Winiblusoft infection! Help!

You can upload to a file hosting website, eg, rapidshare, mediafire.com, etc

ok here is the link to media fire for my root repeal u requested, btw i am srry for responding so slow but they blocked this page but not anymore, wierd, :

http://www.mediafire.com/?nzkjqxzyf20

• Download combofix from here
  Link 1
  Link 2
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.
See HERE for how to disable your AV..

• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ok here u go the report from combo-fix here is the link to the file! woot ty btw u been soo helpful! ^.^

http://www.mediafire.com/?mkzoun2hbjk

Hello, next time can you please split the message into two or more posts if required for my convenience


Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\5da1spaz9e.bin
DreamlordsPatch_1.5.3.10478_to_1.5.4.10509.exe
c:\windows\9s5z791.exe
c:\users\Angel\AppData\Roaming\Dreamlords\DreamlordsPatch_1.5.2.10433_to_1.5.3.10478.exe
c:\users\Angel\AppData\Roaming\Dreamlords\DreamlordsPatch_1.5.1.10390_to_1.5.2.10433.exe
c:\users\Angel\AppData\Roaming\Dreamlords\DreamlordsPatch_1.5.0.10372_to_1.5.1.10390.exe
c:\users\Angel\AppData\Roaming\Dreamlords\DreamlordsPatch_1.4.8.10266_to_1.5.0.10372.exe
c:\users\Angel\AppData\Roaming\Dreamlords\DreamlordsPatch_1.4.6.10185_to_1.4.8.10266.exe

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

ok here i part one and two of report:

http://www.mediafire.com/?tcqxmlemgh0
http://www.mediafire.com/?tiawm5mmdzv

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

haha srry but they page is redirected to page load error when i clicked on the link. btw when i scan with AVG it finds a trojan called trojan horse generic 8.AMFS something like that!

Hello can you download Malwarbytes from any of the following places:

http://majorgeeks.com/download5756.html

o wow, yeah srry yeah i clicked on the new link and i got to the page, then clicked one of the download links and it took me to the page so it can download the page was fine then all of a sudden it said page load error, sry, u been really helpfull do u think its the trojan horse generic 8 thats doing it, kus when avg finds it i try to get rid of it and my comp crashes. btw winiblue is gone no problems with that just alot of page load error on antivirus pages!

Hello.
I suspect something is interfering.

• Open HijackThis.
  
• When Hijack This opens, click "Open the Misc Tools section"
  
• Then select "Open Uninstall Manager"
  
• Click on "Save List..." (generates uninstall_list.txt)
  
• Click Save, copy and paste the results in your next post.
  

Hello, here u go the hijack list:

2MOONS
3D Astro Clock
ABBYY FineReader 6.0 Sprint
AC3Filter (remove only)
Activation Assistant for the 2007 Microsoft Office suites
Ad-Aware
Ad-Aware
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.2
Applian FLV Player
Atlantica Online
AVG 8.5
Avira AntiVir Personal - Free Antivirus
Bluetooth Stack for Windows by Toshiba
Byki
Byki Express
Camera Assistant Software for Toshiba
CCleaner (remove only)
CD/DVD Drive Acoustic Silencer
Compatibility Pack for the 2007 Office system
Conexant HD Audio
CyberLink PowerCinema for TOSHIBA
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Web Player
DVD MovieFactory for TOSHIBA
Functional Ear Trainer - Advanced 1.0
Functional Ear Trainer - Basic 1.2
GearDrvs
GearDrvs
Google Desktop
Google Earth
Google Toolbar for Internet Explorer
Google Updater
HDAUDIO Soft Data Fax Modem with SmartCP
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
Intel Matrix Storage Manager
Java(TM) 6 Update 3
Lexmark 7500 Series
LiveUpdate 3.2 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Marvell Miniport Driver
mCorev32.ism_new
mCPlug
mHelp
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
mMHouse
Mozilla Firefox (3.0.10)
mPfMgr
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MySpaceIM
NetWaiting
Norton 360
O2Micro Flash Memory Card Reader Driver (x86)
OpenAL
Opera 9.63
Pando Media Booster
Security Update for Windows Media Encoder (KB954156)
Shoddy Battle (a FREE GNU licensed Online Pokemon Battle Simula
Skype 3.8
Spybot - Search & Destroy
Synaptics Pointing Device Driver
The One Ring 3D Screensaver 1.0
TOSHIBA Assist
TOSHIBA ConfigFree
TOSHIBA Disc Creator
TOSHIBA DVD PLAYER
TOSHIBA Extended Tiles for Windows Mobility Center
TOSHIBA Face Recognition
TOSHIBA Face Recognition
TOSHIBA Games
TOSHIBA Hardware Setup
Toshiba Registration
TOSHIBA SD Memory Utilities
TOSHIBA Software Upgrades
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 Help (KB957246)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (kb968503)
VC80CRTRedist - 8.0.50727.762
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Windows Live Sign-in Assistant
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Player Firefox Plugin
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar
Zune
Zune
Zune Language Pack (ES)
Zune Language Pack (FR)

Hello.

You are running two antivirus', I see from the uninstall list you have Norton 360/Symantec installed, along with AVG. This is a bad idea as they can conflict and cause more problems. I would recommend that you remove Norton 360 to avoid conflict and other future problems.

Completely Uninstall Norton software using:

• SymNRT.exe
  

Instructions

1. Please download and save SymNRT.exe to your desktop.
   
2. Close all programs and double click on the tool.
   
3. Follow the on-screen instructions.
   
4. Restart the computer if asked.
   
5. Then delete the SymNRT.exe tool from your desktop.
   
6. Open the Program Files folder on your local disk ( normally C: )
   
7. Find and delete the following folders (if present):
   [list]
   
8. Norton AntiVirus
   
9. Norton Internet Security
   
10. Norton SystemWorks
    
11. Norton Personal Firewall
    

Next, go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

• Java(TM) 6 Update 3
  
• LiveUpdate 3.2 (Symantec Corporation)
  
• LiveUpdate Notice (Symantec Corporation)
  
• Norton 360
  

ok its all done! woot, ok whas next!

See if you can download MBAM now, if not, re-run Combofix so we have an up to date log.