WiredWX Hobby Weather ToolsLog in

 


WiniBlue Soft removal

3 posters

descriptionWiniBlue Soft removal EmptyWiniBlue Soft removal

more_horiz
can you help me remove winiblue soft please. I contacted you a few weeks ago and got the checked boxes you told me to fix but my computer crashed and when i got it workig the boxes were different. here is what it says now

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:29:10 PM, on 6/4/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - https://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1224999785837
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate1c9999199297b30) (gupdate1c9999199297b30) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 14949 bytes

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
    O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
    O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
    O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
    O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Ok so when i did then scan only to get ready to check the ones that needed to be fixed, this one was not there anymore
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
this is a tricky little bug. I fixed the other ones though and downloaded the program.

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Malwarebytes' Anti-Malware 1.37
Database version: 2182
Windows 6.0.6001 Service Pack 1

6/9/2009 1:59:12 AM
mbam-log-2009-06-09 (01-59-12).txt

Scan type: Quick Scan
Objects scanned: 73529
Time elapsed: 8 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 13
Registry Values Infected: 0
Registry Data Items Infected: 9
Folders Infected: 3
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{497dddb6-6eee-4561-9621-b77dc82c1f84} (Adware.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4e980492-027b-47f1-a7ab-ab086dacbb9e} (Adware.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5ead8321-fcbb-4c3f-888c-ac373d366c3f} (Adware.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{31f3cf6e-a71a-4daa-852b-39ac230940b4} (Adware.Ascentive) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WiniBlueSoft (Rogue.WiniBlue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NetProject (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3b5d7f84-2cc3-4841-bbdc-8027220a509a}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{76e48418-df3c-4ee9-9aa7-3a35f7e0afd4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{3b5d7f84-2cc3-4841-bbdc-8027220a509a}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{76e48418-df3c-4ee9-9aa7-3a35f7e0afd4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{3b5d7f84-2cc3-4841-bbdc-8027220a509a}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{76e48418-df3c-4ee9-9aa7-3a35f7e0afd4}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.169,85.255.112.111 -> Quarantined and deleted successfully.

Folders Infected:
c:\Users\Allen P Butler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Program Files\HDPlugin (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
c:\windows\system32\gaopdxpdexqtwdijntcgiyypuoyqmniwmqxsyu.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\System32\setup2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Windows\System32\SysRestore.dll (Adware.Ascentive) -> Quarantined and deleted successfully.
c:\programdata\microsoft\Windows\start menu\Programs\HDPlugin\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully.
c:\program files\HDPlugin\Uninstall.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Windows\System32\gaopdxcounter (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\allen p butler\favorites\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully.


this is what it found and deleted. im about to restart to see if winiblue soft if gone.

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Ok winiblue soft is not there anymore! Thanks a lot, i will give a donation to keep the site going

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Hello.
It's not gone, the rootkit is still there.

Please post a new Hijack This log.

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
here is the new hijack this log
ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:29:10 PM, on 6/4/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - https://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1224999785837
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate1c9999199297b30) (gupdate1c9999199297b30) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 14949 bytes

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Please disable Ad-Watch, as it may hinder the removal of some HijackThis entries. You can re-enable it after your computer is clean. Please see here for instructions on how to disable it:

1. Right-click on the Ad-Watch icon in the system tray (located down by the system clock for most configurations)
2. Choose *Settings* from the dropdown menu
3. Under the *General Settings* tab turn OFF (red x) the option to "Load Ad-Watch at Startup" (if enabled)
WiniBlue Soft removal Post-65-1216314425
4. Click on the *Status* button in the left hand menu
5. Turn OFF (red x) the option for *Regshield*
6. Close that window, then right-click on the Ad-Watch icon shield again down in the system tray next to the clock.
7. Choose *Turn off Ad-Watch* from the drop menu




  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
    O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
    O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
    O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
    O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
    O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
    O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111



  • Press "Fix Checked"
  • Close Hijack This.






  • Download combofix from here
    Link 1
    Link 2

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:

WiniBlue Soft removal CF_download_FF

WiniBlue Soft removal CF_download_rename

3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See HERE for how to disable your AV. (Mcafee)
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Ok i checked all the boxes i could see from that list but some were still not showing up in the scan only. I also dont have the ad-watch like the one above but I do have ad-aware and right clicked on it in the systray and clicked disable so hopefully that worked. I ran Hijack again and this is what it says now

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:29:10 PM, on 6/4/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: FB Toolbar - {A057A204-BACC-4D26-8988-34A187E2698B} - C:\PROGRA~1\MYFBTO~1\MYFBTO~1.DLL
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\ALLENP~1\AppData\Local\Temp\awtsPGYO.dll,c
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\ALLENP~1\AppData\Local\Temp\qkbvktuq.dll",run
O4 - HKCU\..\Run: [BM786927fa] Rundll32.exe "C:\Users\ALLENP~1\AppData\Local\Temp\kirnhrld.dll",s
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - https://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1224999785837
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B5D7F84-2CC3-4841-BBDC-8027220A509A}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{76E48418-DF3C-4EE9-9AA7-3A35F7E0AFD4}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate1c9999199297b30) (gupdate1c9999199297b30) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 14949 bytes

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Hello.
Before doing anything else, lets remove AVG because you having two AV's running and that is dangerous.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Ok here is the list of the programs

Activation Assistant for the 2007 Microsoft Office suites
ActiveCheck component for HP Active Support Library
Ad-Aware
Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.4
Adobe Shockwave Player 11
Apple Mobile Device Support
Apple Software Update
Before You Know It 3.6
Bonjour
Conexant HD Audio
DAEMON Tools Toolbar
ESU for Microsoft Vista
FastStone Image Viewer 3.5
GEAR driver installer for x86 and x64
GearDrvs
Google Earth
Google Earth Plugin
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
HDAUDIO Soft Data Fax Modem with SmartCP
HijackThis 2.0.2
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.2
HP Easy Setup - Frontend
HP Help and Support
HP Photosmart Essential 2.0
HP Quick Launch Buttons 6.20 D3
HP Total Care Advisor
HP Update
HP User Guides 0079
HP Wireless Assistant
HPAsset component for HP Active Support Library
HPNetworkAssistant
InstallMgr
Intel(R) Graphics Media Accelerator Driver
iTunes
Java(TM) 6 Update 13
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6
LibUSB-Win32-0.1.12.1
LimeWire 5.1.3
Malwarebytes' Anti-Malware
Microsoft Default Manager
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
MobileMe Control Panel
MSCU for Microsoft Vista
MSN Toolbar
MSN Toolbar
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
muvee autoProducer 6.0
My HP Games
Norton 360
OpenOffice.org Installer 1.0
QuickFreedom 1.1.0
QuickTime
Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista
Rhapsody
Rhapsody Player Engine
Rosetta Stone Version 3
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Safari
Sandlot Games Client Services
Symantec Technical Support Web Controls
Synaptics Pointing Device Driver
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Toolbar

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Hello.

