Win Fixer

[Guest]

I have been getting pop ups (which go through my blocker) for win fixer for
about 2 weeks now. My mom clicked "run" on the win fixer pop up and since we
have had many problems. Our internet, though dial-up, has been slower than
usual and windows get messed up when another window is brought up. Also at
times certain things would not open when clicked on (this happened a few
times when I tried to access internet explorer and once when trying to log
off). I searched through my files and deleted all traces of win fixer
including where I think it was downloaded. We still have problems with
windows getting messed up and win fixer pop ups though. Only now there are
less win fixer pop ups. Is there a way to completely eliminate these problems
or will this continue?

 

[Donny Broome]

Your PC is infected with spyware. The page below details several fine
products that can help you remove these pests. I personally use Ad-Aware,
Spybot and Webroot SpySweeper.
http://www.broomeman.com/spyware/

 

[Lanwench [MVP - Exchange]]

In

I have been getting pop ups (which go through my blocker) for win
fixer for about 2 weeks now. My mom clicked "run" on the win fixer
pop up and since we have had many problems. Our internet, though
dial-up, has been slower than usual and windows get messed up when
another window is brought up. Also at times certain things would not
open when clicked on (this happened a few times when I tried to
access internet explorer and once when trying to log off). I searched
through my files and deleted all traces of win fixer including where
I think it was downloaded. We still have problems with windows
getting messed up and win fixer pop ups though. Only now there are
less win fixer pop ups. Is there a way to completely eliminate these
problems or will this continue?

Note that the best place to post questions such as this is
microsoft.public.security.homeusers.

Basics:
Make sure your computer is completely patched (SP2, all available critical
updates, but no driver updates from WU)
Try the Microsoft antispyware beta (free download)
Try the latest versions of Spybot and AdAware (free download - easy to get
them at www.download.com)
Make sure your firewall is enabled, or you're behind a hardware
router/firewall appliance, or both

 

[David H. Lipman]

From: "cheezysquirrelz" <[email protected]>

| I have been getting pop ups (which go through my blocker) for win fixer for
| about 2 weeks now. My mom clicked "run" on the win fixer pop up and since we
| have had many problems. Our internet, though dial-up, has been slower than
| usual and windows get messed up when another window is brought up. Also at
| times certain things would not open when clicked on (this happened a few
| times when I tried to access internet explorer and once when trying to log
| off). I searched through my files and deleted all traces of win fixer
| including where I think it was downloaded. We still have problems with
| windows getting messed up and win fixer pop ups though. Only now there are
| less win fixer pop ups. Is there a way to completely eliminate these problems
| or will this continue?

Note: The following tool will remove the WinFixer 2005 and Trojan Vundo infection. I am
presently being attacked and impersonated by a News Group Troll named PCBUTTS1 and he will
undoubtedly post using my name and try to discredit me and the below tool.
He is posting through Astaweb or from Pacbell. Therefore, subsequent posts discrediting me
and this tool are NOT being posted by me.


Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.

* * * Please report back your results * * *

 

[David H. Lipman]

I am not pcbutts1. I just don't like you because of your lies.

 

[Deebsat]

Send me an email at (e-mail address removed) and I will send you a fix
tool that will remove that pest. Remove the XXX to make the email valid. Oh
BTW ignore the response you will get from David or Leythos he is a sick
obsessed stalker who cannot fix your problem. He would rather have you
suffer with this issue then to receive help from me.

 

[Leythos]

Send me an email at (e-mail address removed) and I will send you a fix
tool that will remove that pest. Remove the XXX to make the email valid. Oh
BTW ignore the response you will get from David or Leythos he is a sick
obsessed stalker who cannot fix your problem. He would rather have you
suffer with this issue then to receive help from me.

Yea, Yea, Yea, anyone that offers to help you, but only through private
email should not be trusted - they are hiding something.

In the case of PCBUTTS1, he's hiding that he's stolen the code to fix a
large number of malware problems, that he doesn't have permission to
distribute the files he claims the vendors gave him explicit permission
to host.

Ask yourself why you would want to trust someone like the above
described PCBUTTS1 person, why he hides under different identities, why
he has never fixed anything with his own tools.

 

[Nick Skrepetos \(SuperAdBlocker.com\)]

Hello,

You may wish to try Super Ad Blocker with SUPERAntiSpyware. It will remove
the WinFixer issues immediately:
http://www.superadblocker.com

Super Ad Blocker | SUPERAntiSpyware offers several unique features such as
using a system level driver to delete detected items, so pests do not come
back once detected and cleaned.

Super Ad Blocker offers a fully functional 15-day trial. You can scan and
clean your computer and then remove Super Ad Blocker if you do not wish to
keep it. We do appreciate when users support our development efforts by
purchasing the product

If that does not find and/or remove the spyware/adware on your machine, you
can submit a diagnostic and I will diagnose your machine for free and post
the results back to the group and update our rules with anything found:
http://www.superadblocker.com/diagnostic.html?id=nicks

You may also wish to "see" what is running on your computer here:
http://www.fileresearchcenter.com

Nick Skrepetos
SuperAdBlocker.com - SUPERAntiSpyware
http://www.superadblocker.com
http://blogs.superadblocker.com
http://forums.superadblocker.com

** Please note that I am the author of the above programs and sites and I do
have a vested interest in Super Ad Blocker, SUPERAntiSpyware and
FileResearchCenter.com. You, the user, have no obligation to purchase the
software and are free to try the software, clean/fix your system, and then
uninstall.

