Re: WinFixer 2005

David,
I finally got around to following your steps 1 and 2. I downloaded those 3
files, but only double clicked on the one that you told me to. Not sure what
the other 2 were needed for. It took awhile for the blue screen to show up
and run the scan. During the scan, there were a number of files in the
detail that I saw indicating "password protected" Not sure if that was
normal.

Here are the results.....

12/16/2005 22:27:11


Options:
/ADL /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL
/PROGRAM /EXCLUDE C:\MCAFEE\EXCLIST.TXT /MIME /HTML
"C:\MCAFEE\SCANREPORT.HTML"

Scanning C: []
Scanning C:\*.*
C:\Documents and Settings\Trey\Local
Settings\Temp\ICD1.tmp\UWFX5_0001_N57M2811NetInstaller.exe ... Found
potentially unwanted program Winfixer.
The file or process has been deleted.
C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll ... Found potentially
unwanted program Adware-MySearch.
C:\WINDOWS\SYSTEM32\pmkhf.dll ... Found potentially unwanted program
Adware-Virtumundo.
C:\WINDOWS\SYSTEM32\vtstu.dll ... Found potentially unwanted program
Adware-Virtumundo.
The file or process has been deleted.

A file(s) requires a reboot to complete the repair.
You are recommended to reboot the computer.

Summary report on C:\*.*
File(s)
Total files: ........... 106662
Clean: ................. 106488
Possibly Infected: ..... 0
Cleaned: ............... 0
Deleted: ............... 2
Non-critical Error(s): 2
Master Boot Record(s): ......... 1
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0


Time: 00:32.50

When I rebooted this morning, I got this message:
"Winlogon.exe encountered a problem and needed to close. We have created an
error report. Send error report to Microsoft?"

Is this bad?

"David H. Lipman" wrote:

> From: "Trent" <Trent@xxxxxxxxxxxxxxxxxxxxxxxxx>
>
> | David,
> | I read a thread in this news forum last night (but can't find it now) that
> | said I should not click on the "cancel" or the "x" in the top right hand
> | corner of the first Winfixer pop-up that occurs. It said I should stop it in
> | the task manager, which is control-alt-delete. But am I supposed to find the
> | winfixer program in the "applications tab" or in the "processes tab". And
> | what would the process file be that I would want to delete, or "end process"?
> |
> | Thanks in advance.
> |
> | And by the way, are you in any way affiliated with Winfixer, winsoftware,
> | winsoft, or any developer of these winfixer/winantispyware/winantivirus
> | products?
> |
>
> Click on the 'x' in the Top Right corner or hitting Ctrl-Alt-Del and killing IEXPLORE.EXE
> and of the following seen running...
>
> uwfx5.exe
> wfx5.exe
> UWFX5NetInstaller.exe
> 8355.exe
> 196_150_NI.EXE
> install.exe
> logfont.exe
> sr.exe
> riak.exe
> unins000.exe
> updater.exe
> minst[1].exe
> riqzcju.exe
> sspggd.exe
> eqwxzb.exe
> wayftxi.exe
> xau.exe
> hqyikxs.exe
> iasnhl.exe
> odensc.exe
> ipvp2res.exe
> vmtemp.exe
> dfe1.exe
> str.exe
> syssg32.exe
> adduk.exe
> crdh.exe
> ktcar.exe
> netbh.exe
>
>
> Then...
>
> Perform Part 1 the perform part 2
>
> Part 1
> ------------
> Download Adware-Virtumundo Removal Tool v1.5 --
> http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
>
> Information on the Adware-Virtumundo Removal Tool:
> http://forums.mcafeehelp.com/viewtopic.php?t=57049
>
> Part 2
> ------------
> Download WinFixerFix.exe from the URL --
> http://www.ik-cs.com/programs/virtools/WinFixerFix.exe
>
> Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
> Choose; Unzip
> Choose; Close
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
> FireWall to enable WGET.EXE to download the needed McAfee related files.
>
> Execute; c:\mcafee\clean.bat
> { or Double-click on 'Clean Link' in c:\mcafee }
>
> A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
> end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
> It is suggested that you move the report out of c:\mcafee before performing another scan.
> It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
> report for each session.
>
> * * Please report back your results * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>
.

Relevant Pages

  • Re: winlogon.exe
    ... Download Adware-Virtumundo Removal Tool -- ... On Win9x/ME platforms the report will not be shown in ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ... hi david, thx for your reply. ...
    (microsoft.public.windowsxp.security_admin)
  • Thanks! David
    ... "David H. Lipman" wrote: ... Download Adware-Virtumundo Removal Tool -- ... On Win9x/ME platforms the report will not be shown in your bowser ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ...
    (microsoft.public.security)
  • Re: Thanks! David
    ... David thank you for your quick response. ... just want to be able to tell my daughter that this is the only way. ... Download Adware-Virtumundo Removal Tool -- ... On Win9x/ME platforms the report will not be shown in your bowser ...
    (microsoft.public.security)
  • Re: WinFixer 2005
    ... "David H. Lipman" wrote: ... > Download WinFixerFix.exe from the URL -- ... > It is suggested that you move the report out of c:\mcafee before performing another scan. ... > It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML ...
    (microsoft.public.security.virus)
  • Re: winfixer
    ... I have already upgraded to java 6 and I am hesitant to download any adware ... Download Adware-Virtumundo Removal Tool -- ... On Win9x/ME platforms the report will not be shown in your bowser ...
    (microsoft.public.security)