Remove WinFix2005 Spyware

[Guest]

I keep getting pop ups for WinFix2005. I recently installed Microsoft
AntiSpyWare and removed all detected spyware but still receive pop ups for
WinFix2005. Anyone know how to remove this?

 

[Guest]

Steps to take if you have spyware that is not removed by Microsoft Windows
AntiSpyware (betª)
1) Open up AntiSpywªre
2) Click Tools at the tºp
3) Click "Submit a Suspected Spyware Repºrt"
4) Fill out the form with as much detail so they can anªlyze quickly.


Have you tried these operations running in safe mºde?

1) Update both Microsoft Antispyware and your antivirus applicªtion.

2B)Shut down the computer and turn off the power. Wait for at least 30
seconds, and then restart the computer in Safe mode or VGA mºde.

Open a Internet window and go to Internet Options, Delete Cookies and Temp
Files and included all offline content then also go to start and run and type
%temp% and clear that fºlder.
Empty your IE cache and your other temporary file folders, eg: c:\temp,
c:\windows\temp or C:\Documents and Settings\<name>\Local Settings\Temp (the
path to your temp folder will change depending on your name) - sometimes
programmes can be hidden in there - watch out for mysterious *.exe files or
*.dll files in those fºlders.
http://www.mvps.org/winhelp2002/delcache.htm


3) Do full deep scans with Microsoft Antispyware. Repeat scanning until a
complete scan comes through clean. Ditto with the ªntivirus.

Download the following and run a thorough scan in safe mºde:

NOTE: Make certain to update every app before booting into Safe Mode since
you WILL NOT have access to the Internet from Safe Mºde.

Ad-Aware - http://www.lavasoftusa.com
http://hem.bredband.net/b288305/lavasofts_adaware_quick_start.htm

Spybot S&D - http://www.safer-networking.org/
http://net-integration.net/index.html
Make certain to not to select any of the pernament protection for Spybot and
DO NOT immunize the system, as this can interfere with MSAS' Real-tme
Protectiºn.

CWShredder - http://www.intermute.com/products/cwshredder.html

Spy Sweeper - http://www.webroot.com

Ccleaner - http://www.ccleaner.com

Also check windows updates to make sure you have the latest security patches
and service packs instªlled :
http://windowsupdate.microsoft.com/

Istructions for removing WinFix available if you Google "WinFix."

Engel

 

[Guest]

Should I do Engel's suggestions below as well?

Here is what my situation is:

My Internet Explorer homepage has been hijacked by spyware with the
following address: (http://updatecenter.com/. ; The site says that I have
been infected and Recommends AntiSpyware Software, PS Guard and Spyware
Trooper, it also has a small screen entitled Microsoft Internet Explorer the
says your PC has been infected with Spyware and recommends you download and
purchase Spyware Trooper. When trying to use the Tools/Internet Options to
change the default home page it seems to let you change it, but the next time
you click on IE it looks like it goes to what you set the home page to, but
before it has a chance to come up it goes to the http://updatecenter.com
again.

I have downloaded the McAfee Security Center - both the McAfee Virus Scan
and the McAfee Personal Firewall and now the Microsoft AntiSpyware Beta 1.
After running all of these it does not detect and delete this one??

Do you know how I can get rid of it and get my home page back?

 

[plun]

Hi

This is probably not the same "pest". Within your
PC you probably have 1 or 2 or more trojans.

The only way to see this is to use HijackThis logs.

For PS Guard and Spy Trooper you can look at this canned removal
message and compare with your log.

http://forums.techguy.org/printthread.php?t=376692

HijackThis download:
http://www.merijn.org/files/hijackthis.zip

If your symptoms matches use techguy removal practise.
Ewido, Smitrem and so on.

But be careful.

 

[plun]

Hi

Forgot this URL for compare:
http://www.castlecops.com/t135163-PS_Guard_hijack_can_you_please_help.html

 

[Guest]

Thanks Plun,

So the first thing I do is download the hijackthis from the link you
provided and when I run it it, it will give me a log? I then am confused as
to what to compare with what? Sorry, new at this.

Do I go to the URL for compare (http://www.castlecops.com....html) and
compare the hijackthis log with what is in the html? And if it is then what?

When do I need to be careful? When I go to the castlecops site?

 

[plun]

Hi Skipjack

Whats important:
To see signs of a smitfraud infection, techguy and castlecops
are safe sites, experts within these removals.

I can give you more URLs if you are unsure.

And HijackThis, just unzip it to a new folder and run HijackThis.

How to use HijackThis:
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

 

[plun]

One more URL about this:

http://www.castlecops.com/postlite135297-guard+removal.html

Also start with Ewido, it probably kills all trojans and malicious
processes !

--
plun





Skipjack explained :

 

[Guest]

OK, thanks, I'll keep you posted, gotta go to work now.