This is a very short story on how to delete annoying virus and spyware – winivstr.exe.

A few weeks ago in my company we had one computer infected by email from “Fedex”. A virus was zipped, attached and emailed to one of our employees. Of course he opened the email from Fedex and even decided to execute .exe file in attachment… Yeah.. “Shit happens” you would say.. True. But I had to deal with it!

The first indication of this type of spyware is a small red icon in your tray with this message:

Your computer is infected!

Windows has detected a spyware infection! It is recommended to use special antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you.

Click here to protect your computer from spyware!

So, if anybody has this problem – you are more than welcome to read my small manual on how to remove virus winivstr.exe, braviax.exe, buritos.exe etc. from your computer.

Basically the solution is very simple – you have to remove these files from your system. Have you tried yet? If yes – you probably noticed that they are back after a while.. I did the same thing. I also tried to install several antiviruses, including free anti virus Avast, and free Windows Defender, and honestly nothing helped (maybe I didn’t search very well).

I found two ways of removing these viruses:

1. Restart your computer and start Windows in Safe Mode (hold F8 right after restart)
2. Search your disk C:/ (your system disk with Windows on it) for these files:
   • braviax.exe
   • beep.sys
   • buritos.exe
   • winivstr.exe
   • karina.dat
   • delself.bat
   • *.tmp (c:/windows/temp) – all temp files from temp folder
   • ntos.exe
3. Delete all of them except file beep.sys – which you have to replace with the original file (it can be found on Windows installation CD or your friends computer ).
4. Go to menu Start -> Run Program and enter “regedit” to open Windows Registry Editor
5. Now you need to search for all occurrences of files winivstr.exe, buritos.exe and others from the list above (Press CTRL+F when you are inA? Registry Editor). Remove all records you can find.
6. This should solve the problem. In order to double check, you can still run “msconfig” (From menu Start->Run program) and see if you dont have anything suspicious in “Startup” tab.

Additionally I was also able to get rid of annoying pop-up window in the windows tray, by simply replacing infected files with empty files (0 bytes) with the same name. I assume, this spyware checks if file exist, then its not creating another copy of it.

Hope this will help someone.

P.S. Any other ideas will be appreciated.