HowTo: Fixing WinFixer / ErrorSafe / System Doctor

[J]

Q: What is ErrorSafe?
A: It's an application that you installed on your computer (unknowlingly).  It has NOTHING to do with MyDeathSpace.com.

Things you can try to fix it...

• [li]READ THIS http://www.help2go.com/Tutorials/Spyware_Information/ErrorSafe_Removal.html[/li]
  [li]Download Ad-Aware from http://www.lavasoftusa.com, update it (make sure update is success), run it.[/li]
  [li]Download Spybot Search & Destroy fromhttp://www.spybot.info, update it (make sure update is success), run it.[/li]
  [li]Some programs here too... http://www.spywareguide.com/product_show.php?id=2740[/li]
  [li]Follow Symantec's Manual removal directions[/li]

note: if something comes up and is identified as a "cookie", you can safely ignore it.  This is not the program,  But delete it anyway.

If you are still having problems, you need to paste me the following info from your registry, here's how to do it...

• [li]Start Menu >> Run, type regedit and hit enter.[/li]
  [li]Find the Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run[/li]
  [li]Right click on the key and select export and save the file.[/li]
  [li]Open up notepad and open the file you just saved in notepad.[/li]
  [li]Copy and paste the contents of that file into this thread.[/li]

If you are still having problems, reply to this thread with a DETAILED LIST of all the above bullet points you have tried and what you have done.  If you simply reply with "it didn't work" or "it's still happening" or "i tried them all", I will remove your reply and smite you back to hell.  A reply with "it worked" is ok.

Oh ya, make that list detailed!

[xX_foryou_xx]

i did your stuff. and i think its worked, i get a box saying that they are trying to reconnect and i click no and its fine.. thankies! :-D


*prays for no smites*

[magicaxeman]

Im afraid this malware is coming from the webhost you use via the adverts on your pages. As such it is your responsibility to inform your web host of whats happening and make them update their malware protocols, in the meantime all adverts should be suspended to prevent members being infected.
I run several malware detection and protection programs that are updated on a daily basis and also immunize my system regularly yet this little nasty keeps trying to instal itself when ever I visit MDS. I should also add that it doesn’t occur on any other site I visit, just MDS.
Its all very well instructing members how to get rid of it but prevention is better than a cure, also it makes surfing MDS so frustrating due to continual redirects everytime you try to view a page.
This little nasty also defeats pop up blockers by redirecting the page, so beefing up the sttings on your pop up blocker doesn’t work, and adding it to restricted sites just results in a blank screen

[J]

[quote author=magicaxeman link=topic=5460.msg223432#msg223432 date=1173448014]
Im afraid this malware is coming from the webhost you use via the adverts on your pages. As such it is your responsibility to inform your web host of whats happening and make them update their malware protocols, in the meantime all adverts should be suspended to prevent members being infected.
I run several malware detection and protection programs that are updated on a daily basis and also immunize my system regularly yet this little nasty keeps trying to instal itself when ever I visit MDS. I should also add that it doesn’t occur on any other site I visit, just MDS.
Its all very well instructing members how to get rid of it but prevention is better than a cure, also it makes surfing MDS so frustrating due to continual redirects everytime you try to view a page.
This little nasty also defeats pop up blockers by redirecting the page, so beefing up the sttings on your pop up blocker doesn’t work, and adding it to restricted sites just results in a blank screen

[/quote]


We've already gone through this, I've already proved it is not our ad server...  I gave people a piece of code that disabled all communication between their computer and our ad server... The popups still happened.

Please STOP VISITING OUR WEBSITE NOW...

After you realize it's not our website, you can come back.

[J]

[quote author=magicaxeman link=topic=5460.msg223432#msg223432 date=1173448014]
I run several malware detection and protection programs that are updated on a daily basis and also immunize my system regularly yet this little nasty keeps trying to instal itself when ever I visit MDS. [/quote]

I should also warn you.  There are A LOT of anti-spyware programs that will INSTALL ErrorSafe.  Either research every spyware program you have or ONLY use the ones that I have recommended above.

[Plaincat]

[quote author=J link=topic=5460.msg224118#msg224118 date=1173472917]

We've already gone through this, I've already proved it is not our ad server...  I gave people a piece of code that disabled all communication between their computer and our ad server... The popups still happened.

Please STOP VISITING OUR WEBSITE NOW...

After you realize it's not our website, you can come back.
[/quote]

How have you proved it's not the ad server? Think it was two that said they got the problem back after a few days, but what about all the people it actually worked for, to just add that address that you gave us. I don't see why it would hurt to just check with the ad server.

Edit: Ok, I'm sorry, I was just trying to help, I wont do that anymore, since my problem got fixed at the first fix when redirecting outside the adserver, I just feel sorry for all these people with the problem, because I know how annoying it is.

