WinAntiSpyware removal

Name: WinAntiSpyware

Belongs to Adware

Also known as: Winfixer

Created by WinAntiSpyware

Remover: SpywareDoctor

WinAntiSpyware is related to Adware. Some people are nervous about adware, some do not pay attention towards it. Most internet users are unaware about how adware really works. Firstly, it gathers data about surfing history, sends the file with the data recorded to parasite producer database. After that you get ads (pop-up, banner) related to your browsing history. By performing mentioned actions, adware spreaders try to lead you to make a purchase.

Scan your computer now for free with SpywareDoctor:

· Possible pop-up ads display, search redirects

After booting up Windows a WinAntiSpyware popups appear. Add/Remove Program is incapable to repair this problem.

Follow these steps to remove WinAntiSpyware

• This guide fits for Windows 2000 and XP versions. Firstly you have to create Hijackthis log (how to create hijackthis log).
• The www.spyware-removal-guideline.com crew is not responsible if the following actions are performed incorrectly.
• Locate O2 - BHO: MSEvents Object line in the log. If such line is not found terminate reading this paragraph and jump to Manual WinAntiSpyware removal on the bottom of the page.
• O2 - BHO: MSEvents Object is the line where WinAntiSpyware is hiding. Whole line should look like this O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\system32\aabbc.dll, but the {827DC836-DD9F-4A68-A602-5812EB50A834} and C:\WINDOWS\system32\aabbc.dll parts can be different from the lines you can see on your log file. All you have to do is write the second part (C:\WINDOWS\system32\aabbc.dll) down and use it INSTEAD of C:\WINDOWS\system32\aabbc.dll in the future
• Download VundoFix.exe here on desktop and run the file to extract VundoFix. All extracted files will be located on the desktop.
• Reboot the computer into safe mode.
• After computer is booted up, go to VundoFix folder and run KillVundo.bat file. First a caution window will appear - press "Enter". Further you will be asked to enter the line that you have written down in the third step. After the line is entered press "Enter". A message "Please type in the second filepath as instructed by the forum staff" should appear.
• Now type the same line as you did before, but the "aabbc" part (you have to use your own discussed in third step) writing in reverse order - "cbbaa" and replacing "dll" extension with *. So the final line will look like C:\WINDOWS\system32\cbbaa.* Press "Enter".
• Finally HijackThis will be launched automatically (if not - start it manually). After scan if you can locate lines
  O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\system32\aabbc.dll (file missing)
  O20 - Winlogon Notify: C:\WINDOWS\system32\aabbc.dll (file missing)
  Check them and press "fix checked".
  ATTENTION! the C:\WINDOWS\system32\aabbc.dll part on the both lines has to be the same as you have written down in the third step.
• Reboot the computer
• write to us webmaster@spyware-removal-guideline.com and tell how did you succeed.