Editor
2009-05-14 07:55 . 2009-05-14 07:55 -------- d-----w c:\program files\Web Page Maker V2
2009-05-13 16:42 . 2009-05-13 16:42 -------- d-----w c:\documents and settings\ace\Local Settings\Application Data\Cooliris
2009-05-13 05:54 . 2009-05-13 05:54 -------- d-----w c:\documents and settings\Gautam\Application Data\BitDefender
2009-05-12 15:12 . 2009-05-12 15:12 -------- d-----w c:\windows\ie8updates
2009-05-12 13:38 . 2009-05-12 13:38 -------- d-----w c:\documents and settings\ace\Application Data\BitDefender
2009-05-12 13:37 . 2009-05-12 13:45 -------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-05-12 13:35 . 2009-05-12 13:38 -------- d-----w c:\program files\Common Files\BitDefender
2009-05-11 10:55 . 2009-05-14 06:58 -------- d-----w c:\documents and settings\ace\Application Data\QuickScan
2009-05-11 09:40 . 2009-05-11 10:46 -------- d-----w c:\windows\BDOSCAN8
2009-05-11 07:24 . 2009-05-11 07:24 -------- d-----w c:\program files\CleanMyPC
2009-05-11 06:04 . 2009-05-11 06:04 -------- d-----w c:\documents and settings\ace\Application Data\Malwarebytes
2009-05-10 10:41 . 2009-05-10 11:22 -------- d-----w c:\windows\SxsCaPendDel
2009-05-10 09:21 . 2009-05-10 09:21 -------- d-----w c:\documents and settings\Gautam\Application Data\Yahoo!
2009-05-10 08:49 . 2009-05-10 08:49 -------- d-----w c:\documents and settings\Gautam\Application Data\Malwarebytes
2009-05-10 08:49 . 2009-05-10 08:49 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-10 06:45 . 2009-05-10 07:08 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-10 06:45 . 2009-05-10 06:46 -------- d-----w c:\program files\CCleaner
2009-05-10 06:25 . 2009-05-10 06:25 -------- d-----w c:\documents and settings\ace\Application Data\PC Tools
2009-05-10 04:56 . 2009-05-10 06:00 -------- d-----w c:\program files\Perfect Uninstaller
2009-05-10 04:02 . 2009-05-10 04:02 -------- d-----w c:\program files\Windows Live Safety Center
2009-05-10 03:48 . 2009-05-10 03:48 -------- d-----w c:\program files\Trend Micro
2009-05-09 18:57 . 2009-05-09 18:57 -------- d-----w c:\documents and settings\Gautam\Application Data\PC Tools
2009-05-09 18:57 . 2009-05-09 18:57 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2009-05-06 18:19 . 2009-05-06 18:28 -------- d-----w c:\program files\PHP
2009-05-02 16:50 . 2009-05-02 17:18 -------- d-----w c:\program files\Yahoo SiteBuilder
2009-04-22 17:44 . 2009-04-22 17:44 -------- d-----w c:\documents and settings\All Users\Application Data\Metacafe

