My Anti Spyware

How to remove WinFixer

WinFixer is a bogus anti-spyware and spam-blocking application downloaded mainly from popup ads that would be convincing to the average user. It is also bundled with certain free downloadable applications. The program requires you to buy it for about $30. When bought, it scans the computer and replicates the cookie-handling function of Internet Explorer, meaning it’s useless to anyone with IE installed.

If installed, WinFixer will load on startup and use 100% of the user’s CPU. The program shows many “false positives” in its scan results, often targeting non-malicious files, or even essential files. If the user exits WinFixer, it will start up again within a short amount of time.

Here is what Winfixer says it does (but doesn’t):

WinFixer 2005 is useful utility to scan and fix any system, registry and hard drive errors. It ensures system stability and performance, frees wasted hard drive space and recovers damaged Word, Excel, music and video files.

WinFixer is closely related to Aurora Network’s Nail.exe hijacker/spyware program. In worst case scenarios, it’ll embed itself into Internet Explorer and maybe impossible to get rid of from there on. The program is also closely related to the Vundo and Virtumonde viruses and are treated as such.

According to a record on WHOIS lookup, the Winfixer company is located at: WinFixer, P.O. Box 3, Kiev, NA 04114, UA or at hostmaster@winfixer.com

It’s a junk security program with no real benefit. Here’s their marketing nonsense:

WinFixer 2005 detects and repairs corrupted files, removes useless data, cleans up clogged Windows registry and fixes hard drive errors. This useful utility helps you maintain an error-free PC and achieve 100% system performance.

For a fake security program, they’ve got a pretty good fake “Support” page with a Knowledge Base, a troubleshooter and a contact form, but NO E-MAIL ADDRESSES. Of course they’re not eager to put a phone number or address on the site, but not even an e-mail address?

Here’s a choice snippet from WinFixer License Agreement, and other legal docs:

Some of our products may be unsuited to run with other software. We have the right to uninstall incompatible products. We will notify our customers before uninstalling such products. A customer CANNOT claim a refund if the reason is a requisition or removal of conflicting software.

Coexistence of some products may lead to many unsatisfactory effects as well as to slow the customer’s system. That is why the usage of WinFixer 2005 requires the uninstallation of products which represent a risk to the system.

That essentially allows WinFixer to tell you that anything is dangerous, and that you might just have to buckle down and let them delete Norton or Ad-Aware or Spy Sweeper or XoftSpy, which detect WinFixer as a threat.

The program is often installed covertly and can be very difficult to remove.

- You may not be informed that WinFixer has been installed, particularly if it came bundled with another piece of software.

- WinFixer can be installed through intrusive “social engineering” tactics, employing uncloseable ad windows and messages to goad the user into accepting an agreement.

- The program itself can display pop-up and pop-under ads, even when it’s not currently running.

- WinFixer reloads itself on a timer. Closing the program only provides a few moments until it opens again.

The symptoms of Winfixer include slow browser performance, pop-up and pop-under ads, search redirects, fake Windows error messages and warnings, as well as system halting, crashes and reboots.

For a first-hand account of a struggle with WinFixer, read Paperghost’s death-defying tale over at Vital Security.

If you’re struggling with WinFixer right now, you may want to try XoftSpy. Alternately, there are a number of sites with detailed removal instructions. If you’re an advanced user, they might be worth a look. (Try this one: http://www.bleepingcomputer.com/forums/topic18610.html)