A Revolution is the Solution
Some fishy stuff about these guys. Doing a little snooping, seems they're also related to www.winantivirus.com, and they're "affiliate distribution site" is www.softwareprofit.com. Also, have a look at the contact info in any whois list: 555-123-1234.
As for how it came in, maybe through the recently-discovered Remote Desktop vuln?
Listen...software like this just doesn't "magically" install itself...you MUST have signed a EULA and stated you wanted this crap on your system...
And if you didn't a EULA you can't read is proper notice...right????
Erm..sorry...reading up on Eric Howes take on Goldman's view of proper disclosure has me a tad annoyed :P
And downseek.com has a winfixer listed on their site as a downloadable app.
to get this thing to install, you do have to agree to it - my beef is the incredibly "round the houses" view they take of what resembles "consent". my biggest issue here is how a popup advertising something managed to spring up on a PC that had no holes, no problems and (more importantly) nothing at all lurking in the background.
Totally nuts.
No I agree PG. It is, perhaps, my largest beef with the majority of suspect companies at present. Their EULA, what they consider to be consent.
It is why I get very, very much so into debate mode when someone states that it's the "users fault" for agreeing to an EULA.
If a user is to be held liable (as is the defense for crapware companiess) for agreeing to a EULA, the company should be held liable for a suspect or faulty EULA...
Erm...I'll stop ranting afore I get going. As to the page...any clues yet as to where you took the hit from?
all i have is the URL in the initial "install me now" page. but this IE window just opened up out of nowhere, with nothing actually being done on the PC at the time.
now when this happens, there *has* to be something running in the background to make this kind of activity happen. problem is, i just don't see what it could have been. anybody got a medium handy?
What utilities do you have monitoring the various processes that are running?
tons of stuff including some that i can't mention, but trust me when i say every last aspect of the system is monitored. i'm starting to think that maybe this particular box *did* have something lurking somewhere, the pc got cleaned out....or so we thought, and a "hidden entity" was lurking in the woodwork. either way, i'm glad it happened because i love little finds like this.
Wait, you can't mention!! Gimmie!!!!
As you find things out, put them up dernit! I'm a bit interested! Yes, I like digging
heheh, well i have the standard registry monitors, packet analysers and a whole bunch of other stuff. i cant remember the names of most of these things as i've just used them for years without actually bothering to find out their names (oops)...but this does give me an idea.
A couple of articles on the spyware / adware analysis process i use?
Yes please...
we must absolutely hit them personally and phisically. I will never stop saying this. I live in italy, sadly none of those sukers seemsto be from around here. But if we HURT THEM, they will most definitely stop it.
PG, I've had this Winfixer pop up when trolling at iowerestling.com. It seems to be part of a package deal along with a xxxxload of crapware, including nail, elitebar, IBIS, etc. I kept closing the pop-ups and never let it install.
I really don't see the big deal with EULAs and "consent". Are they really the issue here? They're just used by these companies to justify the distribution of crapware, which has no ethical reason to exist anyway.
the tale of PG
and the amazing popup of doom
wow mate you do get them dont you
but then with Nail involved there's no way to tell who's shoving this rubbish
EULA's are legally binding agreements between yourself and the software vendor. It is what several rogue companies utilize to try and claim legitamacy, despite the fact that their EULA's are greatly lacknig and/or misleading.
But, if the EULA's are done correctly, they protect legit companies as well as the consumer. The problem we're seeing now, is that EULA's are really only being enforced one way...onto the consumer. It is becoming quite frequent to read an interview where companies claim "proper notification" was given, when none was.
If a company is utilizing this as a leg to stand on against consumers, we should be pushing back via the same avenue. We can easily demonstrate poor business, if not deceptive, business practices through several of these rogue companies EULA's...and/or how they display or do not display them.
If attacked in this way...things like, defining spyware, and the like become a non-issue. As we can use the precedent of a standardized EULA and how it should be displayed and interacted with to demonstrate poor neglient/bad/deceptive business practices.
winfixer IS installing itself automatically even if I click the close (x) box in the upper right corner.
