NightShark

thanks.. i'll try these... if you don't see me back on in a while you'll know how it turned out.. lol

OzFxCoupe

C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\Ati2evxx.exe (shows up twice for some reason)
C:\WINNT\AGRSMMSG.exe
O2 - BHO: MSEvents Object - {8DBF02DA-4360-4A7E-BEA1-347B87816327} - C:\WINNT\system32\qomnm.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeh
O20 - AppInit_DLLs: katrack.dll MsgPlusLoader.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O20 - Winlogon Notify: QConGina - C:\WINNT\SYSTEM32\QConGina.dll
O20 - Winlogon Notify: qomnm - C:\WINNT\system32\qomnm.dll
O20 - Winlogon Notify: tphotkey - C:\WINNT\SYSTEM32\tphklock.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe


They're all the ones that I'd bin (unless you know what the ATI Technologies Inc. stuff is). If any of them are needed, you'll soon find out wink1.gif

I'd also go into the registry & at least perform a search for "winfixer" & delete any entries that are found.

00tibby

alright well i work all day removing spyware and viruses. heres how we do it.

first disconnect from the internet(just to be sure nothing is going to come back)
1) run something that will clean out all users temp files/cookies/temp internet files/recycle bin/etc. I believe its called C Cleanup (pm me with your email and ill send you a copy)
2) run Adaware (make sure you get the VX2 addon, once again i can email that)
3) run Spybot
4) run Microsoft AntiSpyware
5) run CWShredder
6) run HiJackThis (but be careful you can really f*** things up with this program)
7) run Norton Antivirus

all of the above are free except norton. most universities will give you a copy of Symantec Antivirus Corporate if you work for them or are a student. (symantec makes norton products)

alright. now uve done that in normal mode. reboot and push f8 to get a boot screen option.... you then want to go to safe mode and run the same scans. repeat until completely clean.

hopes this helps guys. not saying this the "best" way, but this is the meathod we use all day to remove spyware and is very effective.

ammoman

PestPatrol...it even picked up some adware on my machine from iolo and MS anti-spyware...the Army types should already know about this one, since the fully licensed version is free on AKO...

Loyen

ATI stuff is the video card support.

and it shows up 3 times - it is fine.

JonGTR

That is the same damn popup I'm getting on my GF's laptop. I've run several different programs and her computer is just fuxored. It's a slow POS now because of it.

supercow

google for winfixer there are lots of good sites with how-to's to remove it.

here's the best way to remove spyware - reinstall xp

here's the second best way:

1. do your scans - adaware, spybot, install and update spywareblaster

2. run hijackthis and found any bad stuff then google for it. 90% of the time simply removing it with hijack this isn't going to cut it. thats the reason adaware and the rest couldn't remove it.

3. quit installing spyware, never install software that has spyware integrated, when installing software to make sure google for "the software name" spyware and i'm sure you'll find plently of people complaining about it if spyware is in it.

edit: here's a site where someone is having the same issue

http://www.bullguard.com/forum/8/Winfixer-...help_18685.html

l2mfix is how i've removed winfixer in the past - it's a pain in the butt, but be glad you didn't install the porn dialer.....

00tibby

just to double check. i recommend the system i posted as we clean like 600 computers a month. but make SURE your doing the scans BOTH in normal mode and SAFE mode. if that does not work. you may have to try looking into knoppx or something that is NOT windows runs from cd+ram and can read windows files and scan with an antivirus and other tools. there are some NASTY stuff where doing it in BART PE or Knoppix is the only way to fix it do to it always running in windows and auto recreating itself (even in safemode 02.gif )

also, disable system restore while running the scan... right click my computer --> properties --> system restore tab --> uncheck

when you remove it reenable it.

also watch out for random "spyware removers" ive seen them actually be viruses themselves 02.gif . if you KNOW its winfixer do a google search and look for the symantec site url. they should i have individual remover for it.

NightShark

ok.. so far so good. i think its gone. i havent seen the pop up come in a few days or anything weird like that.. and now my computer can actually Suspend. before it wouldnt let me it kept waking up.

KayJai

What did you end up doing?