Adware Removal - WUInst.dll

[Guest]

My Norton Antivirus detected a "threat" and identified it as Adware. The file
name was shown as WUInst.dll and was said to be located in the
"c:\windows\downloaded program files" directory. NAV tried to delete the
file and failed but gave no reason.
I looked in the stated directory but could find no file called WUInst.dll.
I tried a search using different combinations such as "WU*.*" etc but could
not locate it.

Symantec's support pages identify the threat as originating in a download
and being marketed by "WhenU.com". It also describes a number of other files
such as "Save", SaveNowInst.exe", shdocvw.dll and others which I can't find
on my machine. It also refers to locations such as c:\program files\save
which I cannot find. I have even searched hidden files to no avail. I have
also searched the registry for the "savenow" tags etc but can't see anything
untoward.

I tried all ofthese things logged on as myself (with administrator
privileges) and then logged on as "administrator" just in case there was some
funny difference in privileges.

Adaware (Lavasoft) doesn't even identify it as being present and that
suprises me since it is normally so good. Yes - I have updated Adaware to
make sure that I have the latest set of reference files.

I can't delete a file that I can't find! But isn't that what they really
want when they stuff your machine full of this unwanted garbage??

Anyone got any ideas how to get rid of this stuff? I can't even think of
which downloaded file it came with since I rarely download anything that I am
not certain about - for this very reason.

I am using Windows XP Professional with Norton Internet Security & Norton
Antivirus etc.

Many thanks - in advance
regards
harry E.

 

[Mark L. Ferguson]

When you perform a search, the Advanced option is available that lets you
search for 'hidden and system files".

IE won't open if you don't have shdocvw.dll, so I would imagine you will
find that.

 

[Ron Martell]

My Norton Antivirus detected a "threat" and identified it as Adware. The file
name was shown as WUInst.dll and was said to be located in the
"c:\windows\downloaded program files" directory. NAV tried to delete the
file and failed but gave no reason.
I looked in the stated directory but could find no file called WUInst.dll.
I tried a search using different combinations such as "WU*.*" etc but could
not locate it.

Symantec's support pages identify the threat as originating in a download
and being marketed by "WhenU.com". It also describes a number of other files
such as "Save", SaveNowInst.exe", shdocvw.dll and others which I can't find
on my machine. It also refers to locations such as c:\program files\save
which I cannot find. I have even searched hidden files to no avail. I have
also searched the registry for the "savenow" tags etc but can't see anything
untoward.

I tried all ofthese things logged on as myself (with administrator
privileges) and then logged on as "administrator" just in case there was some
funny difference in privileges.

Adaware (Lavasoft) doesn't even identify it as being present and that
suprises me since it is normally so good. Yes - I have updated Adaware to
make sure that I have the latest set of reference files.

I can't delete a file that I can't find! But isn't that what they really
want when they stuff your machine full of this unwanted garbage??

Anyone got any ideas how to get rid of this stuff? I can't even think of
which downloaded file it came with since I rarely download anything that I am
not certain about - for this very reason.

I am using Windows XP Professional with Norton Internet Security & Norton
Antivirus etc.

Many thanks - in advance
regards
harry E.

Make sure your AdAware is the latest SE version 1.05. If not get the
updated program from www.lavasoft.de and install it.

See MVP Jim Eshelman's Spyware Quick Fix page at
http://www.aumha.org/a/quickfix.htm for specific advice on cleaning up
your machine.

Good luck


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

"The reason computer chips are so small is computers don't eat much."

 

[Teresa Fair]

Greetings,
What you are dealing with is the Look2Me.com trojan. check your system
for a file called crash.txt, when found, delete it. As far as the .dll
files, check your windows\system folder for .dll files with the hidden/read
only/system attributes. If you find these, reply to this post and I will
tell you how to rid yourself of this nasty pest without having to format
your pc.

Thank-you