This install does seem a tad-bit fishy to me as well. Those two websites that were mentioned in the first comment on this page are now marked as known mal-ware and spy-ware installation sites, by Microsoft and others.
You're also right in that it shouldn't just appear on a desktop on a computer with a firewall, anti-virus and everything else up to date. Something tells me that someone hacked your computer and was using it as a zombie machine.
Winfixer pop-up comes up automatically as I start IE6 - and there's nothing in ad-ins for the browser... but I have Google as my home page.
Funny, when I change my home page to something else, no WinFixer... surely, not... not Google, is it?
Nothing I have removes this twirp! Notwithstanding, I did NOT permit it; it just zapped up and installed itself (well ... almost) because it's not visable enough to uninstall (no uninstaller) and attaches itself in the area of system files so it can't be removed. The shortcut can be wiped from the desktop using GovWipe; but the executable can't be deleted and this garbage regenerates on startup. My productivity level is at zero because of this tourd!Anybody have a removal tool or know how to zap this buzzard into cyberspace to funeral it?
Any help welcomed as I'm updated on everything, ports supposedly shut and it still creeped into a crack. Thanks!
I've got it, too. been working on a solution for a few weeks now. tough.
The EULA agreement is considered fulfilled when you simply open their web page. read it there. I e-mailed same, said I repudiated their EULA, now how do I get your stuff off my machine?..No response. The Cert. that wants to own you is issued from:
https://www.verisign.com/rpa
VeriSign Class 3 Code Signing 2004
__Software Development1_0___U____Vantage Software, Inc.
The winfixer phones are:
Toll-Free: +1.(800) 755-5909 (USA / Canada) (9 am - 5 pm EST, Monday-Friday)
Phone: +1.(202) 904-2212, +1.(519) 488-5191
I haven't tried calling them. There are many people getting this problem, multiple OS types attacked. It may be a proggy that imitates the real winfixer, made by a disgruntled hacker, but I don't think so
It seems that a parallel OS install, then wiping out the old OS is what I will do. I hate MSIE anyway. This does not happen when I use firefox (mozilla). keep searching on "winfix popup" "winfix virus""winfix removal" etc. until you see some similarities with files on your system. good luck to you guys, if anyone nails this one please let me know
I just read a report from a user who got a Winfixer infection after downloading IE 7.0 beta - probably illegally. Beware.
I tried the number. The recording says, "I'm sorry. No one answered your call. Please try again later." How can one sue these jerkoffs?
your right abbout this because this popup came to me also i donno how it just keeps coming and shows me a fake image scan and trying to force me to download it slowed down my pc because of all this spam glad i removed it 
I've been getting those pop-ups since for ever....
wait a sec I just got it AGAIN. Hopefully someone will be able to sue these people for forcing unwanted software on others, let alone infected/faulty software.
No...I say better yet, BURN THEM. >
Sure am glad that I found you guys. My daughter and roomate are not savy enough and thought winfixer was a program I wanted.
Even though I did not pay for it I am having trouble unistalling it. It keeps sending me to their website automatically...wanting to know why I want to unistall.
I have not filled out their questionairre as I suspect that may cause me to have to give them my first born or........
I am sure this is a malware, but anyone knows how to remove it and prevent it from installing in the future?
Am trying to get rid of last 2 days .. It is like Hydra...comes back ..more ugly
Hi i am italian.
How i can remove this pop_up winfixer 2005?
I called the 488-5191 number. So happens that this number is located in the city that I live in. There was a women's voice giving some message about higher than anticipated volume of calls leave a message or e-mail us. I left my number and said call me back or I will come and visit you. Let you all know what they say. Later
Jeff
How do I get rid of this piece of crap. IT won't go away. It keeps popping up even when my browser is closed. I about to wipe my machine, it's that annoying.
Its not going away... nasty one... anyone knows a fix?
Piece of crap is a euphemism for this stupid winfixer. I hate the mother f***in' thing!
Want to install? No. Then you get 3 other boxes to hit cancel. Then another page comes up that you have to close. Then the whole thing comes up again.
