HELP with WinAntiVirusPro 2007!

Forums › Microsoft Windows › HELP with WinAntiVirusPro 2007!

shabba121

17 posts

Geek

#14349 28-Jun-2007 22:30

Hey guys,

I'm having massive trouble with a virus/adware program on my laptop. I'm having pop-ups about WinAntiVirusPro 2007 and WinGuard appear everytime I go online. I have encountered this problem before and used VundoFix to get rid of the .dll files causing the pop-ups. But when I run it this time, it gets nothing and says I'm clean...which I'm not! I've virus scanned with Avast and it too says I'm clean, but when I open IE7, it says it finds 2 Win32:HZS viruses in my temporary internet folder AND my application data folder! These are the only too virus's it finds each time. I use SuperAntiSpyware and it cleans up all the trojans etc that this is causing, then when its done, I scan again to make sure I'm clean. I use HijackThis also, and it cleans up any processes or .dll files that are running. But when I think I've got everything, as soon as I open IE7, or reboot my laptop, THEY'RE BACK AGAIN!! PLEASE HELP ME!! I'm at the end of my tether!

Much appreciated for any help guys.

rscole86

4973 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

#76254 28-Jun-2007 22:39

What is the exact name of the infection?

Googling WIN32: HZS brings up a few results, have you tried following the instructions on the first one?

shabba121

17 posts

Geek

#76256 28-Jun-2007 22:47

The virus's name that crops up is a different numbered version of tmp??.tmp.exe (the ?? being different numbers each time). Theres loads of them and they keep reappearing.

shabba121

17 posts

Geek

#76402 30-Jun-2007 20:06

I'm 1 step away from going mental!! I've used Avast, SuperAntiSpyware, Ad-Aware, VundoFix, FixVundo, HiJack_This v2, Avast Virus Cleaner, AFT Cleaner and FD Fix. They find the Trojans (Trojan.Duncan, eZula etc) and Adware/Malware and go through the process of removing them all. I do this all in Safe Mode btw. I have uninstalled Java completely for the time being aswell. BUT, when I think its all cleared up, I GET THESE GOD DAMN POP-UPS APPEAR about WINCLEANER & WINANTIVIRUSPRO 2007 etc!!! Avast then picks up 2 trojans appearing in my temporary internet files and application data AGAIN!! I CAN'T GET RID OF THIS!! HELP MEEEEEEEEEEEEEEEE!

johnr

19282 posts

Uber Geek
Inactive user

#76412 30-Jun-2007 21:25

reinstall of OS will fix it

tallPete

99 posts

Master Geek

#76435 1-Jul-2007 01:59

I've dealt with this one recently.

WinAntiVirusPro 2007 is indeed a virus. The reason it keeps on coming back I'm afraid is because a rootkit iis installed as well. You can uninstall the WinAntiVirusPro part by simply doing Add/Remove programs, but the rootkit simply redownloads and reinstalls the virus. It also constantly downloads and installs other viruses.

How to tell? The computer I removed this from recently had a hard disk light that was constantly switched on from power up, and the hard disk was always running. Yours is likely to be the same.

2 ways of fixing :

Simple way : Reinstall your OS. Reformat your drive first. This is overkill really.

1. If you are technically competent : Download this : http://vundofix.atribune.org/. Don't bother running it yet.

2. After download DISCONNECT YOUR COMPUTER FROM THE INTERNET BY UNPLUGGING IT FROM THE WALL (the internet plug, not the power plug!!).

3. NOW, RUN YOUR REGULAR ANTIVIRUS FIRST. This gets rid of all the WinAntivirus stuff, but not the rootkit.

4. Run the vundofix you just downloaded. Follow its instructions exactly.

FOLLOW THE INSTRUCTIONS IN THE ORDER ABOVE.

Reboot, and then plug your computer into the internet again. Hopefully you are clean.

Saptha

35 posts

Geek
Inactive user

#76497 1-Jul-2007 18:58

TallPate is right Win Anti virus is a fake anti virus and spy ware + ad ware and all the system notification are all ad's.
more info

i have experienced that some AV softwares are unable to remove system tray notification.

MatDixy

5 posts

Wannabe Geek
Inactive user

#76832 4-Jul-2007 05:32

yes its a rogue antivirus program. follow the procedure mentioned above or download and use "Rogue Remover" from www.malwarebytes.org/rogueremover.php