Help needed about removing Winfix 2005

Dear All,

I need help in making sure that my computer is free of the spyware winfix 2005. I use Internet Explorer and for the past 3 days I have been receiving unwanted popups taking me to installation of winfix 2005. I never accepted and never installed winfix. But, whenver I open IE, I could see the popups. As of now I am working on Mozilla Firefox to keep away from the popups. But, I would like to know some way with which I can completely remove the spyware from my PC. I would like to see myself using IE again. I use Nortnon Internet Security suite and Microsoft Antispyware on my PC.

I am attaching the HJT log below. Please help me in resolving the issue.

• Edit by bjgarrick: Unrequested, Inline HJT log removed!

Thanks,
Nanda

 

Welcome to MajorGeeks.com, please follow the steps below:

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

• Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

Downloading, Installing, and Running HijackThis

 

Hi,

Thanks so much for replying to my post. But, unfortunately, I couldn't succeed still in removing the WinFixer from my PC. I tried doing every step mentioned in the link you have provided. I installed Ad-aware, CCclean, SpyBot and none of the applications could even detect the spyware. But, as usual, when I ran my existing Microsoft Anti Spyware software, it found 14 instances of virtumondo. Everytime I run spyware scan in Microsoft Anti Spyware, it says it found 14 instances of virtumondo.

I couldn't complete the online scanning step mentioned in the link you provided. The reason is that, whenver I open Internet Explorer, Winfixer message appears and my Internet Explorer page hangs.

Please guide me what to do.

Thanks,
Nanda

 

Download this trial version of Ewido Security Suite

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
• After it completes the update, click the Scanner button

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

Open up Ewido and do the following:

• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report along with a fresh HJT log.

 

Hello,

Please find the sequence of steps that I performed and the observations.

1. I downloaded ewido and checked for updates. During the search for updates, an alert message appeared saying C:\Windows\System32\ddcya.dll is infected with virtumonde. I gave the option to clean up. This message appeared 2 times during the search for updates.

2. After I downloaded the latest updates for ewido, I restarted my PC in safe mode. I ran the scan in ewido. It found 41 infections. I am attaching the log file.

3. After the complete scan of ewido, I restarted my computer in normal mode with internet connection plugged in. During starting up the windows, ewido again found 2 instances of virtuemonde infections in C:\Windows\system32\ddcya.dll

4. I took the HJT log and attached with this post.

Please advice me the next step to be made.

Thanks,
Nanda

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

Ewido

Microsoft AntiSpyware

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll (file missing)

O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll (file missing)
O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\ddcya.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O20 - Winlogon Notify: ddcya - C:\WINDOWS\system32\ddcya.dll

O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\MyWaySA ←–– Delete this whole folder if it exist!

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.

 

Hi,

I did every step mentioned in your reply. Please see the recent HJT log attached. I could see some entries that I removed are again present in the log.

Please advice me.

Thanks,
Nanda

 

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Please print these instructions out for use in Safe Mode.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning.
  It should look like this

• At this point press enter one time.
  
• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\system32\ddcya.dll​

• Press Enter to continue with the fix.
• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\system32\aycdd.*​

• Press Enter to continue with the fix.
• The fix will run then HijackThis will open, if it does not open automatically please open it manually.
• In HiJackThis, please place a check next to the following items and click FIX CHECKED:

O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\ddcya.dll
O20 - Winlogon Notify: ddcya - C:\WINDOWS\system32\ddcya.dll​

• After you have fixed these items, close Hijackthis.
• Press enter to exit the program then manually reboot your computer.

Once your machine reboots please attach a fresh HJT log from normal mode.

 

Hi,

I ran the vundofix as you suggested. Please see the fresh HJT log.

Thanks,
Nanda

 

Scan with HijackThis and Check the Boxes for the following:

O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\ddcya.dll (file missing)
O20 - Winlogon Notify: ddcya - C:\WINDOWS\system32\ddcya.dll (file missing)

Make sure All Browser Windows are Closed when you Click FIX.

After you complete the above, your log will be clean! Are you having any further problems?