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Fri May 15, 2009 6:49 am

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-15 06:38 . 2009-02-21 18:06 -------- d-----w c:\program files\Common Files\Akamai
2009-05-15 06:29 . 2009-02-04 04:33 81984 ----a-w c:\windows\system32\bdod.bin
2009-05-13 05:53 . 2008-01-19 12:57 -------- d-----w c:\program files\Microsoft Silverlight
2009-05-12 13:38 . 2009-02-03 18:40 -------- d-----w c:\program files\BitDefender
2009-05-10 11:54 . 2009-05-10 11:54 104328 ----a-w c:\windows\system32\drivers\bdfndisf.sys.upd
2009-05-10 04:35 . 2008-09-18 11:50 -------- d-----w c:\program files\DNA
2009-04-17 10:20 . 2008-08-19 13:27 -------- d-----w c:\program files\EA GAMES
2009-04-10 13:43 . 2009-04-10 13:43 22328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-04-10 13:43 . 2009-04-10 13:43 22328 ----a-w c:\documents and settings\ace\Application Data\PnkBstrK.sys
2009-04-10 13:43 . 2009-04-10 13:43 107832 ------w c:\windows\system32\PnkBstrB.exe
2009-04-10 13:43 . 2009-04-10 13:43 682280 ----a-w c:\windows\system32\pbsvc.exe
2009-04-10 13:43 . 2009-04-10 13:43 66872 ------w c:\windows\system32\PnkBstrA.exe
2009-04-09 17:15 . 2008-08-17 18:19 -------- d-----w c:\program files\EA Sports
2009-04-09 16:49 . 2008-01-15 11:00 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-02 16:26 . 2009-03-28 07:59 -------- d-----w c:\program files\3GP Player
2009-03-29 17:55 . 2009-03-29 17:55 -------- d-----w c:\program files\mTC
2009-03-18 07:28 . 2009-02-05 15:42 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-18 07:28 . 2008-01-17 13:32 -------- d-----w c:\program files\Java
2009-03-06 14:44 . 2004-08-04 04:56 283648 ----a-w c:\windows\system32\pdh.dll
2009-02-17 20:39 . 2009-02-17 20:39 128840 ----a-w c:\windows\system32\Metacafe.scr
2009-01-29 15:18 . 2009-01-29 15:18 27976 ----a-w c:\program files\mozilla firefox\plugins\atgpcdec.dll
2009-01-29 15:18 . 2009-01-29 15:18 126360 ----a-w c:\program files\mozilla firefox\plugins\atgpcext.dll
2009-01-29 15:25 . 2009-01-29 15:28 46408 ----a-w c:\program files\mozilla firefox\plugins\atmccli.dll
2009-01-29 16:59 . 2009-01-29 15:28 98712 ----a-w c:\program files\mozilla firefox\plugins\ieatgpc.dll
2009-01-29 15:35 . 2009-01-29 15:35 32768 ----a-w c:\program files\mozilla firefox\plugins\ptexmeet.dll
2009-03-05 12:38 . 2009-05-12 13:46 49664 ----a-w c:\program files\mozilla firefox\components\FFComm.dll
.

------- Sigcheck -------

[-] 2004-08-04 04:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\system32\svchost.exe
[-] 2004-08-04 04:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\system32\dllcache\svchost.exe

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2004-08-04 04:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtUninstallKB925902$\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\user32.dll
[-] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\windows\system32\dllcache\user32.dll

[-] 2004-08-04 04:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\system32\ws2_32.dll
[-] 2004-08-04 04:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\system32\dllcache\ws2_32.dll

[-] 2007-10-11 05:57 666112 80D660A49E0D118144423099B2A9F5DA c:\windows\$hf_mig$\KB942615\SP2QFE\wininet.dll
[-] 2007-10-10 23:47 825344 0E5D918F87EFA7D2424D66B499C7EB04 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
[-] 2007-12-07 00:44 666112 085A7C37F9C6EDE1BA870B7DBEC06399 c:\windows\$hf_mig$\KB944533\SP2QFE\wininet.dll
[-] 2007-12-07 02:01 825344 B5B411BB229AE6EAD7652A32ED47BFB9 c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
[-] 2008-03-01 13:03 827392 6316C2F0C61271C8ABDFF7429174879E c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
[-] 2008-04-23 03:35 827392 41546B396A526918DA7995A02EA04E51 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
[-] 2008-06-23 16:01 827904 C66402A06B83B036C195242C0C8CF83C c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
[-] 2004-08-04 04:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\windows\$NtUninstallKB942615$\wininet.dll
[-] 2007-10-11 06:13 659456 2005AD86A22AEE68E21EE59F9CCB77F2 c:\windows\$NtUninstallKB944533$\wininet.dll
[-] 2007-12-07 01:07 659456 57D1B5150CF6331FAC6B3E04C1FCB966 c:\windows\ie7\wininet.dll
[-] 2007-08-13 13:24 818688 A4A0FC92358F39538A6494C42EF99FE9 c:\windows\ie7updates\KB942615-IE7\wininet.dll
[-] 2007-10-10 23:56 824832 30C1E0F34AD2972C72A01DB5C74AB065 c:\windows\ie7updates\KB944533-IE7\wininet.dll
[-] 2007-12-07 02:21 824832 806D274C9A6C3AAEA5EAE8E4AF841E04 c:\windows\ie7updates\KB947864-IE7\wininet.dll
[-] 2008-03-01 13:06 826368 AD21461AEF8244EDEC2EF18E55E1DCF3 c:\windows\ie7updates\KB950759-IE7\wininet.dll
[-] 2008-04-23 04:16 817152 F82DC979E1F334DF0C893B3BFDEB404E c:\windows\ie7updates\KB953838-IE7\wininet.dll
[-] 2008-06-23 16:57 826368 8C13D4A7479FA0A026EDA8ABCE82C0ED c:\windows\ie8\wininet.dll
[-] 1999-04-23 23:52 459024 A632F824282A1F84BD1E3798978030C7 c:\windows\system\WININET.DLL
[-] 2008-08-21 21:38 878592 DF1CB456ED1E038B276123365A1A93C4 c:\windows\system32\wininet.dll
[-] 2008-08-21 21:38 878592 DF1CB456ED1E038B276123365A1A93C4 c:\windows\system32\dllcache\wininet.dll