 

[Guest]

ok.......you know what? nevermind........it seems to me that all of you have
problems and you need to sort them out but NOT IN A POST WHERE SOMEONE IS
ASKING FOR HELP. So forget it, I can't trust you people when you are
constantly discrediting eachother. I'll find help elsewhere.......


thanks anyway I suppose

 

[Jim Byrd]

Hi Chezy - Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

There's a good "How-to-Use" tutorial here:
http://computercops.biz/HijackThis.html

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Place HijackThis.exe or unzip HijackThis.zip into its own dedicated folder
at the root level such as C:\HijackThis (NOT in a Temp folder or on your
Desktop), reboot to Safe mode, start HT then press Scan. Click on SaveLog
when it's finished which will create hijackthis.log. Now click the Config
button, then Misc Tools and click on Generate StartupList.log which will
create Startuplist.txt


Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://forums.spywareinfo.com/
or Jim Eshelman's site here: http://forum.aumha.org/
or Bleepingcomputer here: http://www.bleepingcomputer.com/
or Computer Cops here: http://www.computercops.biz/forums.html
or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx
or Net-Integration here: http://net-integration.us/forums/index.php

Register if necessary, then sign in and READ THE DIRECTIONS at the beginning
of the particular site's HiJackThis forum, then copy and paste both files
into a message asking for assistance, Someone will answer with detailed
instructions for the removal of your parasite(s). Be sure you include at
the beginning of your post a description of "What specific
problem(s)/symptoms you're trying to solve" and "What steps you've already
taken."




*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


You probably should consider switching to Sun Java J2SE 5.0 JRE or later
here: http://java.sun.com/j2se/1.5.0/download.jsp (What I use, BTW),
especially since MS will apparently no longer be distributing Java or
providing any support for Java including security fixes after Dec 31, 2007.
BE SURE that you uninstall any prior versions of Sun Java as some,
specifically JRE v. 1.4.2_03, contain a security bug which certain malware,
notably Winfixer/Vundo, are suspected of exploiting. If you did have this
version of Sun Java, JRE v. 1.4.2-03, installed, please post back and tell
us.


When you get things cleaned up, take a look at my Blog, Defending Your
Machine, addy in my Signature below, for some additional curative and
preventive measures you might want to implement to help prevent this type of
thing in the future.

--
Regards, Jim Byrd, MS-MVP/DTS/AH-VSOP
My Blog, Defending Your Machine, here:
http://DefendingYourMachine.blogspot.com/

message

 

[PA Bear]

Give the real David Lipman's suggestion a shot:

Execute; WinFixerFix.exe { Note: You must accept the default of
C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to
go through your FireWall to enable WGET.EXE to download the needed McAfee
related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be
generated. At the end of the scan, it will be displayed in your browser
(Opera, FireFox or Internet Explorer). It is suggested that you move the
report out of c:\mcafee before performing another scan. It would be a
good idea to scan in Safe Mode and in Normal Mode and save a copy of the
HTML report for each session.

* * * Please report back your results * * *

Download the tool here: http://www.ik-cs.com/programs/virtools/Multi_AV.exe
(David forgot to include this in his post)

 

[PA Bear]

You're headers tell us you /are/ pcbutts1:

<QP>
NNTP-Posting-Host: 70a647f7.news.astraweb.com
</QP>

David's headers:

<QP>
NNTP-Posting-Host: pool-151-198-137-110.mad.east.verizon.net 151.198.137.110
</QP>

 

[Jimbo]

What a pathetic loser you are.

Yea, Yea, Yea, anyone that offers to help you, but only through private
email should not be trusted - they are hiding something.

In the case of PCBUTTS1, he's hiding that he's stolen the code to fix a
large number of malware problems, that he doesn't have permission to
distribute the files he claims the vendors gave him explicit permission
to host.

Ask yourself why you would want to trust someone like the above
described PCBUTTS1 person, why he hides under different identities, why
he has never fixed anything with his own tools.

 

[Plato]

I have been getting pop ups (which go through my blocker) for win fixer for
about 2 weeks now. My mom clicked "run" on the win fixer pop up and since we

http://www.bootdisk.com/xptop20.htm#3

 

[Leythos]

What a pathetic loser you are.

Better to lose than be an unethical thief and idiot that constantly
violates security norms.

Posting direct links to executable files is a bad idea, it's a bad way
to train the ignorant masses that come here for help, and it's a bad
thing to host vendors files without their permission when the files are
freely available on the vendors sites (and mirrors).

Users should be trained to get the files from the source, not some
unknown, possibly compromised, unvalidated, site from some unknown
person that keeps changing their name for no valid reason.