How to remove WinBlueSoft
Friday, June 5th, 2009 at 4:13 amHome » Rogue Antispyware » WinBlueSoft
WinBlueSoft description
WinBlueSoft is typical fraud; it offers paid security tool which is totally non-functional. WinBlue Soft is almost identical copy of another malware named WiniBlueSoft (click here to remove WiniBlueSoft).
The goal of the deal is get your money in exchange of Win Blue Soft license. Since Win BlueSoft is a malware, it’s definitely not a piece of software you want to pay for. This parasite uses various security alerts to trick people into taking WinBlueSoft seriously. Here’s one of several messages displayed by the fraud:
Warning!
Your’re in danger!
Your computer is infected with Spyware!
All you do with computers is stored forever in your hard disk. When you visit sites, send emails… All your actions are logged. And it is impossible to remove them with standard tools. Your data is still available for forensics…
All the alerts generated by WinBlue Soft are fakes. Win Blue Soft is also able to interrupt internet connection and network connection.
Get rid of WinBlueSoft
WinBlueSoft is a Rogue Antispyware software
How to manually remove WinBlueSoft
To remove WinBlueSoft spyware you must block WinBlueSoft sites, stop and remove processes, unregister DLL files, search and delete all other WinBlueSoft files and registry utility. Follow the WinBlueSoft detection and removal instructions below.
The most typical software removal method is to remove WinBlueSoft by using "Add or Remove Programs" service. However there may be hidden WinBlueSoft files, running processes and registries in your computer, so WinBlueSoft may recreate all other files after reboot.
WinBlueSoft manual removal instructions
Block WinBlueSoft sites:
winbluesoft.com
winbluesoft.net
Read more how to block WinBlueSoft sites
Stop and remove WinBlueSoft processes:
WinBlueSoft.exe
Read more how to kill WinBlueSoft processes
Locate and delete WinBlueSoft registry entries:
HKEY_CURRENT_USER\Software\WinBlueSoft
HKEY_LOCAL_MACHINE\SOFTWARE\WinBlueSoft
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinBlueSoft
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "WinBlueSoft"
Read more how to delete WinBlueSoft registry entries
Download RegistryBooster 2010 to scan errors caused by WinBlueSoft
Search and unregister WinBlueSoft DLL libraries:
blocker.dll
111znot-a-v5rus998.dll
19945hzcktool65b.dll
12bbszy5ar91941.dll
12946sz5mbot79c.dll
129cvir1z58.dll
11797tzoj595.dll
Read more how to unregister WinBlueSoft DLL files
Detect and delete other WinBlueSoft files:
%Documents and Settings%\All Users\Start Menu\Programs\WiniBlueSoft
%Program Files%\WiniBlueSoft Software\WiniBlueSoft\data.bin
%Program Files%\WiniBlueSoft Software\WiniBlueSoft\uninstall.exe
%Program Files%\WiniBlueSoft Software
%WINDOWS%\10355h9eat227z2.cpl
%WINDOWS%\10325virusz955.ocx
%WINDOWS%\111znot-a-v5rus998.dll
%WINDOWS%\127b95ief305z.ocx
%WINDOWS%\135zvir1929.cpl
%WINDOWS%\system32\1b20z9a5se2186.bin
%WINDOWS%\system32\19z43hacktoo965f.exe
%WINDOWS%\system32\19544spy6fbz.ocx
WiniBlueSoft.lnk
%Documents and Settings%\All Users\Start Menu\Programs\WiniBlueSoft\WiniBlueSoft.lnk
%Program Files%\WiniBlueSoft Software\WiniBlueSoft\License.txt
%Program Files%\WiniBlueSoft Software\WiniBlueSoft\always_skip.xml
%Program Files%\WiniBlueSoft Software\WiniBlueSoft
%WINDOWS%\1197addwaze16915.ocx
%WINDOWS%\13951spzmb9t5a2.exe
%WINDOWS%\12bbszy5ar91941.dll
%WINDOWS%\11797tzoj595.dll
%WINDOWS%\13323w95mz1b.ocx
%WINDOWS%\14041hackt5zl99.exe
%WINDOWS%\system32\19199hackt5zl7a1.bin
%WINDOWS%\system32\19945hzcktool65b.dll
%Documents and Settings%\All Users\Start Menu\Programs\WiniBlueSoft\Homepage.lnk
%Program Files%\WiniBlueSoft Software\WiniBlueSoft\main_config.xml
%Documents and Settings%\All Users\Desktop\WiniBlueSoft.lnk
%Program Files%\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe
%Documents and Settings%\All Users\Start Menu\Programs\WiniBlueSoft\Uninstall.lnk
%WINDOWS%\102959roz2b45.ocx
%WINDOWS%\129cvir1z58.dll
%WINDOWS%\115z1vi9us3e85.ocx
%WINDOWS%\12946sz5mbot79c.dll
%WINDOWS%\1393z5or9df.ocx
%WINDOWS%\system32\1a59dow9lozder1735.ocx
%WINDOWS%\system32\19524spyze9.exe
%WINDOWS%\system32\19991not-a-v5rzs1c9.exe
WiniBlueSoft.exe
We strongly recommend you to use spyware remover to track WinBlueSoft and automaticaly remove WinBlueSoft processes, registries and files as well as other spyware threats.
June 8th, 2009 at 9:38 pm
Hey guys. I just got infected by WinBlueSoft, but I thought I might let everyone know how I got it, cause I figure it’s pretty meaningful feedback. I actually got the trojan from redtube. It said I couldn’t veiw the site because a virus on my computer would hack the site and cause it to “crush”. It gave me the winblue address, stating that other people had solved their problems using this program. It also used the antivirus system pro alert, except of course with winblue. There are two, and they pop up simultaneously on the bottom of the screen. Yes, redtube is a porn site. We all do less then reputable stuff. Just thought it’d be a good thing to note.
Reply
Kelly Reply:
June 8th, 2009 at 9:48 pm
Here’s what the website says!
“Your computer (IP: 71.201.241.26) generates an attacking DOS requests at our servers. This attack was provoked by the spyware/virus named ‘Troj/Rustok-N’
We cannot provide you with an access to our content for browsing purposes as it will lead to the inevitable crush of our website.
We strongly recommend you to run your antivirus edition and, if necessary, check it for the latest updates available.
You may also download recommended software, which has been approved by a number of our surfers who encountered the same problem and used this software to overcome it.
Make sure your computer is protected before continue browsing. Without this antivirus software your computer becomes a pushover for hackers.
Leaving computer unprotected may lead to:
– Computer performance slowdown and operating system crash
– Serious drop of traffic caused by hidden advertising
– Leak of personal and credit card information
– The inappropriate use of your personal photos by web sites
– Using you machine as a source for spam spreading
– Infection spreading to other removable devices such as memory cards, writable CD and DVD disks
– Getting your cell phone infected through USB. The first sign of infection in your cell phone device will appear as sms-messages sent to paid numbers
– etc
Make sure you use effective antivirus software. We recommend you to check your computer right now and the software that have already helped thousands of our visitors.
We apologize for the inconvenience, and hope we’ll see you again on
Find more comments on the software at: aumhaphpbb.com”
Reply
Luciana Reply:
June 8th, 2009 at 10:30 pm
Thank you for sharing your experience.
Reply
Corey Reply:
June 18th, 2009 at 8:05 pm
The same exact site did that to me too! Even Xvideos did that to me. I trusted it but now its soooo annoying i can’t stand it. I think its making my computer freeze alot I’m not sure but yeah damn it!
June 11th, 2009 at 6:47 am
Hello,
I have the same problem with win blue software at the same redtube site. I have done a unistall of Win Blue and also loaded the PCTools SPyware Doctor with Anti virus with full paid license. I ran a full scan 2 times and once in safe mode also. I am still getting the annoying pop ups etc. I am now going to try and manually remove this malious beast. Yes I have slapped my hand for falling in to this trap from Red tube. Why can’t someone invent how to electronically zap the persons keyboard that creates this malware..
Frustrated Ernie
Reply
Corey Reply:
June 18th, 2009 at 8:07 pm
AMEN! Jeeze I those pop-ups!
Reply
andrew Reply:
June 27th, 2009 at 1:08 pm
i went and got myself a lawyer. Someone is getting sued.
Reply
June 29th, 2009 at 9:39 am
hello,
even i am one among you guys,
suggest me an easy way to remove this f**king adware manually.
i installed spyware doctor but no use.
those two pop ups at the bottom,really annoying.
please help me out…
pleaseeeeeeeeeeeeee…………..
Reply
Luciana Reply:
June 29th, 2009 at 10:07 pm
Hello,
Have you tried the manual removal guide one this page above the comments section?
Reply
ravi Reply:
June 30th, 2009 at 4:55 am
ya i hav.
but no use.
only the first three steps worked.
stil no improvement seen.
Reply
Luciana Reply:
June 30th, 2009 at 5:14 am
Since there is a problem with removing WinBlueSoft manually, i recommend running antispyware. make sure you choose a reputable one and update it before running a scan.
June 29th, 2009 at 4:48 pm
hey i already removed winbluesoft with add/remove wat do i do if i removed it before doing the instructions above
Reply
Luciana Reply:
June 29th, 2009 at 10:10 pm
If you’re still experiencing some problems with WinBlueSoft, some of the malicious files might still be left on your computer. I recommend going through the manual removal guide just in cases. Remove all the malicious files you can find.
Reply
July 1st, 2009 at 5:53 pm
Go into safe mode and goto search. Type in wsmanager.exe and when you find it delete it.
Reply
July 14th, 2009 at 8:11 am
I’ve managed to download the relevant spyware doctors etc but I can’t open them and nor will it allow me to delete winluesoft from add/remove programmes. It won’t let me access my system files either. What can I do?
Reply
Luciana Reply:
July 14th, 2009 at 10:26 pm
Run the anti-spyware in a safe mode. I also recommend using the manual removal guide of WinBlueSoft.
Reply
September 2nd, 2009 at 5:37 pm
Tried allof the suggestions here for removing WinBlueSoft, and still not succesful.
No entry in Add/Remove Programs
No entries in Registry containing winBlueSoft
No Winbluesoft files found or folders searching with Windows Explorer with hidden files and system files turned on
Nothing found with Malwarebytes even after all updates.
no wsmanager.exe file
Yet the Damn thing still shows up after startup, (but not in Safe Mode)
Reply
Luciana Reply:
September 2nd, 2009 at 10:30 pm
Have you tried running different anti-spyware? Since they are made by different companies, they detect different things. Other tools may be able to find what Malwarebytes misses.
Reply
Mike Mays Reply:
September 3rd, 2009 at 5:01 am
ok folks, I knew there was more to it… There are additional files not containing the text “Winbluesoft” which were still hanging around even after Malwarebytes was done.
I have never known Malwarebytes to fail at killing anything I have encountered, but this one is particularly nasty!!
In addition to the files above, the following files should also be removed if found:
c:\WINDOWS\102959roz2b45.ocx
c:\WINDOWS\10325virusz955.ocx
c:\WINDOWS\10355h9eat227z2.cpl
c:\WINDOWS\111znot-a-v5rus998.dll
c:\WINDOWS\115z1vi9us3e85.ocx
c:\WINDOWS\11797tzoj595.dll
c:\WINDOWS\1197addwaze16915.ocx
c:\WINDOWS\127b95ief305z.ocx
c:\WINDOWS\12946sz5mbot79c.dll
c:\WINDOWS\129cvir1z58.dll
c:\WINDOWS\12bbszy5ar91941.dll
c:\WINDOWS\13323w95mz1b.ocx
c:\WINDOWS\135zvir1929.cpl
c:\WINDOWS\1393z5or9df.ocx
c:\WINDOWS\13951spzmb9t5a2.exe
c:\WINDOWS\14041hackt5zl99.exe
c:\WINDOWS\system32\19199hackt5zl7a1.bin
c:\WINDOWS\system32\19524spyze9.exe
c:\WINDOWS\system32\19544spy6fbz.ocx
c:\WINDOWS\system32\19945hzcktool65b.dll
c:\WINDOWS\system32\19991not-a-v5rzs1c9.exe
c:\WINDOWS\system32\19z43hacktoo965f.exe
c:\WINDOWS\system32\1a59dow9lozder1735.ocx
c:\WINDOWS\system32\1b20z9a5se2186.bin
Reply
bryan Reply:
September 3rd, 2009 at 11:34 pm
these are random files created by Winbluesoft and I must say these filenames could be different on every computer
September 3rd, 2009 at 12:20 pm
Hey I knew as soon as I found out I needed to buy a Anti-spyware and that I had no money cause i’m only 16 so I just restarted my entire computer as if i just bought it. I put my important files on a External Hard drive and that made it so I had no Virus’ spywares or any of that crap. Now I got a nice fast computer and got all my Hard drive space back.
Reply