[-] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2008-06-20 10:44 360960 744E57C99232201AE98C49168B918F48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2004-08-04 03:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 10:45 360320 2A5554FC5B1E04E131230E3CE035C3F9 c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-04 04:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\system32\winlogon.exe
[-] 2004-08-04 04:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\system32\dllcache\winlogon.exe

[-] 2004-08-04 03:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-04 03:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\system32\drivers\ndis.sys

[-] 2004-08-04 03:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-04 03:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\drivers\ip6fw.sys

[-] 2005-03-02 00:36 2056832 D8ABA3EAB509627E707A3B14F00FBB6B c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2007-02-28 09:15 2059392 4D3DBDCCBF97F5BA1E74F322B155C3BA c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[-] 2009-02-06 09:49 2062976 9D832AF3FD1917DB0E1E8B2F000A2E3A c:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe
[-] 2009-02-07 13:32 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe
[-] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2008-08-14 09:18 2062976 63EC865DFF6CCFC7BEF94B5C50297CAD c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
[-] 2008-08-14 09:33 2066048 4AC58F03EB94A72809949D757FC39D80 c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
[-] 2008-08-14 10:09 2066048 A25E9B86EFFB2AF33BF51E676B68BFB0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
[-] 2004-08-04 05:05 2015232 FB142B7007CA2EEA76966C6C5CC12150 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
[-] 2005-03-02 00:34 2015232 3CD941E472DDF3534E53038535719771 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
[-] 2008-08-14 09:22 2015744 DC097A896A03B8277457D228FD12D4E6 c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[-] 2007-02-28 08:38 2015744 A58AC1C6199EF34228ABEE7FC057AE09 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\ntkrnlpa.exe
[-] 2009-02-06 09:49 2062976 9D832AF3FD1917DB0E1E8B2F000A2E3A c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\ntkrnlpa.exe
[-] 2009-02-07 13:32 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\ntkrnlpa.exe
[-] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\ntkrnlpa.exe
[-] 2009-02-06 16:49 2015744 B238AB60093BABFE76AEC8F34B4D399D c:\windows\system32\ntkrnlpa.exe
[-] 2009-02-06 16:49 2057728 3006410E24772CC6953F0B5C01BEB35F c:\windows\system32\dllcache\ntkrnlpa.exe

[-] 2005-03-02 01:04 2179456 28187802B7C368C0D3AEF7D4C382AABB c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2007-02-28 09:55 2182144 5A5C8DB4AA962C714C8371FBDF189FC9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 10:32 2186112 6A936E9D7BADAF3CAAEED1E1966EC1B0 c:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe
[-] 2009-02-07 14:05 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[-] 2008-08-14 09:57 2185984 CE69DBD54221F2D40E49FF6DB77C6507 c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
[-] 2008-08-14 10:11 2189184 EEAF32F8E15A24F62BECB1BD403BB5C5 c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
[-] 2008-08-14 10:41 2189184 31914172342BFF330063F343AC6958FE c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
[-] 2004-08-04 03:18 2148352 626309040459C3915997EF98EC1C8D40 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
[-] 2005-03-02 00:57 2135552 48B3E89AF7074CEE0314A3E0C7FAFFDB c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
[-] 2008-08-14 09:58 2136064 DD31AB4B91C2605601A3C108AF57A0C9 c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[-] 2007-02-28 09:08 2136064 1220FAF071DEA8653EE21DE7DCDA8BFD c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\ntoskrnl.exe
[-] 2009-02-06 10:32 2186112 6A936E9D7BADAF3CAAEED1E1966EC1B0 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\ntoskrnl.exe
[-] 2009-02-07 14:05 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\ntoskrnl.exe
[-] 2009-02-06 17:22 2136064 16B5EBE97F243441264A8F8694C2F2AA c:\windows\system32\ntoskrnl.exe
[-] 2009-02-06 17:24 2180480 FACEBB0CA3154F77009CDFEE78A00BBB c:\windows\system32\dllcache\ntoskrnl.exe

