Attachment uploads are currently disabled. This is a temporary situation and will resume as normal in the coming days.
UNSOLVED
Winfixer elimination
Hi,
I have followed the advice given by running the VirtuMundoBeGone. It seems to have taken the Winfixer popup away which is absolutely great taking into consideration that Spyware software costing a bit was not able to do this. Hail to the Freeware movement.
However the infamous file awvtr.dll in the system32 directory is stuborn and can not be deleted and VirtuMundoBeGone cannot seem to change the name. At least that is what is says in the log.
Any advice from anybody will be welcome.
Joh
I have followed the advice given by running the VirtuMundoBeGone. It seems to have taken the Winfixer popup away which is absolutely great taking into consideration that Spyware software costing a bit was not able to do this. Hail to the Freeware movement.
However the infamous file awvtr.dll in the system32 directory is stuborn and can not be deleted and VirtuMundoBeGone cannot seem to change the name. At least that is what is says in the log.
Any advice from anybody will be welcome.
Joh
- try this winfixer removal instructions, it might help.
- Zeroacid
Thanks for your help but I disagree. I have bought PCtools SpyWareDoctor and it might prevent your brower from accessing the Winfixer website but it does NOT eliminate the browser from calling the popup or delete the Winfixer files.
They were sporty enough to back up their 30 day money back guarantee. I kept Registry Mechanic which seems to be doing a good job. - to all participants in this thread:please be advised that there are several different variations of WinFixer.... including vundo/virtumundo trojans, SurfAccuracy, installers, stealth/hidden/rookit versions, and cookies. And each version requires a separate fix of its own.vundo/virtumundo trojans are by far the most common source [well over 90%] of all WinFixer problems. And in this case, the use of VirtumundoBeGone 1.5, or the automated Atribune VundoFix version 4.x , are extremely effective.the remaining cases can be properly diagnosed and fixed using HiJackThis analysis [in conjunction with tools like RegSeeker, RootKit Revealer, and Apropos Fix, depending on the particular WinFixer variation involved].Running the "wrong" automated tool won't help matters: for example, if you have the SurfAccuracy version, tools such as VirtumundoBeGone, or VundoFix, won't find/fix it. [It won't damage your system to try these... they just won't be effective in the SurfAccuracy case.] And "manual" fixes, which tend to contain extremely long lists of registry entries and files to be deleted, are completely overwhelming to the average PC user. Because there are so many different versions of WinFixer --- which are continually "morphing" over time to make it harder to find and fix ---- the manual lists are often out-of-date by the time they are compiled and made available. And moreover, the manual fix generally applies to only one type of WinFixer problem (usually the "installers") that the author is taking under consideration.In JohnPro's case, he's indicating he had ( past tense) a WinFixer popup problem, which stopped after he ran VirtumundoBeGone 1.5 . His concern, rather, was that VBG reported it couldn't "rename" nor "delete" an associated file which it had "deactivated". VBG reports this occasionally, and in almost all cases, it's nothing to be concerned about.John: I'm taking for granted you've had no more WinFixer popups since running VBG. But if you would still like to pursue this, I can give you directions for the Atribune VundoFix, and/or HiJackThis, to hopefully bring this thread to a close....EDIT:Here's the info for the Atribune VundoFix. While I believe you have no active vundo infection after running VBG, this tool may still find some "passive" infections... and perhaps also remove the "isolated" file which has been your concern:
Download VundoFix.exe from http://www.atribune.org/public-beta/VundoFix.exe and save it to your desktop. Make sure it's version 4.2.21 [or later].
- Double-click VundoFix.exe to run it.
- Put a check next to Run VundoFix as a task.
- You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
- When VundoFix re-opens, click the Scan for Vundo button.
- Once it's done scanning, click the Remove Vundo button.
- You will receive a prompt asking if you want to remove the files, click YES
- Once you click yes, your desktop will go blank as it starts removing Vundo.
- When completed, it will prompt that it will shutdown your computer, click OK.
- Turn your computer back on.
*************************************************For HiJackThis:Download a self-extracting copy of the latest version of HJT (HiJackThis) (version 1.99.1) fromSave it to your Desktop.Double-click on the file hijackthis_sfx.exe file, and allow it to self-extract [by clicking on UnZip] into the suggested/default folder,C:\Program Files\HijackThisUse Windows Explorer to navigate your way into this folder, and then double click on HiJackThis. exeClick on Do a System Scan and Save a LogFile
This will automatically open NotePad
Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy
Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:
http://forums.us.dell.com/supportforums/board?board.id=si_hijack
Be sure to include a detailed description of any problems/errors/warnings you are encountering.
Hopefully, one of the HJT experts will get to it as quickly as possible.
WARNING: HiJack This is a VERY POWERFUL tool. While it's completely safe for you to download, generate, and post your log (as described above), you should *NOT* attempt to do anything else (in particular, do NOT use it to delete/fix any entries) until you are advised to do so by a forum expert!! Improper use of this tool can severely damage your system.Message Edited by ky331 on 02-11-2006 09:10 AM
I keep getting popups for Winfixer. Does this mean I have the virus? My virus scan doesn't report any viruses.
I'm trying to follow the messages on this forum about winfixer, but am totally confused as to what needs to be done.
Thanks for any help.
Pat
the most common form of winfixer is indeed virus-related, being based on a Vundo-trojan. But other variations of WinFixer have other "sources", which may or may not "technically" be the result of a "virus". But regardless of such technicality, Winfixer is "malware" (bad stuff), which needs to be removed.
i still stand by the advice recommended in my last post above:
try vundoFix first. the last i checked, the current version is 4.2.34
if that fixes your WinFixer problem, you could probably stop. But if it doesn't find a vundo-infected file, or if you still have further WinFixer problems after running VundoFix, then you should follow my instructions to generate and post a HiJackThis log, in the HJT forum.
Message Edited by ky331 on 03-17-2006 07:07 AM
- i'm not familiar with limewire.... i'll try to ask someone else about it...but certainly, if we can locate a source "program X" for winfixer, then, to paraphrase you:If "program X" is the source of the problem, then yes, continued use of the program will just reinfect one's computer again
ky331
5 Journeyman
•
15627 Posts
•
45058 Points
636
0
Posted February 9th, 2006 23:00