Remove UACINIT.DLL Webfixer Trojan Rootkit

You may find that you have malware called Webfixer or WinAV on your PC.  This is a tough one to remove as it disables antivirus and antispyware and malware tools like McAfee Virusscan and Malwarebytes Antispyware.  To remove Webfixer or Winav.exe for free you will need to use a quality tool like Malwarebytes Antispyware which is a tool that is free if you don't mind running it in a mode that is not automatic.  For free you can run Malwarebytes Anti-Malware and update it and run scans which will remove Winav and Webfixer.  For free however Malwarebytes Anti-Malware will not run all the time automatically but for just $24.99 you can purchase the licensed version which will provide active protection from spyware and malware.  I'm not here to sell you this product.  Only to tell you how to remove Webfixer and UACINIT.DLL for free.  This helpful tip is supported by the sponsored ads not from any sale of Malwarebytes Anti-Malware.  Enjoy the free software, you can get it at

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button

You may find that you cannot run or install MalwareBytes.  Try this to get it installed or running.  If you have Malwarebytes installed rename mbam.exe to a.exe and run a.exe to start the program.  You should then be able to run a scan and clean.  Once Malwarebytes Antimalware cleans what it can you'll find that c:\windows\system32\uacinit.dll remains and you cannot delete it.  Malwarebytes will say it will delete it but it keeps showing up on later scans.  Here's what I did to get rid of it.

Boot to an environment not your own like a BartPE bootable CD.  Or you could slave the drive in another PC.  Then in DOS go to c:\windows\system32 and type dir uac*.* and delete any files that start UAC

Because this also runs as a driver you need to also go into c:\windows\system32\drivers and do a dir UAC*.* and delete any files starting with UAC.

Once I did this I restarted normally and my McAfee ran properly and I could now operate my PC normally.