WinCommX ??? Removed it But..............

[jonah - newhorizon]

Pooter running very slowly and net connetion glacial, usual symptoms.

Microsoft Antispyware found WinCommX rated as a severe threat and
removed it so it said. (Spybot & Ad Aware Pro & Norton AV 2005), Yeah
I know NAV is just easy for my pooter useless colleagues to
understand.

Tried to find more info on this via Google, and many other forums but
searching reveals very little of any use. I just want decent
information on this thing & a specific detection / removal tool if one
exists, all I have come up with is "sponsered anti-spyware solutions"
the find loads of spyware and sell the subscription to remove said
"spyware"

Can anybody give me some info? where did it come from? is there any
removal tools .

TIA

 

[Silly Me]

Pooter running very slowly and net connetion glacial, usual symptoms.

Microsoft Antispyware found WinCommX rated as a severe threat and
removed it so it said. (Spybot & Ad Aware Pro & Norton AV 2005), Yeah
I know NAV is just easy for my pooter useless colleagues to
understand.

Tried to find more info on this via Google, and many other forums but
searching reveals very little of any use. I just want decent
information on this thing & a specific detection / removal tool if one
exists, all I have come up with is "sponsered anti-spyware solutions"
the find loads of spyware and sell the subscription to remove said
"spyware"

Can anybody give me some info? where did it come from? is there any
removal tools .

TIA

I found this in an archive:
[{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\WinCommX.dll
CODEBASE =
http://public.windupdates.com.munge...7b2a5905c689:24515e734f677cac594f3fdc891b75c6
(I .munged it so someone would not accidently go there. I always munge,
even safe links.)

Whois for windupdates.com
domain: windupdates.com
status: lock
organization: CDT Inc.
owner: Domain Manager
email: Whois Privacy and Spam Prevention by Whois Source
address: P.O. Box 181
address: TMR P.O.
city: Mont-Royal
state: Quebec
postal-code: H3P3B9
country: CA
admin-c: Whois Privacy and Spam Prevention by Whois Source#0
tech-c: Whois Privacy and Spam Prevention by Whois Source#0
billing-c: Whois Privacy and Spam Prevention by Whois Source#0
nserver: ns1.cdtnet.net
nserver: ns2.cdtnet.net
nserver: ns3.cdtnet.net
registrar: JORE-1
created: 2004-05-31 19:01:37 UTC JORE-1
expires: 2005-05-31 15:01:23 UTC
source: joker.com

"Wind Updates is free ad delivery software which provides targeted
advertising offers."

Smells to me!

Did you do the removal procedure at http://windupdates.com/?

If that failed I would recommend running HiJackThis
http://computercops.biz/zx/Merijn/hijackthis.zip and posting the log so we
can see what you have. There are some good people in this group that may be
able to help. At the very least I can steer you to other resources.

Silly

 

[Jonah]

Pooter running very slowly and net connetion glacial, usual symptoms.

Microsoft Antispyware found WinCommX rated as a severe threat and
removed it so it said. (Spybot & Ad Aware Pro & Norton AV 2005), Yeah
I know NAV is just easy for my pooter useless colleagues to
understand.

Tried to find more info on this via Google, and many other forums but
searching reveals very little of any use. I just want decent
information on this thing & a specific detection / removal tool if one
exists, all I have come up with is "sponsered anti-spyware solutions"
the find loads of spyware and sell the subscription to remove said
"spyware"

Can anybody give me some info? where did it come from? is there any
removal tools .

TIA

I found this in an archive:
[{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\WinCommX.dll
CODEBASE =
http://public.windupdates.com.munge...7b2a5905c689:24515e734f677cac594f3fdc891b75c6
(I .munged it so someone would not accidently go there. I always munge,
even safe links.)

snip

Thanks a lot Silly, not as bad as I thought, serves me right for
giving internet access to sales reps