[-] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2004-08-04 04:56 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2007-06-13 10:23 975360 9784E0719124E4A23989AEF9E7CA02D6 c:\windows\system32\dllcache\explorer.exe

[-] 2009-02-06 10:22 110592 4712531AB7A01B7EE059853CA17D39BD c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe
[-] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2004-08-04 04:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\$NtUninstallKB956572$\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\services.exe
[-] 2009-02-06 10:22 110592 4712531AB7A01B7EE059853CA17D39BD c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\services.exe
[-] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\system32\services.exe
[-] 2009-02-06 17:14 110592 37561F8D4160D62DA86D24AE41FAE8DE c:\windows\system32\dllcache\services.exe

[-] 2004-08-04 04:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\system32\lsass.exe
[-] 2004-08-04 04:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\system32\dllcache\lsass.exe

[-] 2004-08-04 04:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\system32\ctfmon.exe
[-] 2004-08-04 04:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\system32\dllcache\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2004-08-04 04:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\system32\dllcache\spoolsv.exe

[-] 2004-08-04 04:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\system32\userinit.exe
[-] 2004-08-04 04:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\system32\dllcache\userinit.exe

[-] 2004-08-04 04:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\system32\termsrv.dll
[-] 2004-08-04 04:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\system32\dllcache\termsrv.dll

[-] 2004-08-04 04:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\system32\powrprof.dll
[-] 2004-08-04 04:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\system32\dllcache\powrprof.dll

[-] 2004-08-04 04:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\system32\imm32.dll
[-] 2004-08-04 04:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\system32\dllcache\imm32.dll

[-] 2004-08-04 04:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\system32\sfcfiles.dll
[-] 2004-08-04 04:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\system32\dllcache\sfcfiles.dll

