WinFixer

» see winfixer.com as it lived, on the wayback machine

~ the obituary ~

This one showed up in my orbit around the middle of the 2000s, though not on my own machine so much as on everybody else's. If you are the computer engineering student in a Turkish family, you inherit every Windows box in it, and for a few years the recurring complaint was the same one: a window appeared saying the computer was infected, it will not close, and something now wants a credit card. Nobody I dealt with ever called it WinFixer. It was always described by what it did.

The name was almost incidental anyway. WinFixer was one label on a family of near-identical products that also went out as ErrorSafe, DriveCleaner, SystemDoctor, WinAntiVirus Pro and a dozen others, rotated whenever a brand got too well known. Behind them all sat Innovative Marketing Inc, an operation registered offshore with its actual engineering in Kiev, plus a Cincinnati company called ByteHosting Internet Services that handled the American end.

The product itself did nothing. It ran a scan that found threats regardless of the machine's actual state, then asked for $40 to $60 to clean what it had invented, with the whole performance dressed in the visual language of real security software. Some builds also installed genuine malware on the way in, which meant it occasionally created the problem it was selling the cure for.

~ the case file ~

~ how it worked ~

The distribution is what made this different from the spyware of the era. WinFixer did not need you to install anything. It bought advertising space, submitted banner ads through legitimate ad networks, and used those slots to fire drive-by downloads or popups at whoever was reading a normal website. A visitor to a mainstream news site could be infected without clicking anything at all. That is the technique now called malvertising, and this family is a large part of why the word exists.

The second trick was psychological. The alert borrowed the exact visual grammar Windows itself used for warnings, so the design was doing the persuading. To a user who had been told for years that viruses are a real danger and that you should buy protection, WinFixer was not obviously different from the thing they had been told to buy. That is why over a million people paid, and it is why the FTC's case had to be argued as consumer deception rather than as a technical intrusion.

~ the long tail ~

On 2 December 2008 the FTC obtained a temporary restraining order in a Maryland federal court against Innovative Marketing, ByteHosting and several named individuals, freezing assets and halting the operation. That is the date the machine stopped. The litigation took years longer. Marc D'Souza and his father gave up $8.2 million under a 2011 settlement, and in September 2012 the last defendant standing, Kristy Ross, was hit with a judgment of $163,167,539, upheld on appeal in 2014.

Most of that money was never recovered. Several defendants had left the country and the corporate structure was designed for exactly this outcome. The scheme itself did not die either, it just changed clothes: the fake antivirus popup became the fake tech support call, then the browser lock screen with a phone number on it, then the same thing in an ad for something else. WinFixer is buried. The idea that a sufficiently official-looking warning is worth forty dollars to a frightened person has never been buried at all.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »