UPDATES - July 26, 2005

Hello I've tried just about everything to get this stupid thing off and out of my pc but nothing seems to work. I tried the removal instrutions posted here but that didn't seem to work for me either. If any one can offer me assistance in removing this please HELP ME! Nothing has been able to locate it and I'm going crazy. Thanks Dave

quite a few months old and the fixes and the malware change every day Dave. You should start your own thread and offer a little more information than you did here and you will get more responses that way. Most of the regulars don't bother with these old threads because it is usually repeat information that is posted. .

Thanks I will do that.

the numbers are the same except for the internal build number. This is a new update. the earlier one was: Internal build 66

Installing Update...
Definitions File Loaded:
Reference Number : SE1R57 26.07.2005
Internal build : 67
File location : C:\PROGRAM FILES\LAVASOFT\AD-AWARE SE PERSONAL\defs.ref
File size : 503962 Bytes
Total size : 1519153 Bytes
Signature data size : 1486585 Bytes
Reference data size : 32056 Bytes
Signatures total : 42350
CSI Fingerprints total : 982
CSI data size : 34567 Bytes
Target categories : 15
Target families : 720

You can use Webupdate to install the new reference file, or download it manually from:
http://download.lavasoft.de.edgesuite.net/public/defs.zip

I downloaded it, but it is not executable. What am I supposed to do with it now? The file resides in My Documents. Please help Winfixer is the worst!!!

Adware SE update post. To the best of my knowledge Ad-Aware does NOT remover Winfixer. You will need a HijackThis expert forum (NOT here) for it probably. If you need more help, then start a NEW thread of your own and give some more information as to your particular problem.

Your posting was the only search result that came up on CNET for "WinFixer 2005". You've included in this CounterSpy code, but I'm unclear whether WinFixer is the problem or the fix. Is it a virus? It downloaded and installed itself on my computer tonight and now it demands that I click "Repair" or it seems to shut down my computer (may just be a coincidence indicating that I have another problem).
Anyone's input/response is appreciated.

added it to it's detections yesterday. That means it will detect it but as for removing it, I have no idea. You would have to try CounterSpy to find out I guess but if it detects it, it probably removes it too. This is an Updates thread that you posted into. All I was doing was reporting what was added to the program.

I think this thing is a monster!!!

It's a pop-up window that offers a free scan of your computer for internet clean-up or some such thing.
I clicked on it for a second then decided against it...
Now, I forever have this download pop-up window that won't go away. I can't seem to locate any info on the whereabouts this is located in my computer, plus there is some dumb looking icon on my task bar like a white circle with a gold rim...
This is some bad you know what. I can never understand why programs think they will sell more of there stuff if you can't remove it. I also noticed it is distributed by affiliates.... that may be the crux right there. They will have pop-ups of this stuff all over the place. Anyway I went to their site and wrote a letter, will be waiting too hear back. Sorry that you are having troubles as well...I guess thank goodness it never downloaded on my machine.

I picked up Winfix on my PC on Tuesday 23rd. I didn't click on 'yes' to install, I clicked 'no' but a bit later it came back and I clicked on the'x' in the top corner to close it down but i'm pretty sure this is how it installed on my PC.

At first all I was getting was annoying full window pop ups, i saved some of the http addresses if Marianna needs to see them, i'll post them here. However, earlier today my mouse pointer started 'freezing' and I couldn't use keyboard shortcuts either. I had to disconnect the power to get my PC going again.

After this happened a couple of times my Norton picked it up and detected a couple of bad files. I also saved these file names but not sure whether this would just be applicable to my machine. All was OK for about 7 hours then it started again.. three times in about 15 minutes. I switched off the power to my router and ran a Spybot Search and Destroy scan which picked up Winfix.

I run Norton anti virus, Spyware Doctor and TrojanHunter guard. I also run Registry mechanic every time I boot up and Privacy Guardian. I am baffled how this annoying little bug got through my defences but I hope I have now got rid of it.

WinFix is a OK product. It's website is in http://www.winfix.com/

WinFixer 2005 is the Adware product (not recommended to use). See http://research.sunbelt-software.com/threat_display.cfm?name=misc.winsoftware.winfixer&threatid=40196

You can also WinFixer is mentioned in Eric Howes Rogue Product lists -
QUOTE
WinAntiSpyware 2005
winantispyware.com
winsoftware.com
softwareprofit.com
aggressive advertising (1, 2); same company as WinAntivirus 2005 & WinFixer [A: 9-4-05 / U: 9-4-05]

WinAntivirus 2005 winantivirus.com
winsoftware.com
softwareprofit.com
aggressive advertising (1, 2, 3, 4); false positives work as goad to purchase; inappropriate collection of Personally Identifiable Information; same company as WinAntiSpyware 2005 & WinFixer [A: 5-21-05 / U: 9-4-05]
UNQUOTE

http://www.spywarewarrior.com/rogue_anti-spyware.htm

I have been struggling and trying to get rid of Winfixer 2005 for about a month. I had arranged to live with it for about three weeks. As a result of some simple incremental steps, it is now off my Windows 2000 computer. Hooray!

Here are the things I did in the order in which I did them.
1. I found the Winfixer subdirectory and renamed all the .exe files .ex2 instead. This had the effect of making Winfixer try to reinstall itself every time I rebooted. A little window would pop up and tell me that Winfixer was already installed, and did I want to reinstall it. I clicked NO, and this kept Winfixer from giving me any trouble until the next time I rebooted.

2. I ran Norton AntiVirus. It found a number of Winfixer registry entries which it said seemed to be wrong, since, of course, it couldn't find any of the files the registry entries were supposed to call. I told Norton AntiVirus to eliminate those registry entries. Unfortunately, this did not stop the little window from appearing on reboot requiring me to reply NO as in number 1 above.