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Fri May 15, 2009 6:50 am

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-15 06:38 . 2009-05-15 06:38 16384 c:\windows\Temp\Perflib_Perfdata_76c.dat
+ 2009-05-15 06:38 . 2009-05-15 06:38 16384 c:\windows\Temp\Perflib_Perfdata_72c.dat
- 2007-11-13 11:31 . 2008-07-14 11:09 62976 c:\windows\system32\tzchange.exe
+ 2007-11-13 11:31 . 2008-10-22 09:47 62976 c:\windows\system32\tzchange.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 90112 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\xlicons.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 90112 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\xlicons.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 45056 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\wordicon.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 45056 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\wordicon.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 22528 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\unbndico.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 22528 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\unbndico.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 30720 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\pptico.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 30720 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\pptico.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 16384 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\PEicons.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 16384 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\PEicons.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 34304 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\misc.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 34304 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\misc.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 81920 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\fpicon.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 81920 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\fpicon.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 3584 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\opwicon.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 3584 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\opwicon.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 8192 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\mspicons.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 8192 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\mspicons.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 2560 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 2560 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 114688 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\outicon.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 114688 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\outicon.exe
- 2008-01-15 11:18 . 2009-05-12 15:12 167936 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\accicons.exe
+ 2008-01-15 11:18 . 2009-05-14 16:31 167936 c:\windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\accicons.exe
+ 2008-01-18 12:53 . 2009-05-07 07:16 24699336 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"VisualTooltip"="e:\downloads\windows\crystalxp\visual\VisualToolTip.exe" [2007-04-25 956928]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-18 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-08 778240]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Metacafe.lnk - c:\program files\Metacafe\MetacafeAgent.exe [2009-2-18 145736]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Documents and Settings\\ace\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\ace\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3676:TCP"= 3676:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
"1033:TCP"= 1033:TCP:Akamai NetSession Interface
"1044:TCP"= 1044:TCP:Akamai NetSession Interface
"1041:TCP"= 1041:TCP:Akamai NetSession Interface
"1032:TCP"= 1032:TCP:Akamai NetSession Interface
"1523:TCP"= 1523:TCP:Akamai NetSession Interface
"1043:TCP"= 1043:TCP:Akamai NetSession Interface
"2672:TCP"= 2672:TCP:Akamai NetSession Interface
"1047:TCP"= 1047:TCP:Akamai NetSession Interface
"1040:TCP"= 1040:TCP:Akamai NetSession Interface
"1045:TCP"= 1045:TCP:Akamai NetSession Interface
"1039:TCP"= 1039:TCP:Akamai NetSession Interface
"2705:TCP"= 2705:TCP:Akamai NetSession Interface
"1076:TCP"= 1076:TCP:Akamai NetSession Interface
"1050:TCP"= 1050:TCP:Akamai NetSession Interface
"1051:TCP"= 1051:TCP:Akamai NetSession Interface
"1042:TCP"= 1042:TCP:Akamai NetSession Interface
"1071:TCP"= 1071:TCP:Akamai NetSession Interface
"1036:TCP"= 1036:TCP:Akamai NetSession Interface
"1031:TCP"= 1031:TCP:Akamai NetSession Interface
"1034:TCP"= 1034:TCP:Akamai NetSession Interface
"2567:TCP"= 2567:TCP:Akamai NetSession Interface
"1083:TCP"= 1083:TCP:Akamai NetSession Interface
"3649:TCP"= 3649:TCP:Akamai NetSession Interface
"1048:TCP"= 1048:TCP:Akamai NetSession Interface
"1049:TCP"= 1049:TCP:Akamai NetSession Interface
"1063:TCP"= 1063:TCP:Akamai NetSession Interface
"1038:TCP"= 1038:TCP:Akamai NetSession Interface
"1115:TCP"= 1115:TCP:Akamai NetSession Interface
"1079:TCP"= 1079:TCP:Akamai NetSession Interface
"1046:TCP"= 1046:TCP:Akamai NetSession Interface
"1087:TCP"= 1087:TCP:Akamai NetSession Interface
"3087:TCP"= 3087:TCP:Akamai NetSession Interface
"1037:TCP"= 1037:TCP:Akamai NetSession Interface
"4404:TCP"= 4404:TCP:Akamai NetSession Interface
"1388:TCP"= 1388:TCP:Akamai NetSession Interface
"1342:TCP"= 1342:TCP:Akamai NetSession Interface
"1072:TCP"= 1072:TCP:Akamai NetSession Interface
"1469:TCP"= 1469:TCP:Akamai NetSession Interface
"2853:TCP"= 2853:TCP:Akamai NetSession Interface
"1460:TCP"= 1460:TCP:Akamai NetSession Interface

R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [8/4/2004 10:26 AM 14336]
R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [10/6/2008 6:16 PM 82696]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [9/18/2008 12:09 PM 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2/12/2009 4:52 PM 104328]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [1/20/2009 7:16 PM 172032]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [10/5/2008 8:15 PM 33752]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [3/19/2008 11:11 PM 13352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2009-05-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1659004503-2146901713-839522115-1003.job
- c:\documents and settings\ace\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-25 11:12]

2009-05-15 c:\windows\Tasks\User_Feed_Synchronization-{8FF5E086-A276-4C2E-8EE8-A375FE0F689A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 21:35]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {BDF43518-8EE6-418C-9110-714B8BF8B4EA} = 202.56.215.54,202.56.215.55
DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - component: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - plugin: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\documents and settings\ace\Application Data\Mozilla\Firefox\Profiles\ua3ndsa6.default\extensions\iaplayer@instantaction.com\plugins\npiaplayer.dll
FF - plugin: c:\documents and settings\ace\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\ace\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npExentCtl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\VLC\npvlc.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-05-15 12:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-2146901713-839522115-1003\Software\YourCompanyName\YourProductName\Version*]
"VersionData"=hex:0c,42,46,f6,23,bc,3e,2d,7a,2e,97,ca,8b,29,77,15,00,f2,c3,72,
58,b5,be,94,1f,90,16,e0,3a,99,33,1e,44,b0,15,57,a9,8e,58,50,89,88,82,88,9d,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(536)
e:\downloads\windows\crystalxp\visual\VisualTooltip.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\SigmaTel\C-Major Audio\WDM\stacsv.exe
c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
c:\program files\BitDefender\BitDefender 2009\seccenter.exe
c:\program files\Common Files\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-05-15 12:14 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-15 06:44
ComboFix2.txt 2009-05-14 13:17
ComboFix3.txt 2009-05-13 13:44

