WinFixer is closely related to Aurora Network’s Nail.exe hijacker/spyware program. In worst case scenarios, it may embed itself in Internet Explorer and become part of the program, thus being nearly impossible to remove. The program is also closely related to the Vundo and Virtumonde viruses. [3] – Note: The database entry for the Virtumonde trojan and WinFixer itself are down as of late February 2006), however, a great number of forum members on on-line technical support forums and blogs believe that WinFixer is associated with the Vundo trojan.

Program Name

Although purely speculative, it seems fairly obvious that the name WinFixer is derived from the old Microsoft Windows abbreviation “Win” joined with the word fixer, thus implying Win(dows) Fixer. Because of the name association with the operating system, a hypothetical situation could occur in which a user may possibly think that they are downloading a Windows related program, when, in fact, they are not.

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.

Remedies

Avoid infection

If the initial dialog box is shown, disconnecting from the internet BEFORE closing it may prevent the download and any infection.

Switching to a different browser rather than Internet Explorer may reduce vulnerability to this and other online Trojan threats. Most malware is targeted at Internet Explorer, and thus is written to take advantages in any flaws and loopholes in its programming.

Blocking the site www.winfixer.com in your firewall will prevent the typical infecting download. However, there may be other ways in which the program installs itself.

Removing WinFixer

It should be noted that besides WinFixer itself, there are several other products to be found on the Web that claim to have the ability to stop and uninstall WinFixer. All users are advised to be skeptical, as many of these ‘solutions’ are themselves WinFixer clones.

WinFixer will prompt the user to purchase a licensed copy of the WinFixer software. Making this purchase may solve the problems caused by the application, without removing it. However, buying the license carries certain ethical questions as it will encourage the creators of the program to continue their operations. In addition, there is no proof that the program works, even after purchasing the license. Some users report that purchasing and installing the Winfixer program causes additional serious operating problems. If you have purchased the program with a credit card many urge calling the credit card to reverse the charge citing fraud.

Symantec has published procedures for removing WinFixer manually. This is a tedious process involving registry editing, which should be done with the utmost care. As of January 2006, the better-known antivirus and antispyware software packages do not detect or remove WinFixer infections automatically. Webroot‘s Spy Sweeper does detect and remove WinFixer; the free trial version of Spy Sweeper will remove WinFixer from memory and from your files and registry.

McAfee’s WinFixer information indicates that WinFixer may be classified as legitimate software, however, McAfee’s Vundo information should still aid in your WinFixer removal process. This removal process makes use of Sysinternals’s Process Explorer (download here) to suspend infected critical system processes. (Vundo is malware intended to automatically install WinFixer on your machine, without your consent)

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.

Need an webmaster? Click HERE

Initial message prior to infection – Disconnect from the internet before closing this!

There are several ways in which WinFixer can infect a computer. Users using Internet Explorer are most susceptible, although users of other browsers, such as Firefox and Opera can also be infected, but are more resistant to the program.

Typical Infection

The infection usually occurs during a visit to a distributing web site (not necessarily winfixer.com) using Internet Explorer. A message appears in a Dialog Box, asking the user if they want to install WinFixer.

However, when the user chooses any of the options or tries to close this dialog (by clicking ‘Ok’ or ‘Cancel’ or by clicking the corner ‘X’), it will trigger a pop-up window and WinFixer will download and install itself, despite the user’s wishes. Because this is a dialog box related to the Internet Explorer application, it does not appear in the Windows Task Manager list (Ctrl+Alt+Del).

Trial offer of WinFixer

A free, trial offer of this program is sometimes found in pop-ups. If the trial version is downloaded and installed, it “locates” a couple of alleged trojans and viruses, but does nothing else. To obtain a quarantine or removal, WinFixer requires the purchase of the program. Some reviewers believe the alleged unwanted bugs to be bogus, only serving to induce the owner to buy the program.

WinFixer Application

Once installed, WinFixer frequently launches pop-ups and prompts the user to follow its directions. Because of the intricate way in which the program installs itself into the host computer (including making dozens of registry edits), successful removal is a tedious, manual process. When running, it can be found in the Task manager and stopped, but before long it will re-install and start up again.

Firefox Popup

The Mozilla Firefox browser is less vulnerable than Internet Explorer to initial infection by WinFixer. However, once installed, WinFixer is known to exploit the SessionSaver extension for the Firefox browser. The program causes popups on every startup asking the user to download WinFixer, by adding lines containing the word ‘WinFixer’ to the prefs.js file. The prefs.js file is located at:

Windows: C:\Documents and Settings\_username_\Application Data\Mozilla\Firefox\Profiles\_profile_\prefs.js

Linux: ~\.Firefox\Profiles\_profile_\prefs.js

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.

Need an webmaster? Click HERE

WinFixer is a computer program that claims to have the ability to repair any computer system problem. However, due to its regular displaying of popup notifications, dubious installation (installing itself without the user’s permission), and advertisements of other products, WinFixer is generally regarded as a bogus adware program. The popup ads display insistent notifications to convince the user that something may be amiss with the computer, and WinFixer will be able to fix it, for a price.

Due to these problems, WinFixer could possibly be spyware or malware; no authoritative determination has yet been made. However, its misleading popups and forced downloads mirror the “marketing” strategies of many spyware programs. Some computers infected with this program do exhibit sluggish performance.

