WinAntiSpyware removal Instructions
and similar Malware / Adware / Spyware / Viruses / Trojans

SOLUTION FOUND! Please see Update Below!!!

Contribute your experience to our discussion forum! Click here to post something you did that worked or something you did that didn't work! This problem is extremely difficult to deal with, and any contribution would be appreciated! Thanks very much.

UPDATE 19/09/2006: ANOTHER SOLUTION HAS BEEN FOUND!!!

Thanks to mike who contributed his experience in the Discussion Forum, I have found another solution that has worked even more effectively!!! Try this first, if it doesn't work for you, then try the solution in UPDATE: 15/07/2006 Below.

SOLUTION

Download This program by clicking on the link: VirtumundoBeGone.exe [94.7 KB]
Run the program and follow the directions. Make sure you save all your work before!
If the virus is detected it will force you to restart your computer right away.

Thanks to mike again for this solution! I have tested it on my computer and it has completely removed the problem from the boots! Also NOTE: If you have Norton Anti Virus, then you are wasting your resources for no reason! Please download AntiVir, which is a FREE Anti virus program, Uninstall Norton and Install AntiVir. This will get rid of many headaches in the future, and will actually stop viruses!

UPDATE 15/07/2006: THE SOLUTION HAS BEEN FOUND!!!

Thanks to JinxPixie who contributed her experience in the Discussion Forum, I have found a solution that has worked very effectively!!! There are two ways to deal with this, the first is tricky and requires the use of HijackThis, but I wont go into details with this, you can always request this solution if you wish in the discussion forums. The simple solution to this problem is to download a software by Tenebril called SpyCatcher Express which you can get for FREE by going to their website http://www.tenebril.com , or by CLICKING HERE to download the software right away. After installing the software, you should do a system scan. It will detect a .dll file in the System32 folder (the name of which is random, so every case is different). I recommend that you quarantine this file and NOT delete it right away. You will also notice several other programs that the software detects, but your main concern is the .dll file in the System32 forlder, but it is not always clear which one is causing the problem since it will detect several dll files in that folder. YOU DO NOT WANT TO DELETE ANY FILES UNLESS YOU KNOW WHICH ONE IS TROUBLE!!!. Make sure all the suspicious files have the status "ASK" at first, then, while working away on your computer, you will notice that when you open Internet Explorer, or open a new window or popup, the SpyCatcher notification will say that it has stopped the specific file from running. This will insure that the file it has detected is Actually the file causing all these popups. I hope this helps, and if anyone is having trouble with this, or it does not work for them, please make a post in the discussion forum, and I will do my best to help solve your problem as well.

Cheers, and a million thanks to JinxPixie

UPDATE 14/07/2006: I THINK WE HAVE A SOLUTION!!! Check the forums for now, and by tomorrow, if everything goes well, I will post the solution here!!!

UPDATE 29/06/2006: XoftSpy and XoftSpySE DO NOT WORK!!! Dont bother downloading them, they are scamming people into thinking that their software will fix the problem, however all their software does is delete harmless cookies! Don't be fooled by Google Adsence ads, I have tried both XoftSpy and XoftSpySE with the latest definitions over and over again with absolutely NO results!!!

UPDATE 02/07/2006: I have read that these programs use the Vundo Trojan Virus, but I have used every Vundo Trojan remover with no success. I can safely say this these malware CANNOT be fixed by a Vundo Trojan Virus Remover!!!

UPDATE 02/07/2006: Spybot Search & Destroy, Spy Sweeper, Hijack This, Ad Aware SE, Panda Antivirus, and AntiVir (which is the most recommended antivirus program in my opinion) All cannot detect any malware or trojans related to WinAntiSpyware and the other malware mentioned here. As soon as I find the solution I will promptly post it!

UPDATE 02/07/2006: I have tried deleting all the Windows Restore points and disabling System Restore in Windows XP as recommended by some online forums, however that didn't work for me, however you can try it if you don't think you will be using System Restore anytime soon. Be sure to re-enable it though later. System Restore has helped me deal with many unexpected viruses in the past, so it is very helpful!

I am currently looking for a way to get rid of all these spyware, malware, adware, and viruses which are all from the same company! I will post the solution as soon as I find it, so please keep checking this page regularly. Hopefully I will manage to remove this annoying popup, and I will post removal instructions as soon as I have them!

UPDATE 25/06/2005: Newly added System Doctor 2006, yet another malware

Many may have been surfing the net, going through mail, or just working on the internet when a popup like the ones below appear of of nowhere. Adware such as ErrorSafe and WinAntiVirus try to disguise themselves as a windows security prompt to trick people into downloading their software. ErrorSafe, WinFixer 2006, WinAntiSpyware, System Doctor 2006, WinAntiVirus Pro 2006, SysProtect, and similar software are ROGUE anti-spyware programs. They pretends to be a program that will help you fix windows problems, but really it reports false information to try to get you to purchase the program. It is a SCAM.

NOTICE: If your computer has been running slower than normal, it may be infected with Viruses, Adware or Spyware.
WinAntiSpyware can perform a quick and complete FREE scam of your system for malicious programs.
Download WinAntiSpyware FREE now!

NOTICE: You have not completed viruses and spyware scan. If your computer has viruses, spyware and adware trojans, it can cause your private and billing information leaks, unpredictable or erratic system behavior, freezes, crashed or permanent damage to your PC.
WinAntiSpyware can perform a quick and completely FREE scan of your system for viral and spyware infections.
Would you like WinAntiSpyware to scan for and, if found, remove any malicious software not? (Recommended)

WinAntiSpyware will scan your system for threats now.
Please select "RUN" or "OPEN" when prompted to start the installation.
This file has been digitally signed and independently certifies as 100% free of viruses, adware and spyware.