I'm going to find a contact number and tell them to kiss my f***ing ass!
Fuck the american capitalist system!!
I live in Australia and I have to run the following programs each day:
AdAware
SpyBot and
CyberScrub.
WinFixer has raken over my computer and no one seems to know how to completely remove it, and no matter which button I click on the damn pop ups, it still starts to download. HELP ME PLEASE.
I'm going crazy watching these fake errors on my PC
this winfixer problem seems to annoy me as well. At first i thought it was just an annoying pop up that had somehow infected my internet. However i managed to stop it popping up for a few months by just putting www.winfixer.com into the restricted sites on my internet explorer. However now i get a new "winantispyware" pop up and this seems to evade the restricted sites thingy.
So obviously it and winfixer are joining together as one to destroy all mankind?
Anyone got any ideas how to destroy these ugly ****ers?
If I format my PC winfixer pop-up is removed ?!
Hello! the winfixer problem is here in argentina too. I don´´t know how to smashing it. I think that crap is the worst of the worst. and I thing is somethin of MicroBill for pirate versions of WINDOWS. please help!
i went onto cheatcc.com and got that pop-up after going through to the pc games... any help?
I stumbled upon it by trying to find Symantec... made the mistake of spelling Symantec wrong.... this installs itself simply by foolishly launching http://www.symantic.com...
www.winfixer.com virus is one of the worst I've seen. It's the first virus that I've had since windows 95 years ago, where i've had to study the registry with hijackthis.
I've complained all over the place about winfixer.com. They are a blatant virus.
Try Adaware, spybot, ewido, hijackthis, and if worse comes to worse, visit www.tomcoyote.org. They seem to know what to do.
What really gets up my fingernails - as well as all the other stuff, is the little icon of a framed 'spanner'. ("Spanner in the works". Geddit?)
Microsoft actually helped me remove Winfixer. They put a file msnut.dll (something like that) in a system folder that is in use as soon as Windows is opened. We booted from a CD to prevent Windows from loading and removed the dll.
explain in more detail please lee
What I don't get is how this thing got on my computer.
I didn't get the pop up untill today. The most recent thing i've installed was World of Warcraft last night.
Annnnnndddd, I havn't visited any "naughty sites" in the last 3 days.
This is a joke, almost everytime I go to Google or Drudge Report it hijacks my browser.
The people that make this shit need to be dragged in the street and shot.
Mine came from limewire.
I absolutely have no idea how this winfixer crap came on, I keep record of everything typed and clicked and visited! It just appeared, my recent activity around the time I received this winfixer pop up fake warning or error was this: I visited and installed a web tool (I even uninstalled the web tool I had just to see if that was it, but I still receive the pop ups anyhow), I checked my email, and had to visit a decent site for link exchange, then later that day winfixer popup! It is either coming from the software installed, or from some unusual websites. Its odd, cause if I check the same email i read last time it, or visit the site which I exchanged links with, winfixer suddenly pops up. Though I've also done absolutely nothing at times just staring at my pc and boom, it pops up with winfixer! I'm gonna take some screen shots of the whole win fixer process, I wanna sue these guys reallll bad! I'll see what I can do to get enough proof or to atlease get rid of this crap. You know after it popped up, my pc began to act the way they said it would, u know, pc freezes, etc! I have never, ever, ever had that happen ever before until after they attacked me with that pop up, and what the hell is symantec doing about this?! I'm suppose to be protected from crap like winfixer and stuff!
What i found so far is, it's not à Virus ...
Try the on-line scan of the Kaspersky anti-virus tool. He'll tell you ... but that's it. He won't remove it.
I am now stock to this stage ...
If anyone can get any further, let everyone know about it, please
Yea, my P4 feels slower than my P2, its getting slower and slower, im seeing different ones like trafficexplorer.com and shit like that kpsn.com or something too, this is getting out of hand, if someone doesnt find something soon, im gonna let the ship sink and get off, format the bastard.
just keeping this alive, ive been scouring the internet to find solutions to this, and have no luck. Does anyone know if norton or mcfee have said anything about this?