3. Today, I delivered the "coup de grace" to Winfixer. Here's what I did:
a. I disconnected my computer from the Internet.
b. I rebooted in Safe Mode. (I am not sure that this was absolutely necessary.)
c. I ran the unins000.exe file in the Program Files\Winfixer subdirectory.
d. I rebooted. This time a little window came up telling me it was downloading Winfixer from the Internet and reporting how many seconds it was taking. Of course, nothing was being downloaded from the Internet since I had taken my computer offline. I closed the little window.
e. A Winfixer icon also came up on the desktop. HERE IS THE REAL TRICK!!! I right-clicked on that icon, and it gave me a screen identifying the "target" of the desktop shortcut. The target on my machine was the file C:WINNT\Downloaded Program Files\CONFLICT.4\UWFX5LP_0001_0715NetInstaller.exe.
f. I tried to Delete that file, C:WINNT\Downloaded Program Files\CONFLICT.4\UWFX5LP_0001_0715NetInstaller.exe. I was told I did not have authorization to delete that file. So, I renamed it instead, removing the first six or seven characters in its name.
g. I rebooted in regular mode. No little window, no Winfixer subdirectory, and no C:WINNT\Downloaded Program Files\CONFLICT.4\UWFX5LP_0001_0715NetInstaller.exe. In fact the CONFLICT.4 subdirectory is gone as well. I am back on the Internet, with no sign of Winfixer.

Good luck. I hope this works as well for all who are trying to get rid of this pest.

I want to try the way you did to rid my pc of this piece of blackmail. Unfortunatly, I am 65 yars old and a bit of newbie. I understand every instruction you listed but I cannot find C. "I ran the unins000.exe file in the Program Files\Winfixer subdirectory." I don't know where to look or how to find this file. I'm running Norton, Spybot and Lavasoft Adaware but nothing picks it up. Please forgive my ignorance, but can you tell me where to find this subdirectory. Any help you can offer will be most appreciated.

This is what I did:

Run spybot search & destroy (can be downloaded from http://www.safer-networking.org/en/index.html, make sure you have the latest updates) in safe mode (keep pressing F8 when you reboot, actually I am not sure if you really need to run it in safe mode), find winfixer there, remove it.

While in safe mode, restore the system to a previous point that you know you were not infected (Start -> All Programs -> Accesories -> System Tools -> System Restore). When the system reboots, unplug the cable (not sure if winfix might try to download anything upon start up).

Maybe just running spybot will do, but I did the other steps anyway.

Good luck. This winfixer ******* is VERY annoying.

Is this a virus? Every since this WInfixer began to hunt me, my conputer has been acting up (slowdowns, crashes, constant reboting.)

Signed
Fed up

I want to encourage everyone out there to go to www.ftc.gov and file a consumer complaint against winfixer, winsoftware, ltd., and softwareprofit.com. The more people that complain, the sooner this company will be out of business. If anyone has a physical address for winsoftware, please post it so complaints can also be sent to the state attorney general that winsoftware is located in.

I got this nasty thing on my other computer when trying to download an update from Microsofts Update webpage. Imagine that it even hijacked a webpage from Microsoft itself. Thankfully I never let it install but every time I start up the infected computer the Icon appears on my desktop then the gold circular icon appears in the tray. While I don't receive any popups I'm unable to connect to the internet because when I try Winfixer 2005 begins to download. So I can't use my other computer for internet purposes and have even gone as far as to pull the phone line connection from it. To me this not only a "monster" as you call it but it also outright extortion by them demandig you pay $39.95 to get rid of it once it has been installed. I'd be very interested to hear the response you received from the e-mail you sent them. I belive we all should do the same thing and start putting presure on that company. Plus I'd like to see some class action lawsuits started which I would glady be a part of. Right now on my infected machine the winfixer 2005 tray icon is ticking away the minutes as it tries to download and install itself on a machine that is not even hooked up to the internet. It's a nightmare and from what I've read trying to get rid of it is an even bigger nightmare. Again please if you can let us all know the results from the e-mail you sent. Good luck to all of us!

On September 1, I posted on this thread a description of the steps I used to get rid of Winfixer 2005. It has not come back since then.

If you do what I did, you should be able to get rid of it and keep it from coming back.

how do i get rid of winfixer 2005

The free Ad-aware SE recently updated their definitions to detect Winfixer. Try to scan the system using Ad-aware SE
You can get it from http://www.lavasoftusa.com/support/download/

If not, use the removal tool from Symantec http://securityresponse.symantec.com/avcenter/venc/data/trojan.vundo.removal.tool.html

If that will not help, I suggest that you post a HijackThis log in forums where HJT analysis is offered because you need a tool that HJT analyst will ask you to use to remove it - you may find more of this forum in http://asap.maddoktor2.com/
Don't post your log in many forums. Just choose 1 forum to post the log.

Get Hijackthis from http://www.spywareinfo.com/~merijn/files/HijackThis.exe
(that is a direct download)
It is important that you run HijackThis.exe in its own folder so the backup files that HijackThis creates will not be accidentally deleted.

Open 'My Computer', then double-click to open C:\ (or the drive letter that your Windows is installed on)
In the menu bar, click File-->New-->Folder.
That will create a folder named New Folder, which you can rename to ''HJT'' or ''HijackThis''. Now you have C:\HJT\ or C:\HijackThis\ folder. Put your HijackThis.exe there, and double click to run it.

Click 'Scan' button. Click 'Save log' button. Save the 'hijackthis.log' in your desktop. Copy and paste the content of 'hijackthis.log' and post the log file in any forums that offers HijackThis analysis. Again, you may find more of this forum in http://asap.maddoktor2.com/

Do not fix anything using Hijackthis without the guidance of Hijackthis analyst.