"WinFixer" (AKA
"ErrorSafe") Should Be Called "WinTrixer"
All Versions of Windows - All Versions of Internet Explorer
NOTE WinFixer 2005 is now called WinFixer 2007. Same old, same old though. Beware
We've recently (and unfortunately) stumbled upon another Internet scam, this one called "WinFixer". Rarely have we encounter such a misleading advertisement or a more persistent attempt at installing software without meaningful user consent. Below are some screen caps taken during our encounter with "WinFixer" and if you encounter these you'll have a hard time stopping this cycle of events which, if you are not careful, could leave you infected, with changes made to your system that you do not want and which maybe hard to reverse.
Trickery Part One:
Notice in the screen cap above, it appears to be a Windows warning that something is wrong with your computer. If you click "OK" WinFixer installs, if you click "Cancel" you see the following :
(Click on image above or
here to see full-size
image)
Notice, there is no "Cancel Button" and no "X" to close the window. And whether or not you "Click Here" (the red button) WinFixer/ErrorSafe will try to install from this dialog without any user intervention. Those of you who have wisely updated your Windows XP systems to Service Pack Two will receive an "Active-X" warning and the file will not auto-install. Those of you using Windows 98/ME/NT/2000 may not get any warning at all. The ONLY way to get rid of this window is by pressing the ALT plus F4 keys. And, if you do that you'll get the following -
Notice there is NO cancel button, but there is a "X" (Close dialog) at the top right. However if you click the "X" the dialog will close and bring up the following dialog and the entire cycle will start all over again.
In order to safely escape from this scumware attack you should hit CTRL-ALT-DELETE, and close all instances of Internet Explorer. Otherwise you're liable to be caught in a never-ending loop and be tempted to install the software just to get out of it.
WinFixer's (ErrorSafe) license agreement is perhaps one of the worst we've ever seen. You can read the entire license agreement (safely) by clicking here.
In a nutshell, by installing WinFixer/ErrorSafe you are agreeing to allow this program to uninstall any software on your computer that WinFixer/ErrorSafe deems incompatible. Obviously if you have anti-spyware installed, it may be removed by WinFixer/ErrorSafe since anti-spyware software will certainly be "incompatible" - indeed most anti-spyware will remove WinFixer/ErrorSafe, unless of course, WinFixer/ErrorSafe removes your anti-spyware and other security software first. What is it? A race against time? You have no recourse if you install WinFixer/ErrorSafe because by installing this software you are legally bound to abide by its license agreement. In other words, even though you may have installed this software without your consent or even knowledge, you are still legally bound by its license agreement. What's wrong with this picture?
Most all popular (legitimate) anti-spyware programs will remove WinFixer/ErrorSafe. Here's how PestPatrol describes WinFixer (known subsequently as "ErrorSafe"):
"Based on eTrust PestPatrol® Spyware Scorecard v2.05.03, WinFixer violates the following criteria: First, Installs itself or any other item without user permission or knowledge, at time of installation. WinFixer was installed through social engineering techniques upon visiting www.600pics.com--using confusing ads and uncloseable messages. Second, Displays popup/popunder ads that are displayed when main product is not running or do not appear to be connected with the product. After installation, WinFixer began to run automatically. I closed it, but not long after it opened again with an alarmist message saying my system had 1755 'Severe System Threats.' Upon reboot it shows the same adware."
Counter-Spy Says:
"Threat:
WINFIXER
Threat type: Potentially Unwanted Software -
Advice: Remove
Threat risk: High Risk
High risk threats typically are remotely exploitable
vulnerabilities, which can lead to system
compromise. Successful exploitation does not
normally require any interaction. May open up
communication ports, use polymorphic tactics,
stealth installations, and/or anti-spy counter
measures. May use a security flaw in the operating
system to gain access to your computer.
Description: WINFIXER is known to be installed
through inappropriate bundling and without users
consent. It is a software that scans the users
system for damaged files and attempts to fix it if
the user pays a fee."
It's bad enough that WinFixer/ErrorSafe installs (or attempts to install) without informed user consent. It's even more unconscionable that these programs will actually charge you $39.95 as well. When WinFixer/ErrorSafe are installed (either intentionally or unintentionally) they will inevitably find many so-called "system errors" which of course the user will want to fix. In order to fix these so-called errors, WinFixer/ErrorSafe requires you to pay $39.95. That notwithstanding, WinFixer/ErrorSafe will display advertising on your computer even when they are not running, they can add any web site they desire to your "Trusted Zone", they can uninstall any software that you install or have installed on your computer; in essence these programs are definitely not something you want on your computer, in our opinion (and apparently in the opinion of many anti-spyware sites and programs).
Our Advice
AVOID WINFIXER 2005
(ErrorSafe). Be cautious about how you close their
ads if you should encounter them. Please re-read our
advice above as to how to deal with the advertising
loop that closing the first "WinFixer 2005" (or
ErrorSafe) dialog initiates.
Registry Mechanic
- A Cloudeight Endorsed Product
(Advertisement)
Download A Free Trial of Registry Mechanic by PC
Tools
With Registry Mechanic you can
safely clean, repair and optimize the Windows
registry with a few simple mouse clicks! Problems
with the Windows registry are a common cause of
Windows crashes, slow performance and error
messages. By using a registry cleaner regularly and
fixing registry errors your system should not only
be more stable but it will also help improve your
system performance without expensive hardware
upgrades.
Download A Free Trial of Registry Mechanic by PC
Tools
Registry Mechanic uses a high-performance detection algorithm to quickly identify missing and invalid references in your Windows registry. These problems can occur for many reasons including being left-behind after the un-installation or incorrect removal of software, by missing or corrupt hardware drivers, or orphaned startup programs. Download A Free Trial of Registry Mechanic by PC Tools
With a few easy steps Registry Mechanic will scan your entire registry for any invalid entries and provides a list of the registry errors found, you can then choose to selectively clean each item or automatically repair them all. For your convenience and protection Registry Mechanic can also make a backup of any repairs made so that you can easily recover any changes if required. Try it free now! Download A Free Trial of Registry Mechanic by PC Tools