It tried to install itself onto my computer when i did NOT agree to download it. The only reason i am not infected with this crap is because i had Task Manager running at the time.
Cancel button will not pause the download, but deleting the process seemed to work fine. Currently running through the system in the morning and i have found a few problems with my computer because of it (like half a million reg entries so the damn thing cant be deleted easily, keeps trying to re-download)
Okay its fixed now. You wont be hearing from me again unless it comes back and i re-search via google.
Whatever this is, it is DEADLY by the look of things. Glad i had task man up at the time ^_^
Rai, what did you do to remove it - I'm desperate to get rid of the creeper - thanks!
Damn thing's annoying...
came across this last night, but haven't had time to try it. the forum i found it on at Dell.com spoke highly of it.
good luck.
http://www.spyware-removal-guide...infixer-
removal
Yes indeed, WinFixer is a scam. Computer users beware. I first acquired this virus/malware/spyware when a pop-up that appeared to be a genuine Microsoft pop-up stating that there were problems with my registry. I try to close out the pop-up, but instead clicked on it by accident, and it downloaded itself onto my computer.
Here are some instructions to get rid of it:
I first tried to remove this program in my Control Panel under the option of Remove/Add Programs, however, after you reboot, the WinFixer program continues to come back even after you think you have removed it and all of its components. This is a sign that this is a malicious spyware or virus if it continues to keep reappearing.
The solution that worked for me was to download (if you do not have it already) HiJack This, which is a free program that you can download from Download.com
What you need to do is run HiJack This, and review the log - you will then delete the one file/program that says WinFixer. Once you delete in in HiJack This, it will be gone forever! When you reboot, it will no longer come back!
Hope this helps!
Sara
Edit/Delete Message
Nothing works! I had Task Manager running, the browser popped up when I was visiting GameFAQs, and I hit the x on the pop-up. The pop-up closed, but the installer one opened up, so I hit the x again. Nothing. I hit alt-F4. Nothing. The only thing that worked was closing it in the Task Manager, and then when I started my computer up again, the pop-up was back, and it finished before I was able to close it in the Task Manager. So then I cleaned my registry, then ran Ad-aware, and Shaw Secure Anti-Virus and Anti-Spyware. Then I turned my computer off to check to check, and when I logged back in I had nothing out of the ordinary on my system. Then today, there was a power outage, and when I logged in again, WinFixer was running again, and suspicously I had exactly 389 errors.
Coincidence? I think not!
Go to the following URL at "PC World Magazine"...
http://www.pcworld.com/
downloads...lid,1347,00.asp
Download "Ad-Aware SE Personal v1.06" and run on your computer...
That's how simple it is! No more "Winfixer" and no more tedious HJT logs and analyses...
Joe
I just had it poop up after visiting a site which I was given a link to. Pretty dumb of me but meh. I have a security fortress. I hunted the beast down and nuked it. My friend has it on his computer but he wont let me delete because he says he loves it too much.
But yep
I'm more curious as to how it got on my machine. The only program I've installed lately was an updated version of WinAmp... could it be? Say it ain't so!
What we have to realize is that 389 is a prime number, not factorable, fixed and not removable; and lives immortally between its protective neighbor primes 383 and 397 
** but WinFixer is seeing its final days soon **
I tried just about everything I could to get rid of this, including Norton, Housecall, Adaware, and SpybotSD... none of them would work. Tried them in safe mode as well. Nada. This just kept coming back. I just tried Spy Sweeper though and it seems to have worked. 1 hour now with no pop ups... I guess time will tell.
Well... time told alright. Still here.
I too have tried everything. I don't think the actual winfixer program was installed but I keep getting popups to other sites and once in a while the winfix install page pops up again. I've tried AdAware, Spybot, SpywareBlaster, HijackThis. Before infection I had all updates (running XP), SpySweeper running etc. Never have had a problem in almost a year. I cannot find any rogue processes, files, anything. My only option is to reformat. :o
Finally a lead. I ran the latest CWShredder and it detected the Look2Me virus which causes popups. At least now I have something to look for!
still can't find anything to remove look2me virus (cwshredder removes it but it comes back instantly)
pretty sure i got it from winamp.
