winfix32 doctor cleaner

I am getting a constant message, which looks like a microsoft message
obviously, saying that my windows has a problem and to fix it I should follow
a link at: winfix32.com Computer does behave like its got a worm, but nothing
is being detected through scans. I have CA package with Firewall, PPatrol,
AntiVirus and AntiSpam. Any ideas of how I could find out what it is.

Hi,

It's spyware, delete it.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Associate Expert - WindowsXP Expert Zone
www.microsoft.com/windowsxp/expertzone
Windows help - www.rickrogers.org

"dkstf" <dkstf@discussions.microsoft.com> wrote in message
news:3BC0358A-D28E-4AB2-8321-52C2B94DB8D3@microsoft.com...
>I am getting a constant message, which looks like a microsoft message
> obviously, saying that my windows has a problem and to fix it I should
> follow
> a link at: winfix32.com Computer does behave like its got a worm, but
> nothing
> is being detected through scans. I have CA package with Firewall, PPatrol,
> AntiVirus and AntiSpam. Any ideas of how I could find out what it is.

dkstf wrote:

> I am getting a constant message, which looks like a microsoft message
> obviously, saying that my windows has a problem and to fix it I should
> follow a link at: winfix32.com Computer does behave like its got a
> worm, but nothing is being detected through scans. I have CA package
> with Firewall, PPatrol, AntiVirus and AntiSpam. Any ideas of how I
> could find out what it is.

Run Dave Lipman's WinFixerFix from -
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute c:\mcafee\clean.bat (or Double-click on 'Clean Link' in c
\mcafee)

Another fix for this malware:

Download Attribune's VundoFix.exe to your desktop -
http://www.atribune.org/downloads/VundoFix.exe

Double-click VundoFix.exe to extract the files. This will create a
VundoFix folder on your desktop. After the files are extracted, please
restart your computer into Safe Mode. Once in safe mode open the
VundoFix folder and double-click on KillVundo.bat

Continue with general malware removal -
http://www.elephantboycomputers.com/...moving_Malware

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

From: "dkstf" <dkstf@discussions.microsoft.com>

| I am getting a constant message, which looks like a microsoft message
| obviously, saying that my windows has a problem and to fix it I should follow
| a link at: winfix32.com Computer does behave like its got a worm, but nothing
| is being detected through scans. I have CA package with Firewall, PPatrol,
| AntiVirus and AntiSpam. Any ideas of how I could find out what it is.



Two phase answer...

Perform Part 1 then perform part 2

It is suggested that you execute each tool in Normal Mode then in Safe Mode.

If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.
It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp



Part 1
------------
Download Adware-Virtumundo Removal Tool v1.5 --
http://secured2k.home.comcast.net/to...undoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.

Please Copy and Paste the contents of the HTML Log file; C:\mcafee\ScanReport.HTML in your
reply.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

dkstf wrote:
> I am getting a constant message, which looks like a microsoft message
> obviously, saying that my windows has a problem and to fix it I should follow
> a link at: winfix32.com Computer does behave like its got a worm, but nothing
> is being detected through scans. I have CA package with Firewall, PPatrol,
> AntiVirus and AntiSpam. Any ideas of how I could find out what it is.


It's a scam, plain and simple. It's from a very unscrupulous
"business." They're trying to sell you patches that Microsoft provides
free-of-charge, or a useless "product" that will install adware/spyware,
and using a very intrusive means of advertising. It's also demonstrating
that your PC is very unsecure.

Does the title bar of these pop-ups read "Messenger Service?"

This type of spam has become quite common over the past few years,
and unintentionally serves as a valid security "alert." It demonstrates
that the computer user hasn't been taking sufficient precautions while
connected to the Internet. The user's data probably hasn't been
compromised by these specific advertisements, but if he/she's open to
this exploit, he/she may well be open to other threats, such as the
Blaster Worm that swept across the Internet years ago and the Sasser
Worm that followed shortly thereafter, both of which can still be
contacted. Install and use a decent, properly configured firewall.
(Merely disabling the messenger service, as some people recommend, only
hides the symptom, and does little or nothing to truly secure the
machine.) And ignoring or just "putting up with" the security gap
represented by these messages is particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default...B;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/p...e/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise the user to do
nothing more than disable the messenger service. Disabling the
messenger service, by itself, is a "head in the sand" approach to
computer security. The real problem is not the messenger service
pop-ups; they're actually providing a useful, if annoying, service by
acting as a security alert. The true problem is the unsecured computer,
and the user's been advised to merely turn off the warnings. How is
this helpful?



--

Bruce Chambers

Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH