I was referred to this thread http://www.bleepingcomputer.com/forums/t/18610/how-to-remove-winfixer-virtumonde-msevents-trojanvundob/ after posting the following in cnet forums.
Getting ride of ErrorSafe & Winsoftware. WinAntiVirusPro2006
These two buggers showed up and won't go away. They don't so far seem to work on opera. But they will persist on bugging me in IE, I have been forced to set my IE security to max, its the only way to stop their multitude of popups of "installing &/or downloading their software" where each one you close brings up a new one (sometimes set in the install buttons fashion, sometimes in a window, each one different)
Spybot has removed these "cookies" again and again (according to history 7 times for one, 6 for the other) But they keep coming back. I also have adaware, zonealarm, AVG antivirus, spywareblaster, counterspy.. None of the rest of these find anything/stop these buggers. Only spot bot finds em and its only a temporary measure.
I am also awaiting help in a hijackthis forum(a different one) More recently the name mentioned on the popups has changed to systemprot but the resulting popups are identical.
Anyways, the vundofix thread. I was experimenting with VundoFix. I had it do a scan not as a task. It found a number of entries, I checked one of them and told it to remove it. It restarted my computer even though I could have sworn I told it not to Anyways when I restarted I did a scan again. It came back with nothing (even though I only checked one entry, maybe it erased em all anyways? maybe taking out the one file caused the others to go away?)
When I check run as task, vundofix closes down, but never restarts. Tried many a time, it just won't run as a task.
That link, it refers to entries. Entries in what? Hijackthis? I had no such entries in hijack this, yet the program seemed to have found infection.
How do I know if the infection has gone away or not or if there is more infections? Could the virus having lost one of its files now be masking itself to prevent more removal? The thread keeps saying "if the infections still present" but not how to determine that.
Edited by Hobbes, 26 June 2006 - 04:12 AM.