MAKE IT STOPPPP
i got it when i was clicking on something in a yahoo fantasy football league...i don't think i accidentally installed it, but i could have. it still pops up all the time and i get some popup about planes or something too.
I have this too! This thing aggrevated me for 4 days. I also don't know where it came from and I can't get rid of it. I saw a suggestion about HiJack this has anyone else tried it???
(sry thats just 'me site) I have been being harrased by winfixer, I'll do a google search for something and the winfixer bull crap alert will come up. I press CANCEL CANCLE CANCLE!!!!! but then it takes me to the winfixer download page and starts downloading. I have to use the task manager and "end task" 3 or 4 times. Somebody help me out! Its really frigging annoying! Yar!! I got termites in 'me leg!
-jake
yeah this things gay... i have had it for like a week and im going pretty slow...im looking at a list of crap in hijackthis. what is the program called exactly? i cant find the right one
hello my name is Joshua and i have winfixer.
i've tried Ad-Aware, Norton, AVG, Hijack This (i don't know what fuckin' file to look for nor delete, as none of them are explicitly labeled "winfixer", as Sara up there claimed), Command Anti-Virus, SpySweeper, and SpyDoctor.
nothing has worked so far.
i think it's time to reinstall Windows once again...and lose all my precious, precious mods.
DOES ANYONE KNOW HOW TO STOP THIS THING!?
TELL US!
if you go to google and search for "winfixer" there are a few results on forums where people have posted their hijack this logs. if you know what you're doing, or you can get help from someone else, it looks like you can get rid of winfixer with hijack this...but it requires lots of steps
i for one am too lazy to do that and i just want someone to make me a damn fix 
come on adaware and microsoft antispyware what do we pay you for??? or wait..
good news guys!
the newest version of AdAware detects and successfully deletes Winfixer.
download it NOW.
furthermore, i have some links for you lucky bastards
you can thank me later.
http://forums.us.dell.com/
suppor...rd.id=si_hijack
if you create an account here and send them your Hijack This log, a qualified technician will promptly respond.
i was serviced in under an hour.
so...yeah...go to download.com and get the NEWEST version of AdAware and Hijack This, and you'll be fine.
oh, and you're welcome.
-JRD-
has anybody tried these http://www.spywaredb.com/remove-...emove-winfixer/
winfixer removal instructions?
Good god, how many entries does this page have?!?
Anyway - try what Joshua said. Download the latest Ad-Aware. It really does kill this sucker.
adaware didn't kill it for me...
Did as joe suggested and went to http://www.pcworld.com/downloads
Then downloaded "Ad-Aware SE Personal v1.06" and run on your computer...
When loaded deep scan your pc, the Winfixer garbage will show up and then you can quarentine this nasty little #*&$. I did it about 4 hours ago and so far (!) it hasn't appeared again.
Good luck everyone,
Christine
I had Winfixer, I deleted it while running in Safe-mode, then used Regedit to remove its Local_Machine/Software/Microsoft/Winfixer registry key.
THIS IS THE MOST RETARDED AD EVER. i have ran atleast 5 different spyware/adware remover programs, and it STILL keeps popping up! what should i do?
lol, I found this page looking for a solution. Ad-aware, Spybot, Trendmicro all still haven't come up with a solution.
Have you guys tried the latest Ad-Aware? it seems to be doing the job...
I've just done a 'winfixer' search on google and I stumbled across this discussion. I haven't experienced the same symptoms as what you guys have, but I have recently detected 'winfixer' during a routine spyware scan with AOL's anti-spyware scanner. Ironic that AdawareSE, Spybot S&D and Microsoft's anti-beta didn't detect it, though. I'm a bit paranoid as to how it suddenly appeared on my system. :- Have you guys discovered anything more about the application, and how it is being distributed?
I've noticed that people are stating geographical locations to gauge its spreading. I'm from the UK.
All previous comments about the winfixer invasion was reasoned, cogent, intelligent, and reasonable. My approach to these assholes is entirely different: they should fuck off and be incarcerated.
