I suggest you hold off on using jv16--even an excellent registry cleaner such as that should only be used if you know exactly what you are doing. If you post a HijackThis log for us we can guide you thru what needs to be done--specific to the malware and your system. Be sure to mention WinFixer and the popups--this malware can hide even from HijackThis, especially if you try to fix things yourself. But HJT is a start and we can guide you thru the specific process for your specific machine.
Click on the link below and follow the steps in that tutorial so you can get a log posted:How to post a HijackThis Log
You can of course skip step 1. But be sure to follow all the other steps and use the links in the tutorial to:
1. Download the self-extracting HijackThis.
2. Open the HijackThis Logs and Analysis forum to start a new Topic in that forum. It is important that you post your log into a new topic in that forum. If you have any problems here is a link again:http://www.bleepingcomputer.com/forums/ind...?act=SF&s=&f=22
It may be a day or two before you get an answer. But it is also important that you not post again to the topic you started asking for help or wondering if you will get help or otherwise "bumping" your thread/topic. In order to work on a first come-first served basis, helpers look for the oldest topics with zero replies.BUT,
once you receive a reply, stay in the topic that you have started. Do not start another thread.
Thanks and see you in the forum. Edit:
Sorry for stepping on your post Leurgy. I agree that it is not a good idea to visit that site--at all. I would be interested in seeing if that method works. Most people wanting to be rid of WinFixer don't know how they got it and it comes as part of a certain type of malware that injects massive popups. I'm not sure if the removal method would be different when it's voluntarily downloaded.
But for HijackThis to be able to see all startups, everything must be enabled in misconfig. So LuisLazom
, try what Leurgy suggests and let us know. If it doesn't work, be sure to have msconfig set for normal startup before you scan with HijackThis to post a log.
Edited by Papakid, 25 August 2005 - 08:27 AM.