Winfixer, Purveyor of False Security Reports, Appears on Windows Live Messenger

Banner advertisements for a security application said to report false or inflated threats appeared for at least a few days on Microsoft’s instant-messaging (IM) program, prompting warnings from security analysts.

Microsoft appears to have removed the ads, which were displayed in the contacts panel for its IM program, Windows Live Messenger, said Sandi

Hardmeier, a Microsoft Most Valued Professional, a designation the company gives to people who have expertise with its products.

The program, known as Winfixer, falsely warns a computer has been infected with malicious software, to Symantec. It asks users to buy a program to remove the unwanted software.

“Quite often, it reports files that are perfectly safe,” Hardmeier said. “It uses a lot of false positives. Basically, it’s a rip-off.”

Other security companies, such as Sophos and McAfee, classify Winfixer as a “potentially unwanted application.”

Hardmeier, who notified Microsoft of the problem, said the ads that appeared on Windows Live Messenger tried two ways to get users to install Winfixer on their machines.

The first was via a pop-up window offering to scan the computer for problems, she wrote. Depending on the version of Internet Explorer used, Winfixer would try to download itself through an Active X control, she said.

The second way was through a banner advertisement that a user would have to click before being taken to a website offering Free PC-Secure, a program that is detected as Winfixer by most security software, she said. Winfixer goes by several different names, including ErrorSafe and DriveCleaner.

Microsoft had done well preventing spyware programs from being advertised in banner ads on Windows Live Messenger, formerly known as MSN Messenger, Hardmeier wrote on her blog, Spyware Sucks.

But Winfixer has proven a tricky foe. Advertising networks have had trouble with Winfixer ads suddenly being served up by their networks despite no affiliation with its creators, Hardmeier said.

The suspicion is that organizations have falsely registered with the networks and substituted Winfixer ads—hosted on their own servers—instead of the advertisements they agreed to supply, she said.

Microsoft officials contacted in London on Monday morning could not immediately comment.

-Jeremy Kirk, IDG News Service