[J]

Because the people who blocked the ad server were still receiving the ErrorSafe problems.  That tells me, it isn't the ad server.

Also reading and learning about WinFixer, tells me it's an application installed on the users machines.  Symantec even has a manual removal process on their website.

Our ad server is adbrite, which is a reputable ad serving company.  They serve ads for popular sites such as...



Do you think ALL these sites are experiencing the problem?  If we all use AdBrite, then they should be!

You can continue this conversation if you wish, but I will no longer acknowledge any questions nor reply to any post on this line of questioning.  I'm tired of it.

[J]

This is important!  Is anyone receiving this poup message?



If you receive this error message while visiting our website, you need to take a screenshot of the page you are on with the popup.

[Olivia]

[quote author=J link=topic=5460.msg224619#msg224619 date=1173487279]
This is important!  Is anyone receiving this poup message?



If you receive this error message while visiting our website, you need to take a screenshot of the page you are on with the popup.
[/quote]

I always get it at work - Now that I have added the errorsafe etc to my restricted sites, I dont get the pop-ups anymore, just the redirects.  I'll take them off the restricted list for awhile on Monday and send you a screenshot.

Just letting you know, that I tried most of the steps in your post on how to fix but because its a stupid work computer, I can't get past the firewalls to download most of the stuff.  My home computer is still fine.  I'll try harder on Monday from work and let you know how I go.

[Tarren]

J, just an update.

I've done all the restricting sites, scanned with spybot and adawre and blocked the ad server too.

Haven't had a thing since.

It isn't even trying to redirect.

Before I did all that I was getting that message you posted but since blocking the ad server I've been good to go.

Thanks!

[J]

[quote author=Olivia link=topic=5460.msg225631#msg225631 date=1173521289]
I always get it at work - Now that I have added the errorsafe etc to my restricted sites, I dont get the pop-ups anymore, just the redirects.  I'll take them off the restricted list for awhile on Monday and send you a screenshot.

Just letting you know, that I tried most of the steps in your post on how to fix but because its a stupid work computer, I can't get past the firewalls to download most of the stuff.  My home computer is still fine.  I'll try harder on Monday from work and let you know how I go.
[/quote]

You can also try Symantec's manual removal directions at... http://www.symantec.com/security_response/writeup.jsp?docid=2005-120121-2151-99&tabid=3

[Plaincat]

[quote author=J link=topic=5460.msg224619#msg224619 date=1173487279]
This is important!  Is anyone receiving this poup message?



If you receive this error message while visiting our website, you need to take a screenshot of the page you are on with the popup.
[/quote]

I have yet to get re-directed to WinFixer as your screenshot says, however, I disabled the AdBlocker that this page said was the only way to get rid of this annoying re-direct, caused by Adbrite, just so I could take some screenshots, and sure enough, within 1 minute of being on the page with both the adblocker disabled and removing the entry I made in "C:/Windows...." here is the screenshots I got. (only posting the the links, cause the pictures aren't re-sized.)

You can smite me and refuse to listen to the issue that it is the adserver, but that's real ignorant and stubborn of you. What more proofs do you need?! The fact that some people kept getting the re-directs after doing your fix, just makes me think that maybe they did it wrong, not that it is not the issue...

So here goes.

1. I disable the adblocker/windows modification of the /etc file (so far so good, until I click the red x in the corner..)

http://i105.photobucket.com/albums/m204/plaincat/proof1.jpg

2. This is what happens when i click the red x, I get re-directed to a page that stays white (the window also maximizes, for some reason), until I click the x on the next pop-up window.

http://i105.photobucket.com/albums/m204/plaincat/proof2.jpg

3. Spy-doctor website, with no pop-ups this time, guess I'll try to hit the back-button to leave the page.

http://i105.photobucket.com/albums/m204/plaincat/proof3.jpg

4. Hmm, didn't work, got another pop-up when hitting the back button...

http://i105.photobucket.com/albums/m204/plaincat/proof4.jpg

5. Closed the window, managed to get back to MDS, clicked another link on the forum, and I was back at step 1 again.

6. Enable Adblock again,  and wait for smites.

[J]

[quote author=Plaincat link=topic=5460.msg227639#msg227639 date=1173656949]
I have yet to get re-directed to WinFixer as your screenshot says, however, I disabled the AdBlocker that this page said was the only way to get rid of this annoying re-direct, caused by Adbrite, just so I could take some screenshots, and sure enough, within 1 minute of being on the page with both the adblocker disabled and removing the entry I made in "C:/Windows...." here is the screenshots I got. (only posting the the links, cause the pictures aren't re-sized.)

You can smite me and refuse to listen to the issue that it is the adserver, but that's real ignorant and stubborn of you. What more proofs do you need?! The fact that some people kept getting the re-directs after doing your fix, just makes me think that maybe they did it wrong, not that it is not the issue...

So here goes.

