Initial message prior to infection - Disconnect from the internet before closing this!

There are several ways in which WinFixer can infect a computer. Users using Internet Explorer are most susceptible, although users of other browsers, such as Firefox and Opera can also be infected, but are more resistant to the program.

Typical Infection

The infection usually occurs during a visit to a distributing web site (not necessarily winfixer.com) using Internet Explorer. A message appears in a Dialog Box, asking the user if they want to install WinFixer.

However, when the user chooses any of the options or tries to close this dialog (by clicking ‘Ok’ or ‘Cancel’ or by clicking the corner ‘X’), it will trigger a pop-up window and WinFixer will download and install itself, despite the user’s wishes. Because this is a dialog box related to the Internet Explorer application, it does not appear in the Windows Task Manager list (Ctrl+Alt+Del).

Trial offer of WinFixer

A free, trial offer of this program is sometimes found in pop-ups. If the trial version is downloaded and installed, it “locates” a couple of alleged trojans and viruses, but does nothing else. To obtain a quarantine or removal, WinFixer requires the purchase of the program. Some reviewers believe the alleged unwanted bugs to be bogus, only serving to induce the owner to buy the program.

WinFixer Application

Once installed, WinFixer frequently launches pop-ups and prompts the user to follow its directions. Because of the intricate way in which the program installs itself into the host computer (including making dozens of registry edits), successful removal is a tedious, manual process. When running, it can be found in the Task manager and stopped, but before long it will re-install and start up again.

Firefox Popup

The Mozilla Firefox browser is less vulnerable than Internet Explorer to initial infection by WinFixer. However, once installed, WinFixer is known to exploit the SessionSaver extension for the Firefox browser. The program causes popups on every startup asking the user to download WinFixer, by adding lines containing the word ‘WinFixer’ to the prefs.js file. The prefs.js file is located at:

Windows: C:\Documents and Settings\_username_\Application Data\Mozilla\Firefox\Profiles\_profile_\prefs.js

Linux: ~\.Firefox\Profiles\_profile_\prefs.js

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.

Need an webmaster? Click HERE

WinFixer is a computer program that claims to have the ability to repair any computer system problem. However, due to its regular displaying of popup notifications, dubious installation (installing itself without the user’s permission), and advertisements of other products, WinFixer is generally regarded as a bogus adware program. The popup ads display insistent notifications to convince the user that something may be amiss with the computer, and WinFixer will be able to fix it, for a price.

Due to these problems, WinFixer could possibly be spyware or malware; no authoritative determination has yet been made. However, its misleading popups and forced downloads mirror the “marketing” strategies of many spyware programs. Some computers infected with this program do exhibit sluggish performance.

WinFixer’s claim:

WinFixer 2005 is useful utility to scan and fix any system, registry and hard drive errors. It ensures system stability and performance, frees wasted hard drive space and recovers damaged Word, Excel, music and video files.

In reality, WinFixer doesn’t do any of these things.

Links

Note

Most of these websites are selling products to remove WinFixer. If you intend to buy any of these products, including the well known ones (Norton and McAfee), do research on the products to make sure that they are effective and legitimate. In addition, if you prefer to remove the software yourself, please use the utmost caution when editing the registry values.

Links

• McAfee’s Entry on WinFixer
• Symantec’s Entry on WinFixer and removal instructions
• Spyware Guide’s spyware database entry on WinFixer
• WinFixer Removal Solution from Spyware Database And Removal Instructions
• Information about WinFixer from CounterSpy
• More Removal Instructions from Spyware Removal Guide
• 2-Spyware.com’s entry on WinFixer
• WinFixer/Vundo Relation
• WinFixer Virus Manual Removal - Vundo Variant
• Sysinternals’s Process Explorer

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.

Need an webmaster? Click HERE

Adware or advertising-supported software is any software package which automatically plays, displays, or downloads advertising material to a computer after the software is installed on it or while the application is being used.

An example of mild adware

Well-known adware programs

• 123 Messenger
• 180 Solutions
  • 180SearchAssistant
  • Zango
• Bonzi Buddy
• ClipGenie
• Comet Cursor
• Cydoor
• Direct Revenue
  • Aurora (adware)
• Ebates MoneyMaker
• Gator
• PornDigger!
• WinFixer
• Hotbar

Links

• Anti-Spyware Coalition
• Spyware / Adware Removal Tutorial - Spyware / Adware Removal Tutorial

This guide is licensed under the GNU Free Documentation License. It uses material from the Wikipedia.