WinFixer

WinFixer was a family of rogue security and system-optimization programs associated with Winsoftware and later linked in enforcement materials to Innovative Marketing and related operations. Rather than providing trustworthy malware detection or system repair, the software became known for scareware tactics: it presented alarming warnings, displayed purported scan results, and urged users to pay for a full version to remove supposedly discovered threats or repair alleged system problems. The brand was promoted as a utility for scanning and repairing Windows system, registry, and hard-drive errors. Its marketing also claimed that it could improve system stability and performance, recover damaged office, music, and video files, and free unused disk space. Security researchers and antivirus companies did not substantiate those claims. Instead, the free or trial versions commonly produced misleading or fabricated detections and withheld alleged remediation unless the user purchased the product. WinFixer was particularly notable because installation often occurred without meaningful user consent. Distribution methods included deceptive browser pop-ups, fake codec installers, malicious advertising, and malware families such as Emcodec.E and Vundo. A user might encounter a message claiming that the computer was infected or asking whether WinFixer should be installed. Interacting with the dialog, including attempts to dismiss it, could trigger additional downloads or installation activity. The software was browser-independent at the initial infection stage, although it also affected Firefox users by exploiting browser-related settings and extensions. After installation, WinFixer could create persistent pop-ups, modify the Windows Registry to launch at startup, repeatedly scan the system, and relaunch after a user attempted to terminate its process. Its numerous variants made manual removal inconsistent and time-consuming. Some versions interfered with Internet Explorer, while others were technically or operationally related to the Vundo trojan and the Aurora Network's Nail.exe hijacker. A later variant known as Windows Police Pro continued the same general pattern of counterfeit scans, fake security warnings, and purchase prompts. The WinFixer operation attracted consumer complaints, security-industry warnings, and legal scrutiny. A 2006 private lawsuit alleged that the software had seriously disrupted a user's computer, although that case was later dropped. In 2007, WinFixer advertising was reportedly delivered through Windows Live Messenger and MSN Groups by an advertising intermediary; Microsoft said it removed the advertisements and reviewed its approval procedures. In December 2008, the United States Federal Trade Commission obtained a temporary restraining order against Innovative Marketing, ByteHosting Internet Services, and several individuals connected by the agency to WinFixer and sister products. The FTC alleged deceptive advertising and unlawful consumer practices. The associated websites subsequently became defunct. In 2012, the FTC imposed a $163 million civil penalty on Kristy Ross in connection with the operation. WinFixer is therefore best understood not as a conventional software brand but as a historically significant scareware label. Its importance in computer-security history lies in its use of deceptive distribution, fabricated detections, aggressive persistence, and paid remediation claims, as well as its connection to a broader ecosystem of rogue security products.

WinFixer emerged during the mid-2000s growth of deceptive Windows security software. Its branding suggested a legitimate maintenance product capable of diagnosing registry, hard-drive, and system-performance problems. The program's free or trial versions, however, were associated with alarming messages and purported scans that identified threats or errors without reliable evidence. Users were then directed toward a paid registration or full version before the alleged problems could be removed. Distribution was a central part of the WinFixer model. The software could be delivered through websites using misleading pop-ups, fake codec offers, and malicious or compromised advertising. Some dialogs falsely claimed that the visitor's computer was infected, while others appeared to request permission to install a utility. According to descriptions of the infection process, clicking either an affirmative or negative option, or attempting to close the window, could lead to further pop-ups and an unwanted download. The software was not limited to one browser and could affect Microsoft Windows users through several delivery paths. Once installed, WinFixer behaved like persistent malware rather than a conventional diagnostic application. It could display recurring warnings, alter Registry entries so that it started with Windows, and repeatedly scan the computer. Its process could be stopped temporarily, but was reported to restart automatically. Removal was difficult because the program could undo attempted changes and because different variants behaved differently. Firefox users were also affected: WinFixer was reported to exploit the SessionSaver extension and alter the prefs.js configuration file, causing additional prompts at browser startup. Some versions were closely associated with the Vundo trojan and with Aurora Network's Nail.exe hijacker or spyware. The brand became part of a broader network of related rogue applications, including ErrorSafe and later products such as Windows Police Pro. Windows Police Pro continued the established formula by generating fake scan results, persistent warnings, counterfeit Windows Security Center messages, and interface choices designed to steer users toward buying the full version. Microsoft added the later malware to its Malicious Software Removal Tool in 2009, while independent security publications recommended specialist anti-malware utilities for removal. Questions also arose over the identity and location of the operators. Winsoftware Ltd. claimed a Liverpool address that was reportedly found to be false. Domain and certificate information connected associated infrastructure with entities or locations in Ukraine, Poland, Honduras, Belize, and hosting providers operating through North American network infrastructure. These records did not establish a simple or transparent corporate structure, but they contributed to the perception that the brand operated through a distributed and opaque infrastructure. Public scrutiny intensified after a 2006 California lawsuit alleged severe computer disruption. In 2007, WinFixer advertisements reportedly appeared in Windows Live Messenger and on MSN Groups through advertising systems. Microsoft stated that it removed the offending advertisements because they violated its advertising policy. The decisive regulatory development came in December 2008, when the Federal Trade Commission sought and received a temporary restraining order against Innovative Marketing, ByteHosting Internet Services, and individuals associated with the WinFixer family and sister products. The FTC alleged that the software and its advertising used deceptive claims to induce purchases. The defendants were also reported to have violated the order, resulting in a civil-contempt fine of $8,000 per day. The related websites became defunct later that month. In 2012, the FTC announced a $163 million penalty against Kristy Ross for her role. WinFixer has no known continuing commercial operation. Its historical significance comes from its role in the development of scareware: software that imitates legitimate security products while using fabricated detections, aggressive prompts, deceptive distribution, and difficult removal to monetize fear.

