Winfixer spyware.... anyone know how to remove it permanently?

[RedEarth]

I've tried removing Winfixer with Spy Bot, Ad-Aware SE and Trend Micro Housecall. I still can't get rid of it. Does anyone have any other suggestions, other than get an Apple? This is getting annoying real fast.................

Thanks...............

[Floogeldy]

1. I have the same problem.

I fear it is built into Microsoft Explorer. }(

[RedEarth]

2. Sounds like you've tried to get rid of it too ....

I've been trying to get rid of it for the last three hours..... it's really ticking me off.

[Ohio Joe]

3. According to Symantec

They can remove it:

http://www.symantec.com/avcenter/venc/data/winfixer.html

If you don't use it, perhaps try getting their free version and see if it works:

http://www.symantecstore.com/dr/sat1/ec_MAIN.Entry17C?SID=49997&SP=10024&CID=0&PID=&PN=29&S1=&S2=&S3=&S4=&S5=&V1=31040595&V2=31040595&V3=1&V4=10&V5=&CUR=840&DSP=&PGRP=0&ABCODE=&CACHE_ID=0

Good luck!!!

[RedEarth]

4. Thanks, I don't use them, but might need to check into it.....

I appreciate your response......

[Crazy Dave]

5. They usually have free removal tools...

...that you can download and use to fix problems that viruses or trojans have done. It's a must if one is discovered as a virus scanner will only delete the virus while a removal tool usually repairs the known system files that the virus was designed to destroy. Also, rename the removal tool executable because a later variation of the virus might even have a blocker on it to keep a removal tool from installing.

[RedEarth]

6. Thanks Dave.... appreciate the advice......

I also ran across this article... sounds like WinFixer is quite a problem..

We all know spyware is bad stuff, the real question is: How to get rid of it. To find out, we went to the experts -- you, the Redmond reader. Dozens of you responded to our pleas. Here are the best bits of spyware removal advice, sprinkled with a healthy dose of anger and frustration.

Removing Aurora
Aurora is a nasty bit of adware/spyware that can be a real pain to root out. Redmond reader and IT Specialist Robert Butler knows. "I've discovered that Aurora changes the file names of the files it uses to re-infect the host. Aurora also apparently hijacks some legitimate running processes," Butler explains.

Butler has spent hours trying to clean Aurora out of sytems. "I've found that one needs to boot in command prompt safe mode and delete the file c:\winnt\ceres.dll. The file will not delete in normal mode and will regenerate the software if not deleted. No anti-spyware software will delete the file either."

Aurora also seeds confusion, says Butler. "Aurora is part of a group from Direct Revenue that includes: ABetterInternet, ABI Network, Ceres, Aurora, WinFixer, Direct Revenue and Search Assistant."

The confusion extends to Aurora Networks, a technology company that has nothing to do with the spyware, but finds itself mistaken for the malefactor. The firm has gone so far as to publish helpful updates and links for managing the Aurora spyware threat on its Web site.

That site includes a link to the Aurora authors' own removal tool. It would seem foolish to trust such a tool, but at least one reader, Scott Davidson, owner of ARX Computers, had good luck with the Aurora-built fix

http://www.redmondmag.com/features/print.asp?EditorialsID=566

and another article......

Q: For the past month or so, a sinister popup from winfixer.com has been coming up every time I use Internet Explorer. The popup says "Warning: Your system may have critical errors in the registry and file system. To scan your computer, click Next." When I try to close the popup window, a series of other pop-ups come up sequentially. I've run Norton Utilities and spyware scans but haven't been able to get rid of this major nuisance. I'm sure I'm not the only one having this problem.

A: You're not alone. WinFixer is a widespread piece of malicious software (known as malware) that tries to convince you there is something wrong with your computer -- and that the best way to fix the problem is to buy WinFixer. In other words, it infects your computer, then offers to sell you the cure. That's really low. But there are ways to get rid of it. Anti-spyware programs including PestPatrol ($29.95 at pestpatrol.com) and Spyware Detector (also $29.95, from spywaredetector.com) claim they can remove WinFixer. To thwart other creepy malware, consider downloading and installing Microsoft's free Malicious Software Removal Tool, which you'll find under Popular Downloads at microsoft.com.

http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2006/03/06/BUG0NHGOO11.DTL