1. I disable the adblocker/windows modification of the /etc file (so far so good, until I click the red x in the corner..)

http://i105.photobucket.com/albums/m204/plaincat/proof1.jpg

2. This is what happens when i click the red x, I get re-directed to a page that stays white (the window also maximizes, for some reason), until I click the x on the next pop-up window.

http://i105.photobucket.com/albums/m204/plaincat/proof2.jpg

3. Spy-doctor website, with no pop-ups this time, guess I'll try to hit the back-button to leave the page.

http://i105.photobucket.com/albums/m204/plaincat/proof3.jpg

4. Hmm, didn't work, got another pop-up when hitting the back button...

http://i105.photobucket.com/albums/m204/plaincat/proof4.jpg

5. Closed the window, managed to get back to MDS, clicked another link on the forum, and I was back at step 1 again.

6. Enable Adblock again,  and wait for smites.

[/quote]


The screenshots you have shown me are screenshot of a system currently infected with WinFixer.

Please try Symantec's manual removal directions at... http://www.symantec.com/security_response/writeup.jsp?docid=2005-120121-2151-99&tabid=3 and let me know how it goes.

[Plaincat]

No, I enabed the adblock again, and I don't have a problem anymore, I just disabled it to give you some screenshots.

[J]

For everyone still experiencing problems, I have modified the first post to include directions on how to include info from regedit.

[Olivia]

J - question.  Have you updated or done something to the ads on the site?

I bet as soon as I type this, it will happen again.  But I have not had any redirects etc this morning.  I am on the work computer and have not done anything to try and fix it since last week. Fingers crossed!!!

[J]

[quote author=Olivia link=topic=5460.msg228956#msg228956 date=1173738698]
J - question.  Have you updated or done something to the ads on the site?

I bet as soon as I type this, it will happen again.  But I have not had any redirects etc this morning.  I am on the work computer and have not done anything to try and fix it since last week. Fingers crossed!!!
[/quote]

I haven't made any changes.

[Olivia]

It's still okay - miracle of miracles.  I am still hesitant to shout from the rooftops but so far so good.     

[xX_foryou_xx]

so far so good for me today!!

[Olivia]

It's still not happening!  Must be close to about 48 hours now.  Hallelujah!!!!   

[xX_foryou_xx]

[quote author=Plaincat link=topic=5460.msg236881#msg236881 date=1174108236]
Ya, something has had to have been changed, turned off my adblock 30 mins ago, and still no redirects, and ads acting like normal. Yay!
[/quote]

dito.

[Plaincat]

Ya, something has had to have been changed, turned off my adblock 30 mins ago, and still no redirects, and ads acting like normal. Yay!

Edit: I take that back, had to enable adblock again today. 

[xX_foryou_xx]

ok, i havnt had this since the last post ages ago, but this morning im getting it on everypage, is anyone else getting it today? its only happening on this site

[J]

This is a response from Adbrite...

Hello,

We apologize for the ongoing perpetuation of unauthorized advertisements, such as drivecleaner.com, systemdoctor.com, or errorsafe.com in our network.  We would like to notify you that in order to achieve a thorough and lasting resolution to this issue we have tightened restrictions around the submission of ad copy, begun scanning all advertisements for potential abuse, and forged partnerships with established anti-spyware and internet security companies to ensure detection and removal of these ads.  Locating offending advertisers unfortunately continues to pose several difficulties.  To that extent, if you are still experiencing problems with any advertisements that you believe to be abusing our network, we would appreciate any information you could provide about these ads, particularly the following:

1.  What city/state/country are you viewing the ad from?

2. Do you have a screenshot?

3. What's the URL of the webpage that has the virus?

4. Was the user redirected to the above url from another website…if so, what is the url of the website that the user was redirected from?

5. What browser (and what version) is the user using?

6. If you have multiple ad zones, which zone specfically is displaying the ad?

Also, please include the username for your account with your response, if applicable.

Thank you for your ongoing patience and assistance with combating this problem.

Best Regards,



Katie H.

AdBrite, Inc.

Provide me with the requested info and I'll forward it on to them...

[Plaincat]

[quote author=J link=topic=5460.msg283589#msg283589 date=1176322443]
This is a response from Adbrite...

Provide me with the requested info and I'll forward it on to them...
[/quote]

I thought you said you were 100% sure it was NOT Adbrite's fault? And you said you wouldt smite everyone to death if they said it was them!

Here's one from me, Ive provided screenshots earlier in the thread, so not submitting them again, because I don't want to unblock Adbrite again...

1. Asker, Norway
2. Yes, in other posts
3. www.spydoctor.com (?)
4. from www.mydeathspace.com
5. Mozilla Firefox
6. N/A

So now that you found out what the reason for this was, I hope they can fix it. But it really seems like it was what I said. That your ad-server is ran from the States, and these virus things aren't seen by them, because it's only triggered by users in Europe.