WinBlue Soft Help Please

OK, once it gave me the blue screen, I can't run the browser nor MGTools. But I'll give you what MG Tools put in my C: before my comp rebooted.

http://www.mediafire.com/?sharekey=16ffb2755056f3b9d9d5c56d04dfa8b0e04e75f6e8ebb871

the log file .zip
http://www.mediafire.com/?tyyego3lwqh

the tools .zip
http://www.mediafire.com/?tnzqnhwmytl

Hello can you download files from Safe mode and Networking or do you have to install them via a USB stick?

Hey Origin, I'll PM you shortly, new theories I've found on beating this somewhat.

Were getting somewhere. Since INF worked once before, were gonna use it again.

• Now open a new notepad file.
  
• Input this into the notepad file:
  

  
  [Version]
  Signature=$CHICAGO$
  
  [DefaultInstall]
  AddReg=Del.Settings
  
  [Del.Settings]
  HKCU,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,setup2.exe,0x00000000
  HKCU,SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup2.exe
  HKLM,software\microsoft\windows\currentVersion\Run,WinBlueSoft,0x00000000
  HKU,DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run,setup2.exe,0x00000000
  HKLM.software\microsoft\windows nt\currentversion\windows,AppInit_DLLs,0x00000000
  
  

  
  
• Save this as fixreg.inf, save it to your desktop.
  
• Right click fixreg.inf and select install.
  

Can you delete that setup2.exe file now?

Hi,
I could dl MG Tools on Regular Mode and could use an internet browser and it worked for about 5 until it gave me the blue screen.
I tried again on Safe Mode Networking but it still won't let me run any .exe or anything of the sort. Up until that point, I had been trying to use a USB and if it failed I trid to directly install the programs on the USB itself but nothing works.

Belahzur wrote:

Hey Origin, I'll PM you shortly, new theories I've found on beating this somewhat.

Were getting somewhere. Since INF worked once before, were gonna use it again.

• Now open a new notepad file.
  
• Input this into the notepad file:
  

  
  [Version]
  Signature=$CHICAGO$
  
  [DefaultInstall]
  AddReg=Del.Settings
  
  [Del.Settings]
  HKCU,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,setup2.exe,0x00000000
  HKCU,SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup2.exe
  HKLM,software\microsoft\windows\currentVersion\Run,WinBlueSoft,0x00000000
  HKU,DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run,setup2.exe,0x00000000
  HKLM.software\microsoft\windows nt\currentversion\windows,AppInit_DLLs,0x00000000
  
  

  
  
• Save this as fixreg.inf, save it to your desktop.
  
• Right click fixreg.inf and select install.
  

Can you delete that setup2.exe file now?

I deleted setup2.exe already. Should I still keep the .inf file?

Sorry, don't know how that got in there, didn't see that bit.
I need you to run my new inf script there, it will delete some run values and tools might work then.

Alright, I saved it onto the desktop and hit install. My icons blinked a bit but no installation wizard or anything of the sort.

Yeah, the blinking normally happens.
The registry values should be killed off now, see if you can run anything you haven't been able to.

No dice. I tried all the programs you posted and Avenger but no response. I did manage to delete all the .dll files I listed before except for blocker.dll

I made another mistake on the inf file, time for another inf file.

• Now open a new notepad file.
  
• Input this into the notepad file:
  

  
  [Version]
  Signature=$CHICAGO$
  
  [DefaultInstall]
  AddReg=Del.Settings
  
  [Del.Settings]
  HKLM,software\microsoft\windows nt\currentversion\windows,AppInit_DLLs,0x00000000
  
  

  
  
• Save this as fixreg.inf, save it to your desktop.
  
• Right click fixreg.inf and select install.
  

Try and delete blocker.dll now.

It won't delete blocker.dll but the .inf is letting me running my browser. I also dl'd CounterSpy and installing it right now. Counterspy won't scan because I don't have any risk definitions.

Update: OK I deleted blocker.dll. I'm running MGTools again, do you want me to upload the .zips to mediafire?

Blocker.dll is gone. I can run taskmgr and regedit. It still won't let me run Hijack This but the computer doesn't auto reboot for me anymore.

I can install Hijack This and Malwarebytes but after installation it won't let me run it.
Also, I checked the Registry Keys and found 2 setup2's. Both are in the Windows folder, should I delete?

The registry value? yes, delete it.

Alright, I deleted all the setup2 values but only CounterSpy works but won't let me update definitions for threats so I can't use it.

Hello.
I didn't see your last post, please upload the new MGlogs for me.

Run a scan without updating it, see what happens.