I have been trying to remove the virus all weekend and nothing has worked.  Thank you very much for the download; it removed it right away!  You saved much frustration!

K

Details of updated removal tool now on the Symantec FixVundo website. New version 1.3.1. The download itself was updated Oct 13,2005

Ken

idrathergolf - is a good idea to inform your computer shop of the symantec info. Symantec seems to make little effort to let people know about the updated fix. Hope the shop doesn't overdo the fixing.

Ken

Message Edited by kenrob on 10-18-2005 05:08 PM

How does one get this adware?

I started getting weird blank explorer pages linked to Winfixer.  One actually popped up, claimed that Mozilla (??) had detected that spyware had "dowloaded 17 MB" from my hard drive and given control of my computer to someone else.  The same page helpfully suggested I buy a Winfixer product.

Is this sort of thing legal?  Sheesh.  Spyware to sell anti-spyware.  Go figure.

I got some error messages from McAfee anti-virus regarding pmnnn.dll but the program could not erase the file as it was write-protected (McAfee is very poor in this regard).

Spybot has been revealing two errors for the last few weeks: firewalldisablenotify and antivirusdisablenotify were both set to "0" in the Windows Registry.  I kept fixing this, only to see it come back again and again.

A quick jaunt on the c:\   DOS prompt (the old ways are best) revealed a few DLL files in the C:\WINDOWS\SYSTEM32 directory which had -s and -h attributes (system and hidden).  Very tricky.  With those attributes, WINDOWS would be loathe to show or delete such files (the junky Windows "SEARCH" feature failed to show these DLL files).

There was also a mljjh.dll and nnnmp.bat, nnnmp.ba1, and nnnmp.dat files aslong with a gebca.dll present, all with -s and -h attributes.  I deleted these manually.

I also searched the Windows Registry via regedit to check for various pmnnn and winfixer keys as noted on several sites.

I also ran the fixvundo.exe tool from symantec.  Here's the rub, though.  WINFIXER is obviously some hoax adware disguised as a virus removal tool.  Here I am downloading an .exe file to fix this, from a website that (I hope) is really from symantec.  Another hoax?  I hope not.

Anyway, after three virus scans, as well as spybot, it seems to run clean (and faster). 

How does one GET this adware anyway?  I thought I was doing all the right things - anti-virus, firewall, spybot, automatic windows update, etc.

I THINK it may have come from an e-mail sent by a friend.  That e-mail had four pixtures as well as an e-mail attachment (which I did NOT click on).  Anyway, while downloading the pictures, it said "29 items remaining" - quite odd for an e-mail with four pictures attached.  I am using hotmail, not Outlook Explorer.

Is there some settings I should change?  Thanks in advance for any hints.

robert,

you've asked a lot... let's see what i can answer:

since winfixer is perhaps the most common form of malware in circulation at the moment, there must indeed be MANY sources for it.   we do know of a few, and they're [safely] mentioned here:

http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&message.id=43418

legal? -- debatable.      "ethical"? --- NO WAY!   clearly, the creators are being deceptive in spreading this beast.

the Symantec FixVundo tool from  http://securityresponse.symantec.com/avcenter/FixVundo.exe

is legitimate, and safe ---- but in terms of WinFixer/Vundo, it works for some people, but not for others.   and there seems to be no rhyme nor reason as to when it works and when it fails.

in those cases where it fails, we recommend the following procedure (Atribune's VundoFix)

http://forums.us.dell.com/supportforums/board/message?board.id=si_hijack&message.id=16923#M16923

as for the spybot "errors", they're simply an "advisory notification" from Spybot that these setting (part of windows security center alerts) have been changed from their expected/default values.  it does NOT necessarily indicate a problem --- if either you, OR your anti-virus program OR your firewall made these change, it's fine ---- so unless you specifically know something to the contrary, it's best to leave these entries alone. 

Message Edited by ky331 on 10-29-2005 06:34 PM