Forums › Microsoft Windows › blue.exe?? Recyc.exe???
problem is its on my back up hard drive and I don't want to format that... I formated my main drive but it copied itself back from the back up drive... it also seems to stop iTunes from working, I can't even start the program even after reinstalling the program and formating the computer..
any one out there know what to do...?
There is no "automated" anti-spyware removal tool for this type infection.
There are 2 DLLs involved, the "BHO" DLL which you see in your log and the main culprit which is totally hidden. Removing the "BHO" DLL has no effect as it (main culprit) will simply generate a new BHO DLL.
Do not do anything with this file yet, it will be needed later.
Unzip, but do not run it yet, it will be needed later.
Install, but do not run it yet, it will be needed later.
Double-click the included "Find-All.bat" file from Find-All.zip.
Where "<filename>" is the hidden invisable installer.
Note: "+++ File read error" is not an error, this just identifies the culprit.
Clear (delete) the "Value" containing the .dll and click Ok.
(type) "Windows" (no quotes) and close RegLite.
Using Windows Explorer go to your root drive: (typically) "C:\"
Navigate to System32 folder. N.B. File may have HIDDEN attribute.
Note: where "<filename>" = culprit dll from "output.txt"
Open Windows Explorer and check in C:\Junk for the "<filename>.dll" file.
At this point see if you can rename the "<filename>.dll"
Do this several time, changing the name and extension each time.
until you see the "Completed" message.
Next repeat the above steps, subsitute the "secondary dll"
From: "text/html" as seen in the "output.txt"
Under Drives & Folders, select "Scan within Archives".
Click on 'Proceed' to save these Preferences.
Please make sure that you activate IN-DEPTH scanning before you proceed.
Disclaimer: Renaming the "Windows" key modified some security settings.
Note: do this after removing the infection.
If the "inherit permissions" box is checked = Uncheck it.
Then select "COPY" on the prompt.
You can individually view/edit each group settings.
Be sure "Administrators" and "System" have full control on all.
Note: Creator owner full control on Sub keys only.
"Power users" and "users" = "read control".
I to am having the same issue.
"Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
hey I had the same bloody virus!! heres what i did.
I searched through the whole of google and found a chinese website.
Extract the usbcleaner6.rar file and here comes the fun bit. Since the writing on the buttons and program istelf is in chinese, you'll see a whole lot of "??????" and weird characters I literally clicked all the buttons on it and on each program, and what do you know it got rid of the virus.
p.s i tried every other anitvirus including Norton, Mcafee, trend micro, Nod32, ad-aware and a few others and non of them even spotted the virus! good luck!