Evil Advertising from ErrorSafe.COM

So I loaded my normal list of cartoons and news for this morning – “Open in Tabs” is such a marvellous feature – and about halfway through my Safari browser flashed-up an error alert – which stops everything – to say:

www.errorsafe.com

NOTICE: If your computer has errors in the registry database of file system it could cause unpredictable or erratic behaviour, freezes and crashes. Fixing these errors can increase your computer’s performance and prevent data loss.

Would you like to install ErrorSafe to check your computer for free? (Recommended)

/users/alecm/albums/dropdata/dilbert1.png

Use of an Alert Box for advertising struck me as being rather naughty, not to mention the use of the word “(Recommended)” – my emphasis in the above – without saying that it was the vendor, not the OS manufacturer, recommending this; but as a Mac user and with a reasonable idea of what is/is not a risk I decided to play along:

/users/alecm/albums/dropdata/dilbert2.png

It opened a large JavaScript panel above my Dilbert cartoon (I wonder if United Media can be held liable for whom advertises on their site?) and popped open a confirmation box, proudly asserting:

This file has been digitally signed and independently certified as 100% free of viruses, adware and spyware.

…although after what happened next, I remain to be convinced:

/users/alecm/albums/dropdata/dilbert3.png

A complex animated Progress Bar – in MS-Windows colours and style – scrolled from left to right, ticking-off the tests that it was performing and telling me that it found 50 – a whole fifty! – “System Errors” on my machine.

Fifty Windows errors, on my G4 Apple MacOS 10.3.9 iMac. Yeah, really. It also auto-downloaded a .EXE file from their home base and presented it to me for execution.

This appears to be a truly lame confidence trick; aside from the fact that my browser dows not have permission to make those sorts of test upon underlying operating system files, there is the small matter of my being on the completely wrong operating system for it to execute anyway.

There is a possible mitigation that my being an Apple Mac user may be the cause of those 50 errors, but aside from the cluelessness implied by that possibility (that they do not trap the possibility) there is no way in hell I would use software that was advertised by such a hard sell, howeverso much it is “(Recommended)“.

Also: their logo looks astonishingly similar to that of the Victorinox Swiss-Army Knife.

Caveat browser.

Comments

39 responses to “Evil Advertising from ErrorSafe.COM”

  1. alecm
    WHOIS ErrorSafe.COM

    The Registry database contains ONLY .COM, .NET, .EDU domains and Registrars. Registrant: ErrorSafe, Inc. Rua Luiz de Conto, 133 Toledo, Parana CEP 85914-045 BR

    Domain name: ERRORSAFE.COM

    Administrative Contact: Parizotto, Jardim info@errorsafe.com Rua Luiz de Conto, 133 Toledo, Parana CEP 85914-045 BR +1.7865130244 Fax: +1.7865130244

    Technical Contact: Parizotto, Jardim info@errorsafe.com Rua Luiz de Conto, 133 Toledo, Parana CEP 85914-045 BR +1.7865130244 Fax: +1.7865130244

  2. Chris Samuel
    re: Evil Advertising from ErrorSafe.COM

    Several anti-spyware programs say they will detect and remove this malware.

    thundercloud.net/infoave/answers/fixer/index.htm

    securityresponse.symantec.com/avcenter/venc/data/errorsafe.html

    www3.ca.com/securityadvisor/pest/pest.aspx?id=453097282

  3. Mark J Musante
    re: Evil Advertising from ErrorSafe.COM

    I am amused by the first two items: Registry Check followed by Exhaustive Registry Check. Wouldn’t the latter include the former? Coudn’t they think of other official-sounding terms to look for?

    I’d bet it’s either a flash animation or an animated GIF file, especially given the fact that it’s labelled “Typical quick system errors scan”.

  4. alecm
    re: Evil Advertising from ErrorSafe.COM

    I am betting flash animation with no testing at all, which they can then hide behind its being “purely illustrative” by virtue of it being labelled “Typical quick system errors scan” – which you can see in the third image above the progress bar.

    In short: it’s an advertising gimmick designed to scare people. It scared me, even though I am a security geek and not even a windows user.

  5. alecm
    re: Evil Advertising from ErrorSafe.COM

    That first link to http thundercloud.net/infoave/answers/fixer/index.htm is really informative, especially wrt: the logo and graphic design.

    I *really* wonder whether those who run the advertising forums are meant to have an editorial capacity for the adverts they display; I am pretty sure something like that exists in the UK.

  6. mark oldham
    re: Evil Advertising from ErrorSafe.COM

    how do i remove errorsafe? i would appreciate some sound advice. thanks

  7. Purp
    re: Evil Advertising from ErrorSafe.COM

    yes please.. how the fick do I remove this?.. one thing certain. The author of this trap dont wanna meet me a dark night.. Ima rip his balls off, then lick em, shove em down his throat and kick his ass to death!!!