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If Limewire is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    Java(TM) 6 Update 13
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Java(TM) SE Runtime Environment 6
    LimeWire 5.1.3

Try running Combofix now.

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
I removed all the Java and limewire, Here is what combo-fix log says. The log is huge so i have to break it up into several different post. Please let me know if there are anymore steps I need to take. Thanks



ComboFix 09-06-09.06 - Allen P Butler 06/10/2009 21:27.1 - NTFSx86
Microsoft®️ Windows Vista™️ Home Premium 6.0.6001.1.1252.1.1033.18.1013.342 [GMT -4:00]
Running from: c:\users\Allen P Butler\Desktop\Combo-Fix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\10337hazk9ool509.ocx
c:\windows\11143w5zm6bc9.cpl
c:\windows\111e9t5az500.dll
c:\windows\11526noz-a-vir9s400.bin
c:\windows\11590spambot470z.ocx
c:\windows\11653wormz95.ocx
c:\windows\11679zot9a-virus3e05.cpl
c:\windows\12665sza9bot449.ocx
c:\windows\12995zroj656.exe
c:\windows\135939azktool256.ocx
c:\windows\137685rojz9f.dll
c:\windows\13849nzt-a-5irus196.cpl
c:\windows\14235zp51c89.bin
c:\windows\14569teal54z9.cpl
c:\windows\147zvir9s563.dll
c:\windows\14dzspar591154.ocx
c:\windows\14e9bazkdoo52980.cpl
c:\windows\15076wzrm19.bin
c:\windows\15146zpy295.ocx
c:\windows\1517hack5o9l29z.exe
c:\windows\151cth5ef1699z.ocx
c:\windows\15536s9amzot41e.cpl
c:\windows\15556v9rus7fz.dll
c:\windows\15584troz569.exe
c:\windows\15599spambzt5a9.ocx
c:\windows\1559zspamb9t6bf.bin
c:\windows\1569backzo9r2518.exe
c:\windows\15859troj3zf9.dll
c:\windows\15d4th9ef288z.ocx
c:\windows\15z0vi95919.bin
c:\windows\15z9th9eat19154.exe
c:\windows\16329hackzool395.dll
c:\windows\16491haz5t9ol1fa.bin
c:\windows\1677359z14.dll
c:\windows\16946z5rm44c9.exe
c:\windows\16e5szywar92700.bin
c:\windows\16z50s5y279.ocx
c:\windows\16z545pa9bot331.bin
c:\windows\16z62spy559.dll
c:\windows\17195py7dfz.bin
c:\windows\17899zot-a-v5rus150.dll
c:\windows\179219izus2f05.dll
c:\windows\17d4spazs95527.dll
c:\windows\18099tro55ze.ocx
c:\windows\18139spz2f45.bin
c:\windows\18955teaz2483.exe
c:\windows\1895tzreat19885.cpl
c:\windows\18979zroj54b.exe
c:\windows\18z16spamb5t96f.ocx
c:\windows\190295ir9z469.ocx
c:\windows\19245hacktool3zf9.ocx
c:\windows\19368not-a-vizu5361.exe
c:\windows\1945zy37e.ocx
c:\windows\19539hacktoo5z73.dll
c:\windows\195605acztool69b.dll
c:\windows\1957vir128z.ocx
c:\windows\19588troj77z9.exe
c:\windows\1959hiefz058.bin
c:\windows\195backdoor169z.exe
c:\windows\195z5s5ambot449.bin
c:\windows\19670spamboz745.exe
c:\windows\196729irus59fz.bin
c:\windows\19ccd5wzloader362.ocx
c:\windows\1cb0backdooz1859.exe
c:\windows\1dczhi9f4285.bin
c:\windows\1e93sparse96z95.cpl
c:\windows\1f1dthief9z305.cpl
c:\windows\1fc3steaz98125.ocx
c:\windows\1z058viru5499.exe
c:\windows\1z080not-a-9ir5s76d.ocx
c:\windows\1z998sp5498.bin
c:\windows\200z9virus52d9.exe
c:\windows\20404not-9-zir5s57c.bin
c:\windows\20536n5t-a-vizu975.cpl
c:\windows\210495ot-a-vzrus423.bin
c:\windows\2161v9rz175.dll
c:\windows\21a5th9eat10z525.ocx
c:\windows\21z065irus4e89.dll
c:\windows\22048tz9540c.cpl
c:\windows\22160nzt-a-viru55f29.bin
c:\windows\2225thief9z38.dll
c:\windows\22365hz5ktool3f9.cpl
c:\windows\22429z9t-a-vir5sa1.cpl
c:\windows\22483s5azbot3ca9.bin
c:\windows\22649spy7zb5.dll
c:\windows\2273zwo5m5b9.cpl
c:\windows\22902v5rus3z9.ocx
c:\windows\22922szambo5147.exe
c:\windows\23185tr9j6a3z.bin
c:\windows\2325zvirus39b5.dll
c:\windows\24549spz4d39.ocx
c:\windows\24565tzoj429.exe
c:\windows\2459zot-a-virus149.ocx