Pre-Run: 11,898,462,208 bytes free
Post-Run: 11,831,111,680 bytes free

461 --- E O F --- 2009-05-14 16:32

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Fri May 15, 2009 8:26 am

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Fri May 15, 2009 12:34 pm

it's running fine now.... Smile

thank you...

but i am facing small problems like mozilla firefox taking 2-3 minutes before starting up and bitdefender still hanging when i click the "Scan now" button..
i think i need to ask these problems in the respective threads..

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Fri May 15, 2009 1:04 pm

It's possibly because the amount of stuff you have running in the background is hogging your processor.

Post me a NEW Hijack This log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Fri May 15, 2009 2:27 pm

here's the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:55:28 PM, on 5/15/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
E:\downloads\windows\crystalxp\visual\VisualToolTip.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1A7D97A7-6D0A-4A25-91B1-1757D0E917E1} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [VisualTooltip] E:\downloads\windows\crystalxp\visual\VisualToolTip.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - [You must be registered and logged in to see this link.]
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - [You must be registered and logged in to see this link.]
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} (F-Secure Health Check 1.1) - [You must be registered and logged in to see this link.]
O16 - DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} (DinerDash Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) -
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{BDF43518-8EE6-418C-9110-714B8BF8B4EA}: NameServer = 202.56.215.54,202.56.215.55
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

--
End of file - 9775 bytes

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Fri May 15, 2009 2:30 pm

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O2 - BHO: (no name) - {1A7D97A7-6D0A-4A25-91B1-1757D0E917E1} - (no file)
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKLM\..\Run: [VisualTooltip] E:\downloads\windows\crystalxp\visual\VisualToolTip.exe
    O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe


  • Press "Fix Checked"
  • Close Hijack This.

I recommend you remove the Java Quick Starter because it's not needed.
To do so, follow these instructions.

Go to Start > Control Panel > Java.
In the Java control panel, open the click the Advanced tab. Click the + in front of Miscellaneous and uncheck the Java Quick Starter box.

See [You must be registered and logged in to see this link.] for more info.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Fri May 15, 2009 2:50 pm

Done the above steps but bitdefender still hanging

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Fri May 15, 2009 2:54 pm

Okay, last thought would be that the malware has messed with it. You can try uninstalling it, then re-install it, or uninstall it and switch to a different AV like Avira.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Fri May 15, 2009 2:59 pm

ok i will try re-installing it...

and than get back to you...

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Sat May 16, 2009 12:13 pm

bitdefender is still hanging!!!!!
while uninstalling bitdefender using bitdefender uninstall tool it showed cannot delete main registry, etc. etc. i was not able to see the whole list....

can that be the problem it is uninstalling completely..

and i want to ask one more thing that while starting windows it now shows two options(only for 2 seconds and after that windows xp starts):
1. Window restore
2. Window XP professional

is that fine??

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Sat May 16, 2009 1:53 pm

It's the recovery console extra menu. Combofix is a very powerful tool, and very dangerous at the same time, so Combofix wants to install the Recovery Console before running. This allows us to enter a special mode which allows us to do what we want/need to do should anything go wrong.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Sun May 17, 2009 6:22 am

ok.......
So now what should i do with bitdefender?? should i use it or remove it and how is Avira, is the free edition good enough or AVG8 or any other...please help!!
Please tell the combination of antivirus,antimalware,antispam,spyware and antiphishing,internat protection as well..

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by Belahzur on Sun May 17, 2009 1:06 pm

Avira is very light on the system, I use it myself.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Help needed regarding winibluesoft!!!!!

Post by gtp1 on Mon May 18, 2009 5:26 am

ok thank you so much Belahzur...

gtp1
Intermediate
Intermediate

Posts Posts : 68
Joined Joined : 2009-05-10
Gender Gender : Male
OS OS : Windows 7 Home Premium (64 bit)
Points Points : 27976
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum