Darn WinFix Popups
March 18, 2006
After much research, I found a particularly nice forum post on the Dell site. The procedure works if it involves the Vundo-based Winfixer (WinAntiSpyware, WinAntiVirus, Blackworm, Amaena), which can be identified in your HJT log in the O2-BHO section, if you find any of the following names:
- MSEvents Object
- ATLDistrib Object
- MFCOptimizeClass Object
- ADOUsefulNet Object
- WTLHelper Object
- RawExecAction Object
You should download Atribune’s VundoFix.exe (ver. 4.2.34 as of 03/17/2006) located @ http://www.atribune.org/ccount/click.php?id=4 and Save to Desktop.
Then you should follow the next set of steps
- Double-click VundiFix.exe to run it
- Check the checkbox to Run VundoFix as a task
- You will then receive a message saying that VundoFix will close and re-open in a minute or less
- When it re-opens, click the Scan for Vundo button
- Once it is done scanning for files, click the Remove Vundo button
- You will receive a prompt asking if you want to remove the files, click Yes.
- Upon clicking Yes, your desktop may go blank as it starts removing Vundo
- When completed, it will prompt you to shutdown the computer. Click OK.
- Turn your computer back on
If VundoFix worked for you, and cleared-up your WinFixer-related popup problem, then you should check to see what version of Java you’re running. There is much speculation that a “hole” in SUN’s Java, version j2re1.4.2_03 , is being exploited by WinFixer. The latest version (ver. 1.5.0_06 as of 03/08/2006) can downloaded [for free] @ http://www.java.com/en/ download/manual.jsp
Once you have installed the new version successfully, then you should Remove the older versions of Java thru the Control Panel > Add/Remove Programs area.
Good luck! Hopefully, the above steps help someone else out like it did for me. But always backup your machine regularly before attempting self-cleanup — it should be common practice anyways.