NOTICE: If your computer has errors in the registry database or file system, it could cause unpredictable or erratic behavior, freezes and crashes.
Fixing these errors can increase your computer's performance and prevent data loss.
Would you like to install WinAntiSpyware to check your computer for free? (Recommended)

NOTICE: You have not completed the scan. If your computer has errors in the registry database or file system, it could cause unpredictable or erratic behavior, freezes, crashes.
ErrorSafe can perform a quick and completely FREE scan of your system for errors.
Would you like to download WinAntiSpyware to scan for and, if found, correct any registry problems now (recommended)?

WinAntiSpyware will scan your system for threats now.
Please select "RUN" or "OPEN" when prompted to start the installation.
This file has been digitally signed and independently certifies as 100% free of viruses, adware and spyware.

Your Computer tracked all of your actions and stored the evidence on your hard drive. Anyone could see where you had been on the Internet, The images you had looked at, the sites you opened, the movie you had viewed, etc. We recommend to DOWNLOAD DriveCleaner to erase all evidence you had on your PC!

Once you try to close these popup alert windows you are redirected to one of the following websites below. These sites lie to you and claim that you have any number of infections ranging up to 70 on your computer. The infection detection is of course a scam, however that does not mean your computer is not infected. In fact, your computer is already infected if you get this popup. If using Internet Explorer or other common browsers you will be prompted by your browser to Install the ActiveX control WinAntiSpywareFreeInstall.cab from WinSoftware Corporation, Inc. If this is the case, DO NOT INSTALL THE ACTIVEX CONTENT. Just close the browser window immediately. Make sure you do not download anything from these websites!

MAIN URLS

errorsafe.com
winantivirus.com
winfixer.com
winantispyware.com
systemdoctor.com

SOME COMMON FULL URLS

http://winantivirus.com/pages/scanner/index.php?aid=dn_cl_wav_kw1_ca_en_ed0&lid=keyin&ex=1&p=&ax=1
http://www.winantivirus.com/pages/scanner/index.php?aid=nm_ap_wav_kw&lid=pop%20up&ax=2&ex=1
http://www.winantivirus.com/pages/scanner/index.php?aid=nm_fm_wav_kw&lid=scan%20download&ax=2&ex=
http://winantivirus.com/pages/scanner/index.php?aid=nm_go_wav_r5_us_en_ed0&lid=keyin&ex=1&p=&ax=1
http://winantivirus.com/pages/scanner/index.php?aid=dn_cl_wav_kw1_us_en_ed0&lid=keyin&ex=1&p=&ax=1
http://jp.winfixer.com/pages/scanner/index.php?aid=ic_ban728_jp_ja_lng&lid=728&ax=1&ex=1&ed=2
http://winfixer.com/pages/scanner/index.php?aid=ic_ban728_jp_ja_lng&lid=728&ax=1&ex=1&ed=2
http://jp.winantivirus.com/pages/scanner/index.php?aid=ic_ban728_jp_ja_lng&lid=728&ax=1&ex=1&ed=2
http://winantivirus.com/pages/scanner/index.php?aid=ic_ban728_jp_ja_lng&lid=728&ax=1&ex=1&ed=2
http://winantispyware.com/pages/scanner/index.php?aid=ic_ban728_jp_ja_lng&lid=728&ax=1&ex=1&ed=2 http://www.winantispyware.com/pages/scanner/index.php?aid=vm_md_was512_ed&lid=keyin&ex=1&p=1&ax=2
http://www.winfixer.com/pages/scanner/index.php? aid=gb_ed2&lid=in&ex=1&p=&ax=1
http://fr.winfixer.com/pages/scanner/index.php?p=20&ex=1&ax=2&aid=vm_dw_wfx6h_9_ca_fr_lng&lid=keyin
http://www.winfixer.com/pages/scanner/index.php?aid=mgkron2up&lid=alllids&p=3&ax=0
http://www.winfixer.com/pages/scanner/index.php?aid=mgkron2&lid=RON&ed=2&ex=1&ax=1
http://www.errorsafe.com/pages/scanner/index.php?aid=ap8_ca_en_ed2&lid=rn&ex=2&p=&ax=1&h=
http://www.winfixer.com/pages/scanner/index.php?aid=gb_ed2&lid=in&ex=1&p=&ax=1
http://www.winfixer.com/pages/scanner/index.php?aid=mgkron2&lid=RON&ed=2&ex=1&ax=1
http://www.winfixer.com/pages/scanner/index.php?aid=msg&lid=rd2&ax=0
http://www.winfixer.com/pages/scanner/index. php?aid=mgk2&lid=microsoft&ed=2&ex=1&ax=1
http://www.winfixer.com/pages/scanner/index.php?aid=vm_fm_wfx5h_4&ed=2&ex=1&ax=2
http://www.winfixer.com/pages/scanner/index.php?aid=mgkron2&lid=RON&ed=2&ex=1&ax=1
http://fr.winfixer.com/pages/scanner/index.php?p=20&ex=1&ax=2&aid=vm_dw_wfx6h_9_ca_fr_lng&lid=keyin
http://www.errorsafe.com/pages/scanner/index.php?aid=mgkron2_ca_en_ed2&lid=RON&ex=1&p=&ax=1&h=
http://www.systemdoctor.com/download/2006/index.php?aid=dn_cl_syd_r1_ed2&lid=http&ex=1&ax=1
http://www.winantiviruspro.com/pages/newcontent/?aid=dn_cl_wavna_kw1&lid=