  8. Purp
    re: Evil Advertising from ErrorSafe.COM

    ok.. you might have visited a site called “remove-errorsafe.org” that recommend downloading a program called Xoftspy 4.21 ..they claim to not be affiliates with errorsafe and saying this will remove it safely..

    problem is that they dont tell you, that you have to buy it when you finish scanning, to remove the infected files.. lmao.. and I can play that game too

    just google this: Xoftspy 4.21 serial and you’ll be on your way to crack this ish.. muHaHahaha

  9. Chick
    re: Evil Advertising from ErrorSafe.COM

    Is there an effective way to remove errorsafe without having to pay?? Someone help me please. It’s very annoying.

  10. ManicMatt
    re: Evil Advertising from ErrorSafe.COM

    I just found this via spybot search and destroy when i updated it’s definition list. hopefully it’s been removed like it said. I had a very similiar pop up like described above, except whilst browsing I’ve had it pop up THREE times in the last week which is very annoying as it means I’ve lost my place on whatever page I was browsing as I have to close the whole thing down. (Alt-F4. Do NOT press cancel or the little red cross as they mean exactly the same thing as “yes/Ok”. I found that out the hard way.)

    I am now wondering if this has any relation to my current browsing of certain sites, where the page cannot be found. (For example “google”)

  11. 87.10.167.194
    re: Evil Advertising from ErrorSafe.COM

    buono

  12. S. Kikkert from Holland
    re: Evil Advertising from ErrorSafe.COM

    Ik word ook hartstikke gek van die Errorsafe! Ik zal nooit een klant worden van ze.

    I’ll become also crazy from the evil advertising from ErrorSafe. I shall never be a costumer from it.

  13. Krissy Hunter
    re: Evil Advertising from ErrorSafe.COM

    God this pisses me off! I wish I could send a virus through their damn computer…haha okay breathe…does anyone know how to stop it?????? temanakaha@hotmail.com

  14. HateErrorsafe
    re: Evil Advertising from ErrorSafe.COM

    Man give the maker of Errorsafe address, I promise i’ll spill his guts and post it on the net.

  15. Ferg
    Errorsafe

    Those that dont remove this bloody thing :

    lavasoft ad-aware zoftspySE (yep – i paid $29 for it )

    Am now trying spycatcher as they claim to do it.

    Also ran AVG rootkit killer – it found a dodgy file and blatted it – but still errorsafe / winfixer come up.

    Let order a hit on the building where these guys reside !.

  16. Gala
    re: Evil Advertising from ErrorSafe.COM

    I am just so infuriated with those new marketing methods… It even closed the site I was browsing to open their download website.

    Any idea how to spoil the mailbox of those people using such outrageous methods !

    I tried to send a message on their website and – oh surprise – it did not work !

    Do you think the address mentioned above works (Jardim info@errorsafe.com) ?

  17. Ultra.
    re: Evil Advertising from ErrorSafe.COM

    ErrorSafe is probably the reason why my PC blacked out permanently a few months ago. The week before the crash, I kept getting these ErrorSafe-messages. Often the PC would freeze up or restart after these alerts, or when I tried to remove ErrorSafe with anti-spyware programs… Then one day everything went black, when the OS was about to start up, and I could no longer start the computer outside of safe mode. Since I didn’t have a CD-Rom with the OS, which was installed in the computer when I purchased it, there was (as far as I know) nothing I could do about it.

    I hold ErrorSafe and their employees responsible for this. I am planning to take legal actions against ErrorSafe, and I suggest you do the same if you start having problems with your ErrorSafe-infected computers. We can and will bring these fuckers down if we make an effort, rather than just whine about it.

  18. Curry
    re: Evil Advertising from ErrorSafe.COM

    Hi all,

    The ErrorSafe scammers are notorious amongst website publishers as malware developers who continuously buy advertising campaigns on ad networks under new company names. First they get legit banners approved, after which stealth code is activated which redirects a viewing user to their homepage. Unpatched browsers may then even automatically install the malware, or you may be tempted to install their software. If ErrorSafe has been installed on your computer, you will see regular fake warnings pop up while browsing the internet, while in reality it’s trying to scam you out of money for buying a full version.

    You cannot blame the website it’s being hosted on, their banner networks will have to scan each of their ads manually (!!!) to see which is the misbehaving one and under which name they slipped in this time.

    Imho the guys behind this need to be shot and hung, but okay.

  19. Curry
    re: Evil Advertising from ErrorSafe.COM

    Addendum on my post above:

    DO NOT bother contacting the ErrorSafe people. They are criminals and scammers, nothing more. They will probably sell your email address to spammers if you contact them. The only reason the ErrorSafe website and its associated spyware exist is to scam you out of willingly purchasing the full version of their spyware, which consequently won’t kill a single piece of spyware of course.

  20. Platypus
    re: Evil Advertising from ErrorSafe.COM

    I really hate error safe. I got the warning mentioned above, and klicked the “x” to close it. Guess what, it tried to install it self, and sucseeded. I reinstalled my OS, and im using an older IE and Opera than before, but now it isent suceeding in installing itself when ever i get the warning. Strange…. I really wish that all the hackers in the world could fockus on bringing these guys down. If anyone could get the adress of those fuckers, im sure it would be a lot of bloody fun to visit them…

  21. 139.168.92.86
    re: Evil Advertising from ErrorSafe.COM

    gay my computers coming up with it asking me to get it? so does that mean i defiantly have not got it!!!?!!! coz my computers freezeing up, it sucks does it really do damage to ur computer mine froze up 2 times yesterday it never does HELP. crazzykat785@hotmail.com how can i get rid of this or atleast what its asking!!??