c:\windows\25117t5ojz6c9.ocx
c:\windows\251z29pambot4a.bin
c:\windows\2527szy9are3269.exe
c:\windows\25300not-a9zirus3bb.dll
c:\windows\25582spa9bot76z.bin
c:\windows\25655hreat17z97.ocx
c:\windows\25662ha9ktool75fz.bin
c:\windows\257459irusfz.cpl
c:\windows\25815trzjfb9.cpl
c:\windows\2598zhac9tool630.ocx
c:\windows\259baddwzre2945.cpl
c:\windows\25z59spam9ot375.exe
c:\windows\26276n5tza-viru97af.bin
c:\windows\26346hack9zol395.cpl
c:\windows\268dback9ooz2165.exe
c:\windows\26z16tr59489.bin
c:\windows\27297sp5zb9t536.cpl
c:\windows\27319w5rz3a4.bin
c:\windows\2755zworm69b.bin
c:\windows\27785virzs91b.cpl
c:\windows\27954spyz9.bin
c:\windows\27995h95ktool75z.dll
c:\windows\27z97viru927d5.exe
c:\windows\287095orz30a.cpl
c:\windows\288z959oj74a.bin
c:\windows\28b45teal3z529.exe
c:\windows\2905zspy7e8.ocx
c:\windows\2906s5y6z.dll
c:\windows\290addwaze3025.dll
c:\windows\29456spa9botzf9.ocx
c:\windows\29529sp9mboz545.exe
c:\windows\29555spambzt521.ocx
c:\windows\295csz5al2691.ocx
c:\windows\2975addwarz2400.exe
c:\windows\29899vi9us5z3.dll
c:\windows\29928nzt-a-vir5se7.cpl
c:\windows\29975vizus252.bin
c:\windows\2a54add9arez551.bin
c:\windows\2a5faz5wa9e2584.ocx
c:\windows\2c22zhief9759.cpl
c:\windows\2e4z9hi5f788.bin
c:\windows\2z004t5o99d.exe
c:\windows\2z77sp9ware11465.exe
c:\windows\2zb9thie56839.dll
c:\windows\2zd3spyware20995.exe
c:\windows\3006859cktoolzfc.ocx
c:\windows\30518not-9-5izus585.ocx
c:\windows\30613s9y45z.dll
c:\windows\30935szy2f9.ocx
c:\windows\309z5spy4de.exe
c:\windows\31352wz95593.dll
c:\windows\31355tr5z29.exe
c:\windows\31975v5zus589.ocx
c:\windows\321825irus7z9.dll
c:\windows\32243hz9ktool3405.ocx
c:\windows\32759r5j561z.bin
c:\windows\335d9hief2z.dll
c:\windows\3458thr95t19z57.bin
c:\windows\34cfzir26589.dll
c:\windows\352279acktoozad.dll
c:\windows\352eaddware9149z.ocx
c:\windows\3551adzware14699.ocx
c:\windows\3565zddwa9e845.ocx
c:\windows\35999troj30z.dll
c:\windows\359vir827z.ocx
c:\windows\359z6troj797.cpl
c:\windows\35z9addwa9e1014.ocx
c:\windows\366z9hief13295.cpl
c:\windows\367fdown5oad9rz91.ocx
c:\windows\3895not-a-virus6f5z.ocx
c:\windows\389dvir93z95.bin
c:\windows\39585vi5zs6b1.dll
c:\windows\395eth9ezt29640.bin
c:\windows\395zorm5ee.bin
c:\windows\39e9zt5al962.ocx
c:\windows\3ad8thie9236z5.exe
c:\windows\3bdf95arse173z.ocx
c:\windows\3cd8st9zl4765.dll
c:\windows\3d6d9zywa5e393.dll
c:\windows\3d95spyware99z.exe
c:\windows\3f59vzr904.dll
c:\windows\415aaddware1z09.dll
c:\windows\41639ackzoor95.exe
c:\windows\41z9addwar526.dll
c:\windows\4259roj57z.cpl
c:\windows\4265steaz9163.dll
c:\windows\4368adzw59e885.bin
c:\windows\4392bz5kdoor1752.cpl
c:\windows\43fcadd5are9z99.cpl
c:\windows\4522sz9al1008.cpl
c:\windows\4566spazs91457.exe
c:\windows\459csparse1852z.exe
c:\windows\4691do9nloade51037z.bin
c:\windows\48z5stea520419.bin
c:\windows\4915s5ywarz2660.exe
c:\windows\4949zpambo55e.bin
c:\windows\49785acktool3zd.bin
c:\windows\49c5spyz5re1960.dll
c:\windows\49cfbazkdoor26895.ocx
c:\windows\49dead9w5re3z2.bin
c:\windows\49s5eaz2502.exe
c:\windows\4b6estezl23559.ocx
c:\windows\4b9ddozn5oader466.dll
c:\windows\4cbbthr9at27z165.exe
c:\windows\4f68th9ez51372.cpl
c:\windows\4f9zvir9405.ocx
c:\windows\4ff8downlz9d5r2368.bin
c:\windows\4z95th9ef2587.ocx
c:\windows\5025threzt3191.bin
c:\windows\50465sp94z2.dll
c:\windows\515aspzware2391.cpl
c:\windows\5241vir91z6.ocx
c:\windows\52581worm2ez9.dll
c:\windows\5265w9rm10z.exe
c:\windows\52899worm208z.cpl
c:\windows\5297vir254z.ocx
c:\windows\52b4zhre9t24345.dll
c:\windows\52e1back9oor2812z.bin
c:\windows\52eeaz9ware5141.exe
c:\windows\5329vir29z05.cpl
c:\windows\5347dz5nloade92948.bin
