Title: WiniBlueSoft

Type: Rogue Antispyware

Remove WiniBlueSoft. Removal instructions

Also known as: WiniBlue Soft, Wini Blue Soft

Severity scale:

(68 / 100)

WiniBlueSoft is a rogue anti-spyware application. It is advertised through the online advertisements, especially fake online scanners. Once installed, WiniBlueSoft intentionally creates many fake malware files on user's computer, usually in C:\Windows and C:\Windows\System32 folders. Those files are actually innocuous and were made only to scare the user. The main goal of WiniBlueSoft is to make the user believe that his computer is badly infected and to offer paid removal service.

However, the paid version of WiniBlueSoft won't help you either. When the rogue is installed, it is also configured to run automatically on user's computer when the operating system boots. Then WiniBlueSoft performs fake system scan and displays those earlier created files as infections. WiniBlueSoft will also flood the system with annoying alerts and security notifications. Several examples:

"Windows Security Alerts
Your computer is infected with spyware. It could damage your critical files or expose your private data on the Internet. Click here to register your copy of WiniBlueSoft and remove spyware threats from your PC."

"Infiltration Alert!
Your computer is being attacked by an Internet Virus. It could be a password-stealing attack, a trojan-dropper or similar."

As you might have already understood, WiniBlueSoft is quite dangerous fake spyware remover. It should be removed from the system as soon as possible. Please use WiniBlueSoft removal guide stated below and remove this rogue immediately.

Related files: always_skip.xml, data.bin, license.txt, main_config.xml, Uninstall.exe, WiniBlueSoft.exe, WiniBlueSoft.lnk, Homepage.lnk, uninstall.lnk, 102959roz2b45.ocx, 10325virusz955.ocx, 10355h9eat227z2.cpl, 111znot-a-v5rus998.dll, 115z1vi9us3e85.ocx, 11797tzoj595.dll, 1197addwaze16915.ocx, 127b95ief305z.ocx, 12946sz5mbot79c.dll, 129cvir1z58.dll, 12bbszy5ar91941.dll, 13323w95mz1b.ocx, 135zvir1929.cpl, 1393z5or9df.ocx, 13951spzmb9t5a2.exe, 14041hackt5zl99.exe, 19199hackt5zl7a1.bin, 19524spyze9.exe, 19544spy6fbz.ocx, 19945hzcktool65b.dll, 19991not-a-v5rzs1c9.exe, 19z43hacktoo965f.exe, 1a59dow9lozder1735.ocx, 1b20z9a5se2186.bin, HDExtrem.exe, S-5-4-33-100030900-100005361-100010101-6637.com, My Music.url, My Pictures.url, My Video.url, My Documents.url

WiniBlueSoft properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Stays resident in background

WiniBlueSoft snapshot:

Automatic WiniBlueSoft removal:

remover for WiniBlueSoft

SpyHunter is recommended remover to uninstall WiniBlueSoft. You should confirm using free trial that it detects current version of parasite.

Note: Tested and Confirmed means that we have tested spyware remover with multiple versions of WiniBlueSoft and got the best results. There might be updated or modified version of particular parasite that require manual killing of parasite process or an update. In such case try other removers in the line.

Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove WiniBlueSoft using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

Tested and Confirmed! STOPzilla removes WiniBlueSoft (2009-04-20 04:52:25)

Malwarebytes Anti Malware

download | review

Tested and Confirmed! Malwarebytes Anti Malware removes WiniBlueSoft (2009-04-20 04:52:25)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing WiniBlueSoft (2009-06-24 11:43:51)

XoftSpySE Anti Spyware

download | review

WiniBlueSoft manual removal:

FORUM:
Discuss WiniBlueSoft in
spyware removal forum

Kill processes:
WiniBlueSoft.exe 13951spzmb9t5a2.exe 14041hackt5zl99.exe uninstall.exe 19524spyze9.exe 19991not-a-v5rzs1c9.exe 19z43hacktoo965f.exe A0070788.exe ijjistarter2.exe HDExtrem.exe

HELP:
how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USER\Software\WiniBlueSoft
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiniBlueSoft
HKEY_LOCAL_MACHINE\SOFTWARE\WiniBlueSoft
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "setup2.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "WiniBlueSoft"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{bd19cc12-f8a2-475c-846b-0af337b47940}\NameServer

HELP:
how to remove registry entries

Unregister DLLs:
111znot-a-v5rus998.dll 11797tzoj595.dll 12946sz5mbot79c.dll 129cvir1z58.dll 12bbszy5ar91941.dll 19945hzcktool65b.dll

HELP:
how to unregister malicious DLLs

Delete files:
always_skip.xml data.bin License.txt main_config.xml uninstall.exe WiniBlueSoft.exe WiniBlueSoft.lnk Homepage.lnk Uninstall.lnk WiniBlueSoft.lnk 102959roz2b45.ocx 10325virusz955.ocx 10355h9eat227z2.cpl 111znot-a-v5rus998.dll 115z1vi9us3e85.ocx 11797tzoj595.dll 1197addwaze16915.ocx 127b95ief305z.ocx 12946sz5mbot79c.dll 129cvir1z58.dll 12bbszy5ar91941.dll 13323w95mz1b.ocx 135zvir1929.cpl 1393z5or9df.ocx 13951spzmb9t5a2.exe 14041hackt5zl99.exe 19199hackt5zl7a1.bin 19524spyze9.exe 19544spy6fbz.ocx 19945hzcktool65b.dll 19991not-a-v5rzs1c9.exe 19z43hacktoo965f.exe HDExtrem.exe 1a59dow9lozder1735.ocx 1b20z9a5se2186.bin S-5-4-33-100030900-100005361-100010101-6637.com My Music.url My Pictures.url My Video.url My Documents.url

HELP:
how to remove harmful files

Delete directories:
c:\Program Files\WiniBlueSoft Software
c:\Program Files\WiniBlueSoft Software\WiniBlueSoft
c:\Documents and Settings\All Users\Start Menu\Programs\WiniBlueSoft
C:\WINDOWS\system32\gaopdxcounter

Information added: 2009-04-20 04:52:25
Information updated: 2009-06-24 09:06:36

Additional resources related to WiniBlueSoft:

Attention: If you know or you have a website or page about WiniBlueSoft removal, feel free to add a link to this list: add url

more resources

dirk_flail

also look for c:windowssetup2.exe

it is also related to this winibluesoft crap.

Reply »

2009 06 24

Post Comment:

Attention: Use this form only if you have additional information about WiniBlueSoft parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Latest spyware news:

Subscribe to news

Similar parasites:

Compare spyware removers
Compare free products

HijackThis Log Analyzer Beta 2

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.