Threat Description



Category: Spyware
Type: Rogue
Platform: W32
Aliases: Winantispyware, WinAntiSpy, ErrorSafe, WinAntiVirus, WinAntiVirusPro, Systemdoctor


Winfixer is an application that is installed by drive-by downloads and ActiveX installations. The program starts automatically at boot-up and presents the user with multiple dialogs stating that a full license should be purchased to remove problems it has found.


Automatic action

Once detected, the F-Secure security product will automatically quarantine the suspect file and prompt the user to select a further desired action.

Quarantine is a safe repository for files that may be harmful. A quarantined file can be restored or, if you decide so, deleted.

Excluding a file from scanning

If you are aware of and accept any potential risk associated with this program, you can configure the F-Secure security product to exclude it from scanning.

Suspect a False Alarm?

If you suspect a file has been incorrectly identified as malicious, (that is, it is a False Alarm or a False Positive), please first ensure your F-Secure security program is up-to-date with the latest detection database updates, then rescan the suspect file.

If you continue to suspect a False Alarm, you may submit a sample of the suspect file to our Security Labs for further analysis via the Sample Analysis System (SAS).

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Winfixer, made by Winsoftware, is an application to fix problems in Windows. It is mainly installed by drive-by downloads and ActiveX installations. There are also reported cases where Winfixer has been installed by trojans. Winfixer doesn't offer the trial version on their website, it can only be purchased from there.

The software runs automatically and starts up each time the operating system starts. Scan is issued automatically to maximize visualisation to users who have received the trial version. The program detects an excessive amount of false errors and employs scare tactics with questions to the user asking if they want to keep the errors or purchase the full version of the software.

Winsoftware seems to be affiliated with another company called Vantage Software who, despite claims to be headquartered in Croydon, England, registers their website in Chile and hosts their website on servers in Canada. ErrorSafe and WinAntiSpy are two other companies who have re-branded Winfixer and offer it for sale on their sites. Winfixer can also be found localized in languages other than English.

Please also see the description for Zlob for additional details and a removal tool.

Description Created: 2006-04-20 00:00:00.0

Description Last Modified: 2007-10-15 10:59:26.0


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More