c:\windows\535z7wor9513.exe
c:\windows\53a0spywar9563z.cpl
c:\windows\53e3virz986.dll
c:\windows\548fspyware9538z.bin
c:\windows\54a2thre9tz5386.exe
c:\windows\54zav9r611.dll
c:\windows\5500th5e9t1z913.dll
c:\windows\5505spyz59.ocx
c:\windows\5555vir3z609.bin
c:\windows\555e9oznloader2688.bin
c:\windows\55794zackto9l5af.dll
c:\windows\5591t9reatz469.ocx
c:\windows\5604dow9lozd5r1993.exe
c:\windows\5619sp5rze1537.ocx
c:\windows\56245ot-a-viruszea9.cpl
c:\windows\56299parse1945z.exe
c:\windows\56689hzef2798.dll
c:\windows\5691spywar5746z.bin
c:\windows\56cdspywarez090.bin
c:\windows\5779downlozde968.bin
c:\windows\57z5t9oj2b8.dll
c:\windows\5802vzrus379.cpl
c:\windows\586aaddwaze559.bin
c:\windows\58aes5za977.ocx
c:\windows\59086vi9zs333.bin
c:\windows\5917z5t-a9virus7c4.exe
c:\windows\5925sp9mbot6zc.bin
c:\windows\5956backdo95z402.cpl
c:\windows\5958s5zal597.ocx
c:\windows\595dbackdzor29579.dll
c:\windows\5988sze9l2231.ocx
c:\windows\5bc5dow9loaderz775.exe
c:\windows\5beaspywzr91439.bin
c:\windows\5bf7t9ief59z.bin
c:\windows\5c21zd9ware5171.exe
c:\windows\5c5zthreat90208.bin
c:\windows\5c91b9ckdooz2399.cpl
c:\windows\5c94addware2942z.cpl
c:\windows\5f9zthreat265725.bin
c:\windows\5fdz9ir2583.dll
c:\windows\5z659irus79c.ocx
c:\windows\5zc9thief912.exe
c:\windows\62319a5kdzor2848.bin
c:\windows\6411t5oz49d.bin
c:\windows\65439hief2z29.cpl
c:\windows\6591threzt3666.bin
c:\windows\65a5spywz9e2638.bin
c:\windows\65af5ownlzader2579.ocx
c:\windows\65ebbac9dozr758.exe
c:\windows\66z5sparse9808.dll
c:\windows\6762thr95t723z.dll
c:\windows\690zsteal455.dll
c:\windows\6925virzs9fa5.ocx
c:\windows\6939thizf5635.dll
c:\windows\695evir28z8.cpl
c:\windows\6961hac9tool10z5.cpl
c:\windows\6981not-5-virus99z.ocx
c:\windows\6994thze5t30485.cpl
c:\windows\69dczdd5are686.exe
c:\windows\6a7ftzief1195.dll
c:\windows\6c0dszyw9r51562.bin
c:\windows\6c1fdownzoa9er2519.ocx
c:\windows\6c6dt59efz019.ocx
c:\windows\6d945hiefz473.bin
c:\windows\6e07thre953623z.bin
c:\windows\6e2f5owzloade9327.ocx
c:\windows\6f19viz2596.dll
c:\windows\6f90thzef50649.cpl
c:\windows\6z56thre9t6763.cpl
c:\windows\6z9daddware2852.bin
c:\windows\7020zhie51490.dll
c:\windows\7055bac5zoor1983.cpl
c:\windows\7093addzare5325.bin
c:\windows\721dadd5arz639.ocx
c:\windows\73c05pzw9re1457.cpl
c:\windows\76fcd5wnlzade91599.cpl
c:\windows\775ste9z579.bin
c:\windows\7821not-5zviru964a.exe
c:\windows\7881zackdoo913455.cpl
c:\windows\7951zhi9f573.bin
c:\windows\79fdzddware9295.dll
c:\windows\7abd9irz5555.bin
c:\windows\7azedo95loader384.ocx
c:\windows\7z26downloa95r1092.ocx
c:\windows\7z2b59arse2934.dll
c:\windows\82579i5uz6ec.ocx
c:\windows\85z8t9oj7a55.cpl
c:\windows\8699zpy185.dll
c:\windows\908spazse5499.ocx
c:\windows\9091wo9m5z9.dll
c:\windows\90fvir1z375.ocx
c:\windows\90z8vi9u56e7.cpl
c:\windows\9135spyzc.dll
c:\windows\9183z5arse1940.exe
c:\windows\9186z5irus51b.dll
c:\windows\92498wozm735.exe
c:\windows\92fbackdoorz1395.bin
c:\windows\9559ztro52a5.ocx
c:\windows\95665spz367.exe
c:\windows\95881spy4z4.ocx
c:\windows\96562tzoj7c3.cpl
c:\windows\96z29s5y43c.ocx
c:\windows\99533hacktool65z.ocx
c:\windows\9969spy7z75.cpl
c:\windows\99c4downloade551z.ocx
c:\windows\9b38thzef3151.cpl
c:\windows\9b50downlozder2099.ocx
c:\windows\9b78backdozr15885.dll
c:\windows\9c56vir829z.exe
c:\windows\9e59stealz038.bin
c:\windows\b34d5wnlo9dez1187.exe
c:\windows\b88s9eal2195z.dll
c:\windows\ba9par5e110z.bin
c:\windows\bbv951218z.exe
c:\windows\c90thief2z5.bin
c:\windows\cb95kdoor31z5.ocx
c:\windows\d559parse25z95.dll
c:\windows\db5v9r163z.bin
c:\windows\e2dzpyw9re1556.exe
c:\windows\e55spar9e954z.dll
c:\windows\fa75aczdoor951.bin