WinFixer’s claim:

WinFixer 2005 is useful utility to scan and fix any system, registry and hard drive errors. It ensures system stability and performance, frees wasted hard drive space and recovers damaged Word, Excel, music and video files.

In reality, WinFixer doesn’t do any of these things.

Links

Note

Most of these websites are selling products to remove WinFixer. If you intend to buy any of these products, including the well known ones (Norton and McAfee), do research on the products to make sure that they are effective and legitimate. In addition, if you prefer to remove the software yourself, please use the utmost caution when editing the registry values.

Links

• McAfee’s Entry on WinFixer
• Symantec’s Entry on WinFixer and removal instructions
• Spyware Guide’s spyware database entry on WinFixer
• WinFixer Removal Solution from Spyware Database And Removal Instructions
• Information about WinFixer from CounterSpy
• More Removal Instructions from Spyware Removal Guide
• 2-Spyware.com’s entry on WinFixer
• WinFixer/Vundo Relation
• WinFixer Virus Manual Removal – Vundo Variant
• Sysinternals’s Process Explorer

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.

Need an webmaster? Click HERE

The advent of online shopping has resulted in the development of a large number of rewards programs that offer rewards for shopping through specific shopping portals. These rewards can be points-based (allowing redemption for various prizes), cashback, airline frequent flyer-miles-based, hotel points, or even donations to charity.

Rewards portals exist in most major markets, most notably in the US, Canada, UK, and Australia. The original loyalty program was started in 1896 by Sperry & Hutchinson called Green Stamps which has been digitized into the new S&H greenpoints.com. In the early 1900s, Carlson Marketing owned a company called Gold Stamps and that has similarly been rebranded as GoldPoints.com. One of the most successful programs that currently exist is called AirMiles out of Canada and, like the old Green/Gold Stamps programs it includes everyday spending in supermarkets.

It is important to remember that, with the exception of cashback rewards, each rewards program values its points differently: before consumers purchase through one of the point- or mile-based programs, they should compare the points they will earn with the specific reward they choose. In addition, because of the highly competitive nature of online commerce, many of the shopping portals offer coupons or discount offers not available if purchases are made directly through the merchant site: besides receiving points towards a reward, consumers can also save money up front.

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.

Need an webmaster? Click HERE

Loyaltyware is a sub-category of adware. It works around the notion of user “loyalty” by providing incentives in the form of cash, points, airline miles, or other type of goods while shopping. Examples include WebRebates, Top Moxie, and Ebates Moe Money Maker.

Links

• Spyware Guide: LoyaltyWare

Need an webmaster? Click HERE

Application

Adware is software integrated into or bundled with a program. It is usually seen by the programmer as a way to recover programming development costs, and in some cases it may allow the program to be provided to the user free of charge or at a reduced price. The advertising income may allow or motivate the programmer to continue to write, maintain and upgrade the software product.

Some adware is also shareware, and so the word may be used as term of distinction to differentiate between types of shareware software. What differentiates adware from other shareware is that it is primarily advertising-supported. Users may also be given the option to pay for a “registered” or “licensed” copy to do away with the advertisements.

Controversy

There are concerns about adware because it often takes the form of spyware, in which information about the user’s activity is tracked, reported, and often re-sold, often without the knowledge or consent of the user. Of even greater concern is malware, which may interfere with the function of other software applications, in order to force users to visit a particular web site.

It is not uncommon for people to confuse “adware” with “spyware” and “malware”, especially since these concepts overlap. For example, if one user installs “adware” on a computer, and consents to a tracking feature, the “adware” becomes “spyware” when another user visits that computer, and interacts with and is tracked by the “adware” without their consent.

Spyware has prompted an outcry from computer security and privacy advocates, including the Electronic Privacy Information Center [1]. Often, spyware applications send the user’s browsing habits to an adserving company, which then targets adverts at the user based on their interests. Kazaa and eXeem are popular programs which incorporate software of this type.

Adware programs other than spyware do not invisibly collect and upload this activity record or personal information when the user of the computer has not expected or approved of the transfer, but some vendors of adware maintain that their application which does this is not also spyware, due to disclosure of program activities: for example, a product vendor may indicate that since somewhere in the product’s Terms of Use there is a clause that third-party software will be included that may collect and may report on computer use, that this Terms of Use disclosure means the product is just adware.

A number of software applications are available to help computer users search for and modify adware programs to block the presentation of advertisements and to remove spyware modules. To avoid a backlash, as with the advertising industry in general, creators of adware must balance their attempts to generate revenue with users’ desire to be left alone.

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.

Adware or advertising-supported software is any software package which automatically plays, displays, or downloads advertising material to a computer after the software is installed on it or while the application is being used.

An example of mild adware

Well-known adware programs

• 123 Messenger
• 180 Solutions
  • 180SearchAssistant
  • Zango
• Bonzi Buddy
• ClipGenie
• Comet Cursor
• Cydoor
• Direct Revenue
  • Aurora (adware)
• Ebates MoneyMaker
• Gator
• PornDigger!
• WinFixer
• Hotbar

Links

• Anti-Spyware Coalition
• Spyware / Adware Removal Tutorial – Spyware / Adware Removal Tutorial

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.