Spyware "Winfixer" detected

[Delinda Noyes]

Everyday when my spyware runs, it detects spyware
called "Winfixer" (potentially unwanted software) with a
high threat level.

Everyday, I chose to remove it and each time my computer
goes through the process and said it and all its
components have been removed. I have even tried to
quarentine it. However, everytime I run a scan it
continues to detect this same spyware, even if I run one
immediately after "supposedly" removing or quarentining.

Why is this continuing to be detected and why is my
Microsoft Spyware Beta not doing what it says it is
doing? Is it not working properly? What do I need to do
about this? Because everyday from now on, I guess, it is
going to detect Winfixer.

Your response and solution will be very much
appreciated. I checked and I have the latest build and I
have it set to update daily so from where I sit, there
shouldn't be a problem.

Sincerely,
Delinda Noyes
(e-mail address removed)

 

[Bill Sanderson]

One (reasonably) quick thing to try is to restart Windows in safe mode by
pressing the F8 function key before the initial Windows screen appears.

Then do full, deep scans with Microsoft Antispyware, until a scan comes
through clean.

This spyware has several variants. I've seen testimony in these groups that
Microsoft Antispyware can handle one of the variants, but it isn't clear
that it can handle the newest one.

It would also be helpful if, in Microsoft Antispyware, you could submit a
Tools, suspected spyware report--if this is possible on your machine. Note
the problems you are having in the text boxes provided. If you get an error
message about proxy server settings, don't spend any further time on
it--there's a bug in some installations that causes this, and we don't have
a workaround for it, I'm afraid.

 

[Dave M]

Hi Delinda;
We've had reports that MSAS will remove Winfixer at and following the 5757
definitions. Insure your MSAS definitions are up to date, reboot to SAFE
mode (F8 at bootup - which prevents interference from other running
programs), start MSAS and do a DEEP full scan. See if that doesn't remove
it permanently for you. SAFE mode is required for many difficult removals.

Should that fail to remove it please let us know. There is an alternative
removal technique posted at this link, but we'd appreciate your feedback
using MSAS first:

http://castlecops.com/postp616914.html

 

[Andre Da Costa]

Here are some solutions from this post:
http://castlecops.com/postp616914.html
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

 

[Jim Byrd]

Hi Delinda - Follow the procedures outlined at the following page:

http://www.bleepingcomputer.com/for...janVundoB-Search42com-MSevents-tx18610-0.html

 

[Guest]

Winfixer isn't just spyware, it's a virus. It replicates itself and keeps
reinstalling itself. I got rid of it by searching for the installation
fileset on my machine and deleting all instances of it. As at last Saturday,
these files all began with UWFX5_0001.. The registry does not seem to have
been touched and Winfixer has now not reappeared for three days. Winfixer is
being installed by the adware that comes bundled with the free version of a
particular file sharing package. I have uninstalled it.

PLEASE NOTE. When the popup appears asking you if you want to install
winfixer to stop your machine from behaving eratically (this behaviour is
actually programmed by Winfixer) DO NOT OPERATE ANY OF THE BUTTONS ON THE
DIALOG, NOT EVEN THE x IN THE TOP RIGHT HAND CORNER. Stop the process from
Task Manager.