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
Here is part 2 to the log


c:\windows\system32\1005dzwnl9ader167.bin
c:\windows\system32\10505ddwaz91062.ocx
c:\windows\system32\1075ad9wa5e2157z.bin
c:\windows\system32\1095noz-a-vir9s79.bin
c:\windows\system32\10aca5dwzre999.ocx
c:\windows\system32\12701z5y294.bin
c:\windows\system32\129935py2z2.exe
c:\windows\system32\12z93virus7519.dll
c:\windows\system32\13487zp9mbo5283.exe
c:\windows\system32\1350zspambotf95.dll
c:\windows\system32\137z9tr5j605.dll
c:\windows\system32\13bzsparse1095.bin
c:\windows\system32\13z9ir1755.ocx
c:\windows\system32\14039wor52z2.dll
c:\windows\system32\1409zt5al9275.bin
c:\windows\system32\143795ormza7.cpl
c:\windows\system32\145559pamzot205.bin
c:\windows\system32\14579zpy693.cpl
c:\windows\system32\14589wzrm4395.dll
c:\windows\system32\14752not-a-vir9sz5e.cpl
c:\windows\system32\14ff9parsz3059.exe
c:\windows\system32\14z4095y293.bin
c:\windows\system32\15271zot-a-vi9us283.bin
c:\windows\system32\152z0hac9to5l5da.bin
c:\windows\system32\15407vir59714z.cpl
c:\windows\system32\154585py194z.ocx
c:\windows\system32\15495s5926z.cpl
c:\windows\system32\15519tzoj89.exe
c:\windows\system32\15599worm7z59.bin
c:\windows\system32\15615zpamb9t72a5.bin
c:\windows\system32\159zad9w5re781.ocx
c:\windows\system32\15e9threatz6519.bin
c:\windows\system32\15z5vir9461.ocx
c:\windows\system32\15z9downloa5er2687.bin
c:\windows\system32\16059w5rmz69.ocx
c:\windows\system32\16499zp5323.cpl
c:\windows\system32\1693zorm5435.bin
c:\windows\system32\16942spa5bzt1ec.bin
c:\windows\system32\169zh5ef2066.cpl
c:\windows\system32\16z64spambot259.bin
c:\windows\system32\17519notza-virus495.dll
c:\windows\system32\17922zir5s59c.exe
c:\windows\system32\17997zot-a-vi5usca.exe
c:\windows\system32\17zspars5987.dll
c:\windows\system32\18594spy45z.bin
c:\windows\system32\18843nzt-9-viru59b.bin
c:\windows\system32\189d5hreat19906z.exe
c:\windows\system32\19003not-a5viruz13d.cpl
c:\windows\system32\19179vizus55b.bin
c:\windows\system32\19362vi5zs7ab.dll
c:\windows\system32\19452wo9m2z9.bin
c:\windows\system32\19505wzrm1df.bin
c:\windows\system32\195z9v5rus9da.ocx
c:\windows\system32\1968z5ckdoor3218.dll
c:\windows\system32\197965orm8z.exe
c:\windows\system32\1b5ddownload9rz89.bin
c:\windows\system32\1c31down9oaderz235.exe
c:\windows\system32\1ccbtzie95037.bin
c:\windows\system32\1d925ownloadez129.exe
c:\windows\system32\1f55spy9aze1384.cpl
c:\windows\system32\1z883no95a-virus212.exe
c:\windows\system32\1z955hacktool36b.cpl
c:\windows\system32\2058not-a-9irus3z0.cpl
c:\windows\system32\20732no95a-vzrus391.ocx
c:\windows\system32\20854hack59oz610.ocx
c:\windows\system32\20z52virus928.ocx
c:\windows\system32\2139zir14605.exe
c:\windows\system32\21669zpambot558.exe
c:\windows\system32\2191downloa5er9871z.ocx
c:\windows\system32\22093zpambot589.cpl
c:\windows\system32\2242z9ir5s157.cpl
c:\windows\system32\22614sp5z79.cpl
c:\windows\system32\227539za5bot280.exe
c:\windows\system32\22999h5cktoolb4z.exe
c:\windows\system32\2325zno9-a-virus53.exe
c:\windows\system32\23665not-9-viruz7ab.cpl
c:\windows\system32\23669spazbot5ec.dll
c:\windows\system32\23865tzoj9bb.dll
c:\windows\system32\23929viru5348z.dll
c:\windows\system32\2419tr5j505z.dll
c:\windows\system32\24555zpy295.bin
c:\windows\system32\24759vizu5197.dll
c:\windows\system32\25045hackto9z86.ocx
c:\windows\system32\25050hacztool59b.exe
c:\windows\system32\254219pzc3.ocx
c:\windows\system32\254269acktoolza5.cpl
c:\windows\system32\25479spy15bz.dll
c:\windows\system32\25553trzj469.bin
c:\windows\system32\2569troz121.ocx
c:\windows\system32\25731viz9s5b3.bin
c:\windows\system32\25795zpa5bot294.cpl
c:\windows\system32\259629irus6az.ocx
c:\windows\system32\25b4spyw9re2z99.ocx
c:\windows\system32\25bzdownloade92437.exe
c:\windows\system32\25fdt9rzat7566.exe
c:\windows\system32\25z549pambot7f1.exe
c:\windows\system32\26442tr5j329z.dll
c:\windows\system32\26575hacktozl1369.dll
c:\windows\system32\2664b5ck9ooz2768.ocx
c:\windows\system32\26z49t9oj59b.ocx
c:\windows\system32\2721st5al2922z.dll
c:\windows\system32\272s5arse9z1.bin
c:\windows\system32\2756095rm19z.ocx
c:\windows\system32\276385iruz997.ocx
c:\windows\system32\27z55troj7949.dll
c:\windows\system32\28058worm9z.dll
c:\windows\system32\2833vzrus559.ocx
c:\windows\system32\285zt9o5144.bin
c:\windows\system32\28625hacktzol393.dll
c:\windows\system32\289319ot-a-virz5249.dll
c:\windows\system32\28bazo5n9oader653.dll
c:\windows\system32\29507zot-a-virus55e.cpl
c:\windows\system32\29518h5cztool614.exe
c:\windows\system32\29599zyware359.bin
c:\windows\system32\295z5troj46.ocx
c:\windows\system32\297779zrus145.exe
c:\windows\system32\297ha9ktooz54.dll
c:\windows\system32\29935hzc5to9l4a8.ocx
c:\windows\system32\29981w5rz66d.bin
