WINFIXER pop up ARGGGGGGGGGGGGGGGGG!

[Extra 300 Driver]

I have this bloody pop up thing which is really annoying. It says I have spyware on my PC and I have to download a fix, and pay $39.99.

I have tried;

SPYBOT
ADAWARE
NORTON

All in safe mode too.

Any ideas? Please help.

[__Lee__]

Yep go here dude, it is called SpySweeper and is the daddy of anti-spyware.

You can use the 30 day free trial.

Let us know if this cures the problem.

Lee.




>> Edited by __Lee__ on Wednesday 14th September 21:08

[BliarOut]

If not, google for hijackthis. Haven't found one yet that I can't shift with that.

[__Lee__]

Yeah another fan of HiJackThis but it depends on your I.T. level as it can be a bit dangerous as you can easily kill valid processes off.

[Extra 300 Driver]

OK, I have run SpySweeper and a couple of trojans were found, hope thats sorted it!

Cheers

[BliarOut]

And, empty your temp folders and temporary internet files while in safe mode.

[Extra 300 Driver]

Just had it pop up again.

BOLLOX!

[BliarOut]

Names of the trojans? Depending on their names, there'll be detailed instructions out there on how to get rid of the critters.

[Extra 300 Driver]

It said that it had delt with them, its just this bloody winfixer thing! I am now getting allmax travel pop ups, I have a pop up blocker too!

[BliarOut]

Just cos it said they had gone Sounds like you'll need HiJackThis and a google on winfixup.

If it's XP, create a system restore point (which will still have the popups) in case you knacker it and need to go back a step.

[Extra 300 Driver]

I thought it may be an easy fix too.

[aranell]

Extra 300 Driver said:

It said that it had delt with them, its just this bloody winfixer thing! I am now getting allmax travel pop ups, I have a pop up blocker too!

Have you tried add/remove programs? Apprently, if you are lucky, you can get rid of it that way.

If not, these two sites seem to provide pretty good details for manually removing it:

http://castlecops.com/postp623000.html
www.spyware-removal-guideline.com/winfixer-removal

[_dan_]

Run HiJackThis (download HERE) and cut and paste the logfile on here for everyone to see.

[FunkyNige]

I've just come across Ewido and it's a fantastic peice of software - I spent about 30 minutes looking up .exe files in the Windows folder removing someone else's spyware when it dawned on me all the Google links used this software to remove what I was searching for. It's free to try for 30 days (in which time you can get some protection against spyware - most people reccomend the Microsoft Antispyware, spywareblaster and spybot search & destroy) so you can get rid of the infection you have then delete it.

www.download.com/Ewido-Security-Suite/3000-8022_4-10326287.html

[Extra 300 Driver]

_dan_ said:

Run HiJackThis (download HERE) and cut and paste the logfile on here for everyone to see.

Thanks Dan will do when I return home.

[Extra 300 Driver]

FunkyNige said:

I've just come across Ewido and it's a fantastic peice of software - I spent about 30 minutes looking up .exe files in the Windows folder removing someone else's spyware when it dawned on me all the Google links used this software to remove what I was searching for. It's free to try for 30 days (in which time you can get some protection against spyware - most people reccomend the Microsoft Antispyware, spywareblaster and spybot search & destroy) so you can get rid of the infection you have then delete it. www.download.com/Ewido-Security-Suite/3000-8022_4-10326287.html

Cheers FN, will do that tonight too!

[Extra 300 Driver]

Here you go, It means nothing to me!

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesJavaj2re1.4.2_05 injusched.exe
C:Program FilesJavaj2re1.4.2_05 injucheck.exe
C:WINDOWSSystem32alg.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesWebrootSpy SweeperSpySweeper.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesNorton AntiVirus avapsvc.exe
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSSystem32 undll32.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesWebrootSpy SweeperWRSSSDK.exe
C:WINDOWSSystem32wdfmgr.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program Filesewidosecurity suiteewidoguard.exe
C:Program Filesewidosecurity suiteewidoctrl.exe
C:Documents and SettingsNick SnowLocal SettingsTempTemporary Directory 1 for hijackthis.zipHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:WINDOWSSystem32hgghh.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:Program FilesNorton AntiVirusNavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:Program FilesNorton AntiVirusNavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 - HKLM..Run: [ccRegVfy] "C:Program FilesCommon FilesSymantec SharedccRegVfy.exe"
O4 - HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_05 injusched.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 - HKLM..Run: [SSC_UserPrompt] C:Program FilesCommon FilesSymantec SharedSecurity CenterUsrPrmpt.exe
O4 - HKLM..Run: [REGSHAVE] C:Program FilesREGSHAVEREGSHAVE.EXE /AUTORUN
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe /Consumer
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [SpySweeper] "C:Program FilesWebrootSpy SweeperSpySweeper.exe" /startintray
O4 - HKLM..RunServices: [Microsoft Update Time] wuam.exe
O4 - HKCU..Run: [msnmsgr] "C:Program FilesMSN Messengermsnmsgr.exe" /background
O4 - Startup: Scheduler.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk.disabled
O8 - Extra context menu item: &Google Search - res://c:program filesgoogleGoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:program filesgoogleGoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:program filesgoogleGoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:program filesgoogleGoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:program filesgoogleGoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:program filesgoogleGoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_05 in pjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavaj2re1.4.2_05 in pjpi142_05.dll
O20 - Winlogon Notify: hgghh - C:WINDOWSSystem32hgghh.dll
O20 - Winlogon Notify: req - C:WINDOWSSystem32 eq.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:Program Filesewidosecurity suiteewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:Program Filesewidosecurity suiteewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:Program FilesNorton AntiVirus avapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSSystem32 vsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:Program FilesWebrootSpy SweeperWRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe

[BliarOut]

Delete these three entries to start with in safe mode.

O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:WINDOWSSystem32hgghh.dll

O20 - Winlogon Notify: hgghh - C:WINDOWSSystem32hgghh.dll

O20 - Winlogon Notify: req - C:WINDOWSSystem32 eq.dll (file missing)


Then delete hgghh.dll from your windowssystem32 directory. and empty all your temp files and recycle bin.

Then run HJT again and make sure they're not back!

If that doesn't fix it and no-one is around, you can post your HJT log file here and it'll automatically parse it.

http://hjt.iamnotageek.com/

[Extra 300 Driver]

Still doing it!

[Extra 300 Driver]

BliarOut said:

If that doesn't fix it and no-one is around, you can post your HJT log file here and it'll automatically parse it. http://hjt.iamnotageek.com/

Did that and it says

'Critical Error! Could not open file.'

HUMPH!