Getting rid of WinFixer 2005

SamiSueXP (and all other participants here):

 

there are at least 6 different/distinct variations of WinFixer infections:  

1) MSEvents-type vundo/virtumundo trojan  (generally, a 5-letter randomly named .dll file)

2) ALTDistrib-type vundo/virtumundo trojan (generally, a 5-letter randomly named .dll file)

3) CATLEvents-type (.dat file)

4) SurfAccuracy, and the "simple" installers

5) "resistant" installers

6) "stealth"/hidden/rootkit versions

7) and perhaps other versions  [yet unclassified]

 

each distinct version requires a different approach to fix it.   So the first thing that needs to be done is to determine precisely which version the person has.   And about the only way to do this, is to generate and post a HiJackThis log, in the HJT forum.   [I will give detailed directions to do so, later in this post].

 

************

 

WebRoot Spysweeper is indeed a first-rate, excellent program.  it is highly effective in "killing" the vundo/virtumundo trojan versions of WinFixer.   [Presumably, it can handle some, and perhaps even all, of the other versions as well... but i'm just not sure].   the only downside to this product is that the free download is only for a 14-day trial period.   meaning that, if a person gets another infection (or re-infection) after the 14 day period has passed, they will then first need to find another/alternative fix for the problem... or else, buy the full/paid version of SpySweeper (which, considering its effectiveness, might indeed be a very wise move).   but i am trying to avoid getting involved with a paid situation. 

 

****************

 

having specialized in removing WinFIxer infections over the past several weeks, I can confidently assert that the WinFixer 2005 Removal webpage/link suggested by ScottLaRockMan:

 

a) applies essentially to the first type of WinFixer (MSEvents, plus an "un-named"/blank-BHO version of the  vundo/virtumundo trojan)... and to a lesser extent, to the second type (ALTDistrib can be attacked via the "step 9" - Atribune VundoFix)... but *NOT* to any of the other versions of WinFixer.

 

b) does not adequately explain even this one "sub-case" of WinFixer:  it simply cites two specific examples, without any elaboration as to what people should be looking for in general.

 

c) advocates a 10-step procedure... in which most of the steps are in fact non-essential (steps 1-6, 8, and 10)... and moreover, the only critical/rquired  steps (specifically, step 7 ; and, if necessary, step 9) have the "warning"  to "Use these programs and instructions at your own risk!"  and "for advanced users only"

 

because of all these pitfalls, i strongly advocate people NOT follow this link's recommendations.

 

***********************

 

the link suggested by dxernnj has indeed helped many people solve their winFixer problem [as of this writing, this link has been viewed over 46 thousand times!  (not sure how many times i've gone there myself :smileywink: )  however, the fix cited there, which applies in the MSEvents vundo/virtumundo trojan case --- and which i advocated at the time it was written --- is somewhat complicated, and we now have a newer/simpler fix that i'm recommending instead.

 

******************

 

so the bottom line, again, is first get a diagnosis, via HiJackThis, and then, get the appropriate fix for your version.

 

http://majorgeeks.com/download3155.html

you must create a separate folder and place it there.... people commonly use C:\HJT.   Note:  Please do *NOT* use a TEMP (temporary) folder, *NOR* your DESKTOP, as HJT will be generating log files and backup files in the folder from which it is run... you risk accidentally losing these if you use a TEMP folder, and you will generate extreme clutter if you use your DESKTOP.

The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer.   If for any reason, you're unable to UNzip it, you can download the already-unzipped .EXE file from http://downloads.malwareremoval.com/HijackThis.exe )

After Unzipping, double click on HiJackThis.EXE

Click on  Do a System Scan and Save a LogFile

This will automatically open NotePad

Copy the entire file from NotePad:  EDIT/SelectAll, EDIT/Copy

Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and  PASTE the results there:

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

Be sure to include a detailed description of any problems/errors/warnings you are encountering.

Hopefully, one of the HJT experts will get to it as quickly as possible.

 

POST SCRIPT:   It has come to my attention that many people are unfamiliar with how to create the recommended sub-directory/folder   C:\HJT   ;