c:\windows\system32\29z15spy676.ocx
c:\windows\system32\2az6ba9kdoor3510.cpl
c:\windows\system32\2e90s95zl93.cpl
c:\windows\system32\2z4319orm5cd.dll
c:\windows\system32\30090hzcktool950.bin
c:\windows\system32\304c9teal5z49.exe
c:\windows\system32\30666hacktozl5c95.ocx
c:\windows\system32\30z795eal875.exe
c:\windows\system32\31601ha9kzool645.ocx
c:\windows\system32\31824t5oj4za9.dll
c:\windows\system32\322z59irus6c6.ocx
c:\windows\system32\32704z9555f.cpl
c:\windows\system32\33bcthr95t15z97.bin
c:\windows\system32\3439th9ef1z05.dll
c:\windows\system32\35226spzm9ot6a5.ocx
c:\windows\system32\354zspyw9re12.exe
c:\windows\system32\35725rzj519.dll
c:\windows\system32\357espyw9re3166z.dll
c:\windows\system32\359129rojz62.exe
c:\windows\system32\35a8t9zef1566.cpl
c:\windows\system32\37f1z5e9l1294.dll
c:\windows\system32\389aste5z2283.exe
c:\windows\system32\3939down5zader2992.cpl
c:\windows\system32\393e59arsz1216.bin
c:\windows\system32\39556zorm624.cpl
c:\windows\system32\3973not-5zvirus993.ocx
c:\windows\system32\399z9s5y642.exe
c:\windows\system32\39c4zd9war5145.ocx
c:\windows\system32\39dfbackdooz2745.exe
c:\windows\system32\3a1ztea518119.ocx
c:\windows\system32\3a7cvzr25429.ocx
c:\windows\system32\3az5stea92845.exe
c:\windows\system32\3c08d5wnloa9er890z.bin
c:\windows\system32\3d2cb9z5door445.dll
c:\windows\system32\3e39downlozd5r21949.dll
c:\windows\system32\3efezow5l9ader295.cpl
c:\windows\system32\3z370tro58f9.bin
c:\windows\system32\3z49spa5se1079.ocx
c:\windows\system32\3z605spambo93c2.dll
c:\windows\system32\3za2sp5wa9e1971.cpl
c:\windows\system32\4092t5oj5z19.ocx
c:\windows\system32\4259zackto5l93f.dll
c:\windows\system32\42a9tzreat170735.exe
c:\windows\system32\4403not-a-z9r5s417.exe
c:\windows\system32\4553zpy59re897.exe
c:\windows\system32\4575vir289z.cpl
c:\windows\system32\45aczownload9r5210.bin
c:\windows\system32\4685doznloade92055.dll
c:\windows\system32\4795szarse1599.bin
c:\windows\system32\47d4st9al5z27.exe
c:\windows\system32\4835spywar9z031.bin
c:\windows\system32\4898thiz55.dll
c:\windows\system32\48e5dowzloade52295.cpl
c:\windows\system32\49145ir9s309z.bin
c:\windows\system32\491at5re9t20z.bin
c:\windows\system32\4956spzware2291.bin
c:\windows\system32\4996back5oor794z.ocx
c:\windows\system32\49ez5pywar9159.exe
c:\windows\system32\4b21viz1959.exe
c:\windows\system32\4b35do9nloader23z9.exe
c:\windows\system32\4c9faddwarz7695.ocx
c:\windows\system32\4ccdstzal16195.ocx
c:\windows\system32\4d95ownloade9z015.exe
c:\windows\system32\4dzaddw5re3209.cpl
c:\windows\system32\4fb9bazkd5or1239.dll
c:\windows\system32\4z2d5hreat10409.exe
c:\windows\system32\5037thr9az11989.dll
c:\windows\system32\5080znot-a-vir9s6e2.exe
c:\windows\system32\513539pamboz7e1.bin
c:\windows\system32\51519hi5z2908.exe
c:\windows\system32\51ac5par9z2530.exe
c:\windows\system32\51cadownloader5z98.bin
c:\windows\system32\5262azdw5re2593.exe
c:\windows\system32\526cth5ea917326z.cpl
c:\windows\system32\5356ste9l2z08.cpl
c:\windows\system32\5400zownload5r31529.bin
c:\windows\system32\54779aczdoor1945.cpl
c:\windows\system32\5489stezl3149.exe
c:\windows\system32\5495szy16f.bin
c:\windows\system32\55155not-a-vi9uszf6.bin
c:\windows\system32\553fvz51089.dll
c:\windows\system32\55410z9ambotf9.dll
c:\windows\system32\5594szarse2809.cpl
c:\windows\system32\55bfz59233.dll
c:\windows\system32\55ccvir9z9.exe
c:\windows\system32\55d1bzckdoor1696.ocx
c:\windows\system32\56065ot-a9virus6zc.bin
c:\windows\system32\5656doznloader10059.dll
c:\windows\system32\565dstzal9295.bin
c:\windows\system32\56caste9l5z07.exe
c:\windows\system32\56czsparse1609.bin
c:\windows\system32\56dzs9eal1905.ocx
c:\windows\system32\57601zpy92b.ocx
c:\windows\system32\57e1zhi9f1212.cpl
c:\windows\system32\58eetz9ef539.ocx
c:\windows\system32\5908zworm281.ocx
c:\windows\system32\5954s5zrse169.bin
c:\windows\system32\5957threat632z.bin
c:\windows\system32\5959zi9us302.dll
c:\windows\system32\595espzw9re1698.ocx
c:\windows\system32\595zworm95a.ocx
c:\windows\system32\59d8szars59275.dll
c:\windows\system32\59dathief515z.dll
c:\windows\system32\59e3spyware7z1.cpl
c:\windows\system32\59f15parze2299.cpl
c:\windows\system32\59z9spa5se2993.ocx
c:\windows\system32\5a39threat25z5.ocx
c:\windows\system32\5afcthief1279z.dll
c:\windows\system32\5b59zir2545.exe
c:\windows\system32\5b5edow5lozder19899.bin
c:\windows\system32\5b64threa95814z.cpl
c:\windows\system32\5ca2threz915251.exe
c:\windows\system32\5d07zir91915.dll
c:\windows\system32\5d479hie51z03.cpl
c:\windows\system32\5dz0sp9rse729.dll
c:\windows\system32\5e49teal2757z.ocx
c:\windows\system32\5ed9vi5z276.cpl
c:\windows\system32\5f0cb9ck5zor2572.ocx
c:\windows\system32\5f59spazse15645.dll
c:\windows\system32\5fe9thz5f836.cpl
c:\windows\system32\5z17spyware1998.ocx
c:\windows\system32\5z759sp9372.exe
c:\windows\system32\5za0vir968.exe
c:\windows\system32\621ddownzoader31509.dll
c:\windows\system32\6268stz5l999.cpl
c:\windows\system32\62dfdownloade592z7.exe
c:\windows\system32\6384s9e5l2200z.dll
c:\windows\system32\63bca95ware1z14.cpl
c:\windows\system32\63dbthie5149z.cpl
c:\windows\system32\64dz9pyware5695.cpl
c:\windows\system32\65935zyware79.dll
c:\windows\system32\65d95ackdoor302z.dll
c:\windows\system32\65vi9z665.bin
c:\windows\system32\6600zpa5se3539.bin
c:\windows\system32\66bba5kdoo9z76.dll
c:\windows\system32\66ez9ief725.cpl
c:\windows\system32\6749threatz554.dll
c:\windows\system32\68f5ba9kdo5r9z9.bin
c:\windows\system32\6915sza5se4089.cpl
c:\windows\system32\6979not-az9irus4c5.dll
c:\windows\system32\69afb5ckdoor92z.bin
c:\windows\system32\6a8fthrea52199z.dll
c:\windows\system32\6aa1downlo9der5005z.ocx
c:\windows\system32\6dzaaddw9re2905.cpl
c:\windows\system32\6dzaspyware29825.bin
c:\windows\system32\6e37do5nloader2980z.dll
c:\windows\system32\6ed5zpywa9e1624.ocx
c:\windows\system32\6f93doznl5ader963.exe
c:\windows\system32\6z84thre9t19155.ocx
c:\windows\system32\6zct5r9at19099.dll
c:\windows\system32\6zd5v5r2980.exe
c:\windows\system32\6zed9ir599.dll
c:\windows\system32\707e9tealz526.dll
c:\windows\system32\7092zirus5b55.cpl
c:\windows\system32\70d8t5rezt26791.cpl
c:\windows\system32\7159th5eat6049z.cpl
c:\windows\system32\72z95pambot3b.ocx
c:\windows\system32\73d8t5reat10900z.dll
c:\windows\system32\75055zoj7f9.cpl
c:\windows\system32\7569backdoor2782z.dll
c:\windows\system32\7590spywa5z2072.bin
c:\windows\system32\75z3spywar9556.bin
c:\windows\system32\76e4adzwar95055.bin
c:\windows\system32\7754za9kdoor1656.bin
c:\windows\system32\77f8thiefz8959.ocx
c:\windows\system32\787faddz5re2749.dll
c:\windows\system32\7963threat15075z.bin
c:\windows\system32\7970hacktozl3f5.cpl
c:\windows\system32\797z9irus4695.bin
c:\windows\system32\79z6spyware1554.bin
c:\windows\system32\7a69vi525z5.exe
c:\windows\system32\7b88sp9waze5861.cpl
c:\windows\system32\7d25th9ea5132z9.cpl
c:\windows\system32\7d55zack9oor1386.cpl
c:\windows\system32\7dabback9ozr7495.ocx
c:\windows\system32\7e689zief955.cpl
c:\windows\system32\7e9f5i9z1.bin
c:\windows\system32\7f9bvir114z5.ocx
c:\windows\system32\7fzaspar9e5619.ocx
c:\windows\system32\8883w9rmzaa5.bin
c:\windows\system32\8887zpam9o597.exe
c:\windows\system32\90055vi5us6c6z.dll
c:\windows\system32\901z5arse576.ocx
c:\windows\system32\90363t5oj17z.ocx
c:\windows\system32\909e5ddware1770z.exe
c:\windows\system32\90cds5eal174z.ocx
c:\windows\system32\915z5wo5m785.dll
c:\windows\system32\9233zackdoo53090.ocx
c:\windows\system32\93599spamzot668.cpl
c:\windows\system32\9375ackdooz1393.dll
c:\windows\system32\93935orm7z7.dll
c:\windows\system32\93z94not-a-virus63e5.dll
c:\windows\system32\94525hacktoolcz.bin
c:\windows\system32\9494viru5578z.cpl
c:\windows\system32\9500zp9363.dll
c:\windows\system32\95201not-a-zi5us2c6.cpl
c:\windows\system32\9523worm1z45.bin
c:\windows\system32\95d15ddwarez48.cpl
c:\windows\system32\96645szy7f5.bin
c:\windows\system32\9742not-a-5i9zs3a9.bin
c:\windows\system32\9777hz9k5ool69a.ocx
c:\windows\system32\9790not-z-vir5s63e.exe
c:\windows\system32\97c0sp5ware1032z.dll
c:\windows\system32\97f75hrezt7145.bin
c:\windows\system32\9887spambo9zd5.cpl
c:\windows\system32\9d5b5oznloader389.bin
c:\windows\system32\9d85spy5are324z.bin
c:\windows\system32\9e75vir2733z.ocx
c:\windows\system32\9eebs5arse139z.dll
c:\windows\system32\9z996wo5m3dd.exe
c:\windows\system32\a9ctzr95t3426.bin
c:\windows\system32\ac8ste9531z6.cpl
c:\windows\system32\b15zddwar92819.ocx
c:\windows\system32\b8a9ir852z.cpl
c:\windows\system32\be9zir225.dll
c:\windows\system32\bf0thi9z5122.cpl
c:\windows\system32\czddownloade91570.ocx
c:\windows\system32\e31dow9loader56z.cpl
c:\windows\system32\e69bzckdoor1051.dll
c:\windows\system32\f995zdware19459.dll
c:\windows\system32\z0697hackt9ol125.bin
c:\windows\system32\z0bbsparse945.cpl
c:\windows\system32\z1840v59usa8.ocx
c:\windows\system32\z2091not-a-vir5s52f.ocx
c:\windows\system32\z3839p56fc.bin
c:\windows\system32\z396troj9d5.ocx
c:\windows\system32\z5019troj965.dll
c:\windows\system32\z554spyware15399.dll
c:\windows\system32\z579thr5at377.ocx
c:\windows\system32\z57sp5wa9e53.exe
c:\windows\system32\z595v9r1558.exe
c:\windows\system32\z67159py642.bin
c:\windows\system32\z6945hackt5ol6f6.bin
c:\windows\system32\z7037hack9oo57dc.dll
c:\windows\system32\z8699hackt5ol2619.bin
c:\windows\system32\z8949virus5ba.dll
c:\windows\system32\z9294wor94925.cpl
c:\windows\system32\z95995y7a8.dll
c:\windows\system32\zb959ownloader1469.exe
c:\windows\system32\zdc6vir25799.dll
c:\windows\system32\zeb4ste5l798.bin
c:\windows\system32\zf51thr9at22512.bin

