Winfixer - do I have a problem?

tigs78

I've just had three messages appear on my computer about winfixer. They were like normal pop up information messages but they were basically saying about threats and click OK to start winfixer to fix the problem. I clicked the cross box on the first one and on the second it had an ok box and a cancel box so I clicked the cancel box on the 2nd and clicked the cross box on the third.

Did a quick search and read somewhere that even though I didn't click yes to anything I could still be infected. I have just run spybot and it said 'no immediate threats found'.

Should I do anything else? Could I be infected?

Thanks in advance.

Rex_Mundi

Winfixer is a particularly bad nasty. If you already have good antivirus and antispyware (with a realtime monitor) in place, this should stop you in the first instance of being infected with this malware (not always though).

I've had this message a couple of times myself. It comes associated with the site you are trying to view. Take this as a warning and don't go back to the site/sites that gave this popup.

My best advice against getting this installed............

Don't use Internet Explorer (Firefox will at least ask your permission before it downloads anything).

Keep up to date, and decent antivirus and antispyware running all the time.

If this popup appears. Don't click anything in the message..........Use the buttons Alt and F4 at the same time to close it without clicking in the popup.

pchelpman

What Rex says is fair enough for prevention but I feel that, if you are seeing these pop ups, you are already infected.

I won't go into too much detail as I'm not going to be around for a while to follow this up. However, download VundoFix.exe to your desktop.

> Double-click VundoFix.exe to run it.
> Put a check next to Run VundoFix as a task.
> You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
> When VundoFix re-opens, click the Scan for Vundo button.
> Once it's done scanning, click the Remove Vundo button.
> You will receive a prompt asking if you want to remove the files, click YES
> Once you click yes, your desktop will go blank as it starts removing Vundo.
> When completed, it will prompt that it will shutdown your computer, click OK.
> Turn your computer back on.


Now run everything in the first 4 posts to this thread ....

http://forums.moneysavingexpert.com/showthread.html?t=133269

If your problem still isn't fixed post a HJT log and someone will give you more specific advice.

Rex_Mundi

pchelpman wrote:

but I feel that, if you are seeing these pop ups, you are already infected.

Absolutely not.

Certain infected sites give this Winfixer popup. I've come accross a few myself (including from a link posted on these forums a while ago). Just because you get the popup does not mean that you are already infected. I've come accross these a few times in the last month, and can say with 100% certainty that I've not got this on my system.

Prevention in every case is better than cure. People are better to learn how to prevent infection in the first place rather than have to deal with an infection when it's too late.

tigs78

Thanks for all the advice so far....

To Rex in particular, do you think that given the fact spybot said that 'no immediate threats were found' that I am not infected. It's just that I'm not that computer literate and I think I would probably struggle with all the steps in that other thread that pchelpman kindly linked to.

I do run firefox and have Avast antiviruus and Zone Alarm firewall. A few days ago it said that Zone Alarm needed updating and whilst the update took place the Zone alarm icon disappeared and a message came up saying that the computer was not protected. This was for literally a few minutes but I know how quickly nasty things can get into the computer!

Could this be anything to do with the winfixer message? Do you think that I am infected given that spybot gave me the all clear?

electron_3

Winfixer pop-ups

This site is particularly bad avatarity.com DO NOT visit the site
its more of a keep away, so if someone say's go there DONT

Rex_Mundi

tigs78 wrote:

Thanks for all the advice so far....

To Rex in particular, do you think that given the fact spybot said that 'no immediate threats were found' that I am not infected. It's just that I'm not that computer literate and I think I would probably struggle with all the steps in that other thread that pchelpman kindly linked to.

You can never be 100% sure that a scan by just one antispyware application will give you a completely clean bill of health. This is why you see so much advice from people that it's best to run at least two of these kind of programs.

i.e.......

Spybot
Adaware
Windows Defender

........All the above programs are there for the same reason, but work in slightly different ways. One program can pick up stuff that the others miss and vice versa.

From the look of the security you have in place already, it looks good so far.

I would be certain that running Avast and Spybot together would give a good indication of whether you have been infected with this malware. It has been out for quite a while, and I'd be surprised if one or both of these programs has not been updated to pick up this infection by now.

Running the application posted by pchelpman could give you a bit more peace of mind, but don't think for a moment that just because you've seen this popup you are automatically infected. I've dealt with a computer infected with this malware before, and believe me, if you had it you would know you had problems for sure (it really is a nasty bug).

I've been surprised myself that this seems on the increase recently. Like I said, I've come accross this on a few sites myself recently. If you take precautions in the first instance (good security and a few good sense online practices), you have nothing to worry about.

hth

tigs78

Well I could manage doing the Vundofix.exe thing but it was all the other steps in the linked thread that made me gulp!

Is there any value in just doing that thing and not the rest?

P.S Last question I promise!

electron_3

I think you would be very prudent in following that link advice, put it this way
you will sleep better and get to know how to use security programs properly
no-one ever got anywhere in this world without trying.

:beer:

tigs78

electron

It's not that I'm not prepared to try it's just that I've fallen at the first hurdle, I don't even know how to back up!

electron_3

There is this kind of backup http://www.microsoft.com/windowsxp/using/setup/learnmore/bott_03july14.mspx

Then there is putting all of your important files on a USB pen drive or CD-R or CD-RW
so that important files dont go missing or become corrupt..

Have you got Nero at all? Have you got a CD Writer?