Removing Winfixer Popups - Comments Page 4

Download HijackThis.exe and VirtumundoBeGone.exe.
Then run hijackthis; it should show your trojan as (02) BHO: (program name) and (20)Winlogin Notify (program name). Close and boot into safe mode (F8). Run Virtumundobegone.exe, it should kill all entries that have to do w/ this trojan. It will more than likley re-boot your computer. When it boots back up re-run hijackthis and those two entries should be gone. Worked for me.

EDITOR'S NOTE: That does seem to zap some/most instances of Winfixer. But I would recommend using X-Ray PC instead of HijackThis. X-Ray was designed as a replacement for HJT, works great, and is super easy to use.

Hi i bought Spy Sweeper.. and it certainly does seem to detect problems early and exlain it in black and white- much more then norton. But im afraid my problem is not gone.. it found virtumund or whatever its called, and im pretty sure i removed it.

but everytime i use IE i still get popups... and now some have been popping up in mozilla. I would do that restore thing. but will i loose all information files and programs that i have made since the date i go back to?

EDITOR'S NOTE: System Restore will not remove your personal files, such as word processor documents, spreadsheets, pictures, music, etc. It will only undo software installs and system changes.

Thank You Rob !!!!!!!!! (Nov 20th entry) It works!

Go back and read Robs entry. Make sure you read everything on that Dell site page before you begin. It works perfectly.

http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&message.id=44634

You can download a removal tool from Norton called FixVundo.
It does the trick.

In September, WinFixer invaded my computer. I bought Spy Sweeper, and it fixed the problem. Unfortunately, I became reinfected with WinFixer a couple of weeks ago, and this time Spy Sweeper was not able to get rid of it. I contacted Spy Sweeper support on several occasions, and each time they sent me a solution that did not work. Next I tried Eddie's FixVundo solution (12/29/05). It took over a half hour to scour my system, but failed to get rid of WinFixer. One last hope was to try: http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe, which Rob recommended (11/20/05). Well, surprisingly IT WORKED! Not only that, it worked in seconds, and now my system works crisply again without the WinFixer albatross. Like others, I'm going to send a donation to the Techguy who developed this program. Isn't it amazing that he succeeds where Symantec and Webroot fail. As for the folks who developed the WinFixer adware, they should be tracked down and held accountable for their misdeeds. Big fines and jail time would be appropriate for all the grief that they've caused.

I too have been struck with the WinFixer malware since December even though my WinXP Pro SP2 PC is always patched with the latest protection from Microsoft and goes through a Verizon and MS router. I do have Half Life 2 on my PC but it was installed back when the product shipped.

I'll try Rob's fix and I'll let you know how that work's out.

There are least three posts here by people who, having successfully fixed their WinFixer problem by running VirtumundoBeGone, have expressed their desire to send a donation to "TechGuy". If you read things carefully, the "Tech Support Guy" forum is just one of many forums (along with the DELL forum, and "Bleeping Computer" forum) that have recommended the use of VirtumundoBeGone. However, the author/developer of that program is NOT "TechGuy", but rather "secured2k". So if people are making donations, I feel it important that the record be set straight here.
P.S. I am NOT secured2k.

I think the problem is that Winfixer has several variants. The VirtumundoBeGone and the Vundo removal tools I've found do NOT work for my variant.

What I can't believe is that the pay for tools/utilities don't seem to work either. I just can't believe that something that has been around for several weeks still gets past their detections. First couple of days, I'd understand, but this is absurd. I guess SpySweeper is where I'll go next.

Hi, In response to the earlier gentleman who wrote about the Antivirus companies placing some of these on the net. I think he is absolutely correct. The Winfixer virus contantly urges me to buy new antivirus software from Winsoft telling me there is something wrong with my computer.

I have written to them and Urge everyone to write to their local states attorney General's office seeking they take action. While there may be no specific law against them putting a virus on the net per sae , The vast majority of States regard the crime of Fraud as "Theft by deception". Convincing you something is wrong with your computer (when they created the problem) so you will buy their product is fraud!
The States Atty General has the power to act on behalf of the thousands of us affected and sue these clowns into poverty.
Please do like I have done and send out an e mail complaint today! WHen they hear enough, they'll act!

With some detective work (whois lookups and United Kingdom Companies House searches) I was able to work out that Winsoftware Ltd (who apparently created WinFixer) were a company based in Croydon in the UK. This company is now defunct and the winfixer domains are now registered to a post office box in the Ukraine. Maybe WinFixer was originally legitimate software (who knows), but what is clear is that this is now quite a large and organised scam. I wouldn't be surprised if it was being operated by the Russian Mafia.