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
And here is the 3rd part


c:\windows\twain_16.dll
c:\windows\z1424spy5559.ocx
c:\windows\z196steal1509.ocx
c:\windows\z30threa925209.bin
c:\windows\z31bac9door950.dll
c:\windows\z3689ot-a-virus55a.bin
c:\windows\z4cbt9reat1885.bin
c:\windows\z557steal23879.ocx
c:\windows\z5894troj3c09.cpl
c:\windows\z58dbackdoor895.cpl
c:\windows\z64459rm57c.dll
c:\windows\z73539irus440.bin
c:\windows\z74275py7fe9.ocx
c:\windows\z754s9ea51853.bin
c:\windows\z792sp5309.bin
c:\windows\z8829sp519c.bin
c:\windows\z915spy96b.cpl
c:\windows\z95ddownloader25969.ocx
c:\windows\z9f6thr5at2297.ocx
c:\windows\zb02thre5t21269.bin
c:\windows\zc4backdo9r24455.dll
c:\windows\zda95ir1975.bin
c:\windows\zf5avir9603.exe
D:\Desktop.ini

.
((((((((((((((((((((((((( Files Created from 2009-05-11 to 2009-06-11 )))))))))))))))))))))))))))))))
.

2009-06-11 01:25 . 2009-06-11 01:35 -------- d-s---w- \Combo-Fix
2009-06-11 01:21 . 2009-06-11 01:33 -------- d---a-w- \Qoobox
2009-06-11 00:09 . 2009-06-07 15:43 89104 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\NAVENG.SYS
2009-06-11 00:09 . 2009-06-07 15:43 876144 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\NAVEX15.SYS
2009-06-11 00:09 . 2009-06-07 15:43 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\NAVENG32.DLL
2009-06-11 00:09 . 2009-06-07 15:43 1181040 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\NAVEX32A.DLL
2009-06-11 00:09 . 2009-06-07 15:43 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\EECTRL.SYS
2009-06-11 00:09 . 2009-06-07 15:43 101936 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\ERASER.SYS
2009-06-11 00:09 . 2009-06-07 15:43 259368 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\ECMSVR32.DLL
2009-06-11 00:09 . 2009-06-07 15:43 2414128 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090610.025\CCERASER.DLL
2009-06-10 18:25 . 2009-06-10 18:24 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-09 23:06 . 2009-06-09 23:06 -------- d-----w- c:\program files\iPod
2009-06-09 23:06 . 2009-06-09 23:07 -------- d-----w- c:\program files\iTunes
2009-06-09 23:02 . 2009-06-09 23:03 -------- d-----w- c:\program files\QuickTime
2009-06-09 22:51 . 2009-06-09 22:51 75048 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-09 14:11 . 2008-12-06 04:42 376832 ----a-w- c:\windows\system32\winhttp.dll
2009-06-09 14:09 . 2008-11-27 04:43 268288 ----a-w- c:\windows\system32\schannel.dll
2009-06-09 05:45 . 2009-06-09 05:45 -------- d-----w- c:\users\Allen P Butler\AppData\Roaming\Malwarebytes
2009-06-09 05:45 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-09 05:45 . 2009-06-09 05:45 -------- d-----w- c:\programdata\Malwarebytes
2009-06-09 05:45 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-09 05:45 . 2009-06-09 05:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-08 19:48 . 2009-06-08 19:48 758088 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-06-08 18:24 . 2009-06-07 15:43 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSviA64.sys
2009-06-08 18:24 . 2009-06-07 15:43 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSvix86.sys
2009-06-08 18:24 . 2009-06-07 15:43 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSXpx86.sys
2009-06-08 18:24 . 2009-06-07 15:43 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\IDSxpx86.dll
2009-06-08 18:24 . 2009-03-16 20:03 533880 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090604.001\Scxpx86.dll
2009-06-08 14:15 . 2009-06-08 14:15 39428 ----a-w- c:\programdata\Lavasoft\Ad-Aware\ThreatWork\Submit\WNASPINT.DLL
2009-06-07 15:46 . 2009-06-07 15:46 -------- d-----w- c:\programdata\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-06-07 15:45 . 2009-06-07 15:45 -------- d-----w- c:\users\Allen P Butler\AppData\Local\Downloaded Installations
2009-06-07 15:45 . 2009-06-07 15:43 25136 ----a-r- c:\windows\system32\drivers\SymIMV.sys
2009-06-07 15:45 . 2009-06-07 15:45 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-06-07 15:45 . 2009-06-07 15:45 -------- d-----w- c:\program files\Symantec
2009-06-07 15:43 . 2009-06-07 15:43 396848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvia64.sys
2009-06-07 15:43 . 2009-06-07 15:43 292912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-06-07 15:43 . 2009-06-07 15:43 276344 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\IDSxpx86.sys
2009-06-07 15:43 . 2009-06-07 15:43 1290592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2009-06-07 15:43 . 2009-06-07 15:43 136840 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2009-06-07 15:43 . 2009-06-07 15:43 447864 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\BinHub\idsxpx86.dll
2009-06-07 15:43 . 2009-06-07 15:43 796016 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2009-06-07 15:42 . 2009-06-07 15:42 -------- d-----w- c:\windows\system32\drivers\N360
2009-06-07 15:42 . 2009-06-07 15:42 -------- d-----w- c:\program files\Norton 360
2009-06-07 15:29 . 2009-06-07 15:29 -------- d-----w- c:\programdata\PCSettings
2009-06-07 15:28 . 2009-06-07 15:28 -------- d-----w- c:\programdata\Norton
2009-06-07 15:11 . 2009-06-07 15:42 -------- d-----w- c:\programdata\NortonInstaller
2009-06-07 15:11 . 2009-06-07 15:27 -------- d-----w- c:\program files\NortonInstaller
2009-06-05 15:42 . 2009-06-05 15:42 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-05 15:42 . 2009-06-05 15:42 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-31 07:51 . 2009-06-10 07:17 1063378944 --sha-w- \hiberfil.sys
2009-05-31 07:34 . 2009-05-31 07:34 -------- d-----w- c:\windows\system32\.exe
2009-05-24 19:42 . 2009-05-24 19:42 -------- d-----w- c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-11 01:10 . 2007-04-24 19:44 -------- d-----w- c:\program files\Java
2009-06-11 01:08 . 2007-09-02 12:29 -------- d-----w- c:\program files\LimeWire
2009-06-11 00:57 . 2007-09-02 12:29 -------- d-----w- c:\users\Allen P Butler\AppData\Roaming\LimeWire
2009-06-10 07:17 . 2009-05-31 07:51 1063378944 --sha-w- \hiberfil.sys
2009-06-10 07:17 . 2007-06-05 00:54 1592786944 --sha-w- \pagefile.sys
2009-06-10 07:15 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-10 00:49 . 2007-11-25 04:25 -------- d-----w- c:\programdata\Google Updater
2009-06-10 00:35 . 2007-10-19 21:29 -------- d-----w- c:\programdata\Apple
2009-06-09 23:06 . 2007-10-19 21:29 -------- d-----w- c:\program files\Common Files\Apple
2009-06-09 22:50 . 2008-03-23 15:40 -------- d-----w- c:\program files\Safari
2009-06-08 23:36 . 2007-11-25 04:24 -------- d-----w- c:\program files\Google
2009-06-08 16:19 . 2007-09-02 03:34 94456 ----a-w- c:\users\Allen P Butler\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-07 16:09 . 2007-04-24 18:40 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-07 15:45 . 2009-06-07 15:45 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-06-07 15:45 . 2009-06-07 15:45 7386 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-06-07 15:42 . 2008-10-09 02:34 -------- d-----w- c:\programdata\Symantec
2009-06-07 15:34 . 2008-04-07 22:24 -------- d-----w- c:\users\Allen P Butler\AppData\Roaming\Symantec
2009-06-04 19:25 . 2009-03-05 23:59 -------- d-----w- c:\programdata\Rosetta Stone
2009-05-31 11:49 . 2009-04-20 03:52 -------- d-----w- c:\program files\LibUSB-Win32
2009-05-31 07:33 . 2008-04-18 00:45 1356 ----a-w- c:\users\Allen P Butler\AppData\Local\d3d9caps.dat
2009-05-09 02:23 . 2009-03-10 22:33 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-05-09 02:23 . 2008-08-07 01:12 -------- d-----w- c:\program files\Apple Software Update
2009-05-09 01:28 . 2009-05-09 01:28 15670 ----a-w- c:\windows\9057s9am5otz.exe
2009-05-07 05:44 . 2009-05-07 05:44 -------- d-----w- c:\program files\Microsoft
2009-05-07 05:42 . 2009-05-07 05:42 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-04-29 17:18 . 2009-04-29 17:18 -------- d-----w- c:\program files\Realtek
2009-04-29 17:18 . 2007-04-24 18:29 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-20 03:39 . 2009-04-20 03:39 -------- d-----w- c:\program files\QuickFreedom
2009-04-15 19:42 . 2009-04-15 19:42 -------- d-----w- c:\programdata\WindowsSearch
2009-04-15 18:21 . 2009-04-15 18:14 -------- d-----w- c:\programdata\Lavasoft
2009-04-15 18:15 . 2009-04-15 18:15 -------- dc-h--w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-15 18:14 . 2009-04-15 18:14 -------- d-----w- c:\program files\Lavasoft
2009-03-31 19:35 . 2009-04-22 16:29 17160 ----a-w-

descriptionWiniBlue Soft removal EmptyRe: WiniBlue Soft removal

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum