winfixer and other popups

[Miguel]

I have the latest/greatest microsoft ani-spyware
installed and have run numerous full scans to get rid of
this new spywaere/malware that keeps occuring. Does
anyone know how to find and delete this malware? How can
we inform Microsoft that it's new software does not
detect this so they can update their stuff?

Thanks

miguel

 

[Engel]

Steps to take if you have spyware that is not removed by
Microsoft Windows AntiSpyware (betª)
1) Open up AntiSpywªre
2) Click Tools at the tºp
3) Click "Submit a Suspected Spyware Repºrt"
4) Fill out the form with as much detail so they can
anªlyze quickly.


Have you tried these operations running in safe mºde?

1) Update both Microsoft Antispyware and your antivirus
applicªtion.

2B)Shut down the computer and turn off the power. Wait
for at least 30 seconds, and then restart the computer in
Safe mode or VGA mºde.

Empty your IE cache and your other temporary file
folders, eg: c:\temp, c:\windows\temp or C:\Documents and
Settings\<name>\Local Settings\Temp (the path to your
temp folder will change depending on your name) -
sometimes programmes can be hidden in there - watch out
for mysterious *.exe files or *.dll files in those
fºlders.
http://www.mvps.org/winhelp2002/delcache.htm


3) Do full deep scans with Microsoft Antispyware. Repeat
scanning until a complete scan comes through clean.
Ditto with the ªntivirus.

This isn't guaranteed, but it works for a great many
items that at first appear not to be cleaned in normal
mºde.


See:
Subject: winfixer & virtumondo won't leave
From: "Steve" <[email protected]>
Sent: 9/26/2005 12:09:52 AM
Announcemenys forum.

Good luck Miguel

Engel

 

[Gary]

A lot of spyware programs install in these specific
locations:

c:/documents and setting/Username
c:/program files/

and most often i find them stored in registry files.
(unless you are skilled to handle the registry, deleting
registry files will harm your computer)

unfortunately i have recently opened an unknown exe file
and a keeps generating the same spyware to beinstalled
over and over no matter how many times i remove it. i
successfully deleted the bulk of the spyware by booting
from another hard drive partition, running the
antispyware on both harddrive partitions and then
rebooting. when i loaded back to the infected partition it
gave me 3 error screens. all said Failed to load a
paricular EXE file. so i had successfully removed
something. This may work for you.

you may also try starting with safe mode and looking for
files that you do not need or dont remember installing.

GaryD

 

[Alan]

Miguel, I just had a bout with winfixer popups also, and
finally found a fix. MS Antispyware did identify the
problem, but was unable to remove it.

If you are having the same problem I had, then you will
see an unsigned browser helper object in your IE add-ons
list (go to the IE menu: Tools, Manage Add-ons) named
MSEvents.

If this is what you have going on, the instructions found
here:
http://www.bleepingcomputer.com/forums/How-to-remove-the-
TrojanVundoB-Search42com-MSevents-tx18610-0.html

worked to kill this bad guy for me.

Good luck.

(P.S., I will be sending a report for this to the spyware
beta team.)