• 2012

  FTC penalty against Kristy Ross

  [1]WinFixeren.wikipedia.org

  The FTC imposed a $163 million civil penalty on Kristy Ross in connection with the operation.

• 2009

  Windows Police Pro identified as a later variant

  [1]WinFixeren.wikipedia.org

  Microsoft described the emergence and evolution of Windows Police Pro, a later WinFixer-related rogue security product, and added it to its malware-removal coverage.

• 2008

  FTC obtains temporary restraining order

  [1]WinFixeren.wikipedia.org

  The FTC brought action against companies and individuals associated with WinFixer and related products, alleging deceptive consumer practices.

• 2008

  Associated websites cease operating

  [1]WinFixeren.wikipedia.org

  WinFixer-related websites reportedly became defunct in December following regulatory action.

• 2007

  WinFixer advertising reported through Microsoft messaging properties

  [1]WinFixeren.wikipedia.org

  Reports identified WinFixer advertisements in Windows Live Messenger and some MSN Groups pages. Microsoft said the ads were removed.

• 2006

  Private consumer lawsuit filed

  [1]WinFixeren.wikipedia.org

  A California plaintiff filed a lawsuit alleging that WinFixer and related fraudware caused serious computer problems. The case was later dropped.

Presented as a Windows system-repair, security-scanning, and performance-optimization utility, but widely characterized by security researchers and regulators as deceptive scareware.

• Rogue security and system-optimization software

  WinFixer

  The core WinFixer product family presented itself as a Windows utility for finding and repairing system, registry, hard-drive, and file problems. Its trial versions were associated with fabricated or misleading detections, repeated warnings, and demands for payment before alleged threats could be removed. Variants could modify startup settings, create persistent pop-ups, and resist ordinary removal procedures.

• Rogue antivirus variant · 2009

  Windows Police Pro

  Windows Police Pro was described as a later WinFixer-related variant. It generated persistent alerts, counterfeit scan reports, fake Windows Security Center messages, and purchase prompts. Its interface reportedly used confusing confirmation choices to encourage users to buy the full version. Microsoft included the malware in its removal-tool coverage in 2009.

• 2008

  Federal Trade Commission enforcement action

  The FTC alleged that WinFixer and related products used deceptive advertising and software behavior to induce consumers to pay for unnecessary or ineffective remediation.

  Source

• 2007

  Deceptive advertising delivered through Microsoft properties

  WinFixer ads reportedly appeared in Windows Live Messenger and MSN Groups, prompting Microsoft to remove them as a violation of its advertising policy.

  Source

• 2006

  Consumer allegations of computer damage

  A lawsuit alleged that WinFixer-related software rendered a computer's hard drive unusable, ejected its CD-ROM drive, and displayed repeated false virus warnings. The case was later dropped.

  Source

Read more

• 2007Windows Live Messenger and MSN Groups advertising

  International · Microsoft Windows users

  WinFixer advertisements were reportedly delivered through advertising placements associated with Windows Live Messenger and some MSN Groups pages. The activity was not a legitimate WinFixer brand campaign in the conventional sense; it was an example of the distribution and monetization ecosystem surrounding the software.

  Outcome. Microsoft said it removed the offending advertisements and reviewed its ad-approval process.

  Source

• 2009

  Expansion into the Windows Police Pro variantOther

  Background

  The WinFixer ecosystem continued through renamed or related rogue security products that preserved the use of fake detections and purchase prompts.

  Action taken

  Windows Police Pro appeared as a later variant and was subsequently included in Microsoft's malware-removal coverage.

  Aftermath

  The variant became another example of the evolving scareware family and was addressed by Microsoft and independent malware-removal guides.

  Source

• 2008

  Regulators target the WinFixer distribution and monetization modelStrategy

  Background

  The WinFixer family relied on deceptive installation paths, alarming pop-ups, questionable scan results, and paid registration prompts. The FTC treated the practices as consumer-protection violations.

  Action taken

  The FTC obtained a temporary restraining order against Innovative Marketing, ByteHosting Internet Services, and named individuals associated with the operation.

  Aftermath

  The operation reportedly violated the court order and incurred an $8,000-per-day civil-contempt fine. Associated websites became defunct in December 2008.

  Source

1. 1WinFixeren.wikipedia.org
2. 2Federal Trade Commission action referenced in the WinFixer articleftc.gov