Ive been calling the phone numbers and giving them a hard time till they tell me how to remove it. LOL its hillarious. Also called the FBI as it was on a website targeting children and the FTC who was most interested.
Now when you call the numbers for winfixer they will say they are not the same company. they claim to be billingnow.com. which they are not and even if they were they share the same ontario addy as winsoftware ltd.( winfixer) among other tasty spyware names. When you call they want your name and call back number and email addy to send you the removal instructions. I refused on the first 2 as they dont need that to send me an email, right? then the lady I was talking to forgot where she was after I asked her what city she was in. LOL imagine that. then she told me that winfixer was out of singapore. I confronted her with an IP trace that leads back to their ontario office. oooooops click. hello
another call resulted in them promising to send me the removal intructions without giving them a name and phne number. guess what no email so far. so getting ready to call again.
I suggest you call its quite fun to listen to these girls squirm. every call now I ask them if the FBI has contacted them yet. LOL
I forgot to add. Please call the friendly FTC, they are very interested in hearing from ya'll.
877 382 4357
complaint number for winfixer is 6831884
If you ned help removing this, go here: http://computercops.biz/
These guys are great. Winfixer kept trying to download itself to my computer and they helped me get rid of it.
Mate
Winfixer 2005 is a beauty.
I just finished removing it after 2 days of frustration on a P4 with 1 gig ram, 80 gig hard drive,running XP home edition with SP2. And the customer did not believe in backups.
The way to go is
1/ Obtain a program called Hijack get-now be really really careful.
This is a registry editor -so back up the registry first- repeat backup the registry first.
2/ Obtain Cleanup
3/ Then obtain Registry Editor
4/Now you run Hijack from DOS
5/Then you have to search the registry for the infection - in other words map the registry. Yet another undocumented Microsoft feature!
6/once done mapping then run Hijack it blows the selected items away.
7/ Run Cleanup - this removes temp files, contacts and everything else -so you have to select your items carefully first- no there is no rollback
8/ Follow the Cleanup prompts and read the screens - if you are not sure stop, think then act.
9/ You have to shutdown and restart the machine for Cleanup to do its job - sorry no half measures.
10/Now run registry editor -this one actually gets down and gets dirty but it is slow - about 40 minutes.
10/ Empty the recycled bin
11/ Then run Cleanup and Registry Editor again.
Winfixer is nasty it builditself into the Registry, Executable files, Dlls and the WindowsSystem32 folder as an application so you have to chase it around all the directory to destroy it!!
It also comes with Gator which is near impossible to remove without
reading Windowssystem 32 and changing all the file names and turning of fast searching through the advance section on properties. I rename all the files using Australian animal names. Gator then has to ring mum to get an update and this is done through cookies which are in the temp file so you can destroy it.
lots of luck
By the way winfixer uses an A Class address starting at IP 66 so it is run from a University.
Why not complain to all universities on the West Coast of the USA around LA -need I say more. Ring the Dean ask him his IP address and complain!!!!
I finally got rid of a week of WinFixer pop ups by doing a system restore on XP (MCE). I went back about a week and a half. No more pop ups for a couple days now! (and I have rebooted my PC many times since).
And the beat goes on!
as a tip, go into your router settings and block winfixer!
it attempted to download from bravenet for me, using a popup luckily it didnt finish.
a javascript popup at that
try using vundofix to remove winfixer pop-ups
On September 29, 2006, a San Jose woman filed a class action lawsuit over WinFixer and related "fraudware" in Santa Clara County Superior Court.
I found this on my computer, thinking ints an oridinary Antivrus from windows xp , it was called WinAntiVirus XP 2008, it frequently popped up telling me to download Winfixer too and told me it wouldnt delete the 217 threats on my computer unless i bought the $35 program. I got AVG instead which worked great and deleted WinAntiVirus, but from now on it has been still in my start button and uses browser exploitation to get me to look at holiday and gambling websites. Is there anyone I can contact to make a report on this?
Commenting by HaloScan