  22. bombskwad
    re: Evil Advertising from ErrorSafe.COM

    Yes, I found several spyware manufacturers who claim that they can rid you of errorsafe for a mere $19.99 (That’s about a tenner to us Brits at the present rate). Sorry to sound so cynical but maybe this is the whole purpose of the ‘software’…..

  23. zoom
    re: Evil Advertising from ErrorSafe.COM

    look what i found:

    Registrant: ErrorSafe, Inc. Caixa Postal 0021 Centro, RJ CEP 20010-974 BR

    Domain name: ERRORSAFE.COM

    Administrative Contact: Parizotto, Jardim info@errorsafe.com Caixa Postal 0021 Centro, RJ CEP 20010-974 BR +1.5672520048 Technical Contact: Parizotto, Jardim info@errorsafe.com Caixa Postal 0021 Centro, RJ CEP 20010-974 BR +1.5672520048

    Registrar of Record: TUCOWS, INC. Record last updated on 30-Aug-2006. Record expires on 04-Aug-2007. Record created on 04-Aug-2005.

    Domain servers in listed order: NS8.NSCACHE.NET 66.244.254.8 NS9.NSCACHE.NET 66.244.254.9

    Domain status: ok

    The Data in the Tucows Registrar WHOIS database is provided to you by Tucows for information purposes only, and may be used to assist you in obtaining information about or related to a domain name’s registration record.

    Tucows makes this information available “as is,” and does not guarantee its accuracy.

    By submitting a WHOIS query, you agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass, unsolicited, commercial advertising or solicitations to entities other than the data recipient’s own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of any Registry Operator or ICANN-Accredited registrar, except as reasonably necessary to register domain names or modify existing registrations.

    The compilation, repackaging, dissemination or other use of this Data is expressly prohibited without the prior written consent of Tucows.

    Tucows reserves the right to terminate your access to the Tucows WHOIS database in its sole discretion, including without limitation, for excessive querying of the WHOIS database or for failure to otherwise abide by this policy.

    Tucows reserves the right to modify these terms at any time.

    By submitting this query, you agree to abide by these terms.

    NOTE: THE WHOIS DATABASE IS A CONTACT DATABASE ONLY. LACK OF A DOMAIN RECORD DOES NOT SIGNIFY DOMAIN AVAILABILITY.

    The previous information has been obtained either directly from the registrant or a registrar of the domain name other than Network Solutions. Network Solutions, therefore, does not guarantee its accuracy or completeness. Show underlying registry data for this record

    Current Registrar: TUCOWS INC. IP Address: 66.244.254.63 (ARIN & RIPE IP search) IP Location: CA(CANADA)-ONTARIO-PETERBOROUGH Record Type: Domain Name Server Type: Apache Lock Status: ok Web Site Status: Active DMOZ no listings Y! Directory: see listings Web Site Title: ErrorSafe – Fix computer problem. Fix slow computer, corrupt file and hard drive errors. Secure: Yes E-commerce: Yes Traffic Ranking: 1 Data as of: 25-Jul-2006

  24. Mendez
    re: Evil Advertising from ErrorSafe.COM

    I was Half way through, the purchase and went for a walk (this is always recommended before final selection) and then remembered I *should always do a search* on a product or persons credibility or trustworthiness. Thanks Alex for the page & guys, keep up the reporting.

  25. Slayer0420
    re: Evil Advertising from ErrorSafe.COM

    This virus doesn’t even need Internet Exposer running. All i had open was Windows Live Messenger and i got the pop up trying to install itself. I try to close the pop up with the “X” and Suprize! it still trys to install itself. Luckily Internet Exposer 7 had blocked the auto install or id be fighting to get rid of it as well. Thanks to Microsoft for making your I.M. client as unsafe as Windows itself!

  26. rsquirrels
    re: Evil Advertising from ErrorSafe.COM

    So after reading all the posts, I’m still unclear about errorsafe’s effect on Mac OS. It popped up on Foxfire when I was using AnyWho. I immediately clicked cancel, but when it became clear it was starting to load anyway, I force quit. So question: Is it now resident on my G4? Will this be a recurring pop-up? Any advice appreciated. Thanks.

  27. Generalissimo
    re: Evil Advertising from ErrorSafe.COM

    Please someone give me those cunts address, the real one. I swear I will hunt them down and torture them to death. YOU HEAR THAT LUIZ DE CUNT-O?? YOU’RE A FUCKING DEAD MAN

  28. jejus
    re: Evil Advertising from ErrorSafe.COM

    Those effin’ cunts. I’m telling you, the first thing I’m gonna do when I see ErrorSafe guys’ ass, is shoving my cock deep down their throat till they choke and die.

    But more than anything, could anyone please, PLEASE come up with a clear, concise answer as to how I can delete this sickfuck off the face of the earth already??? It’s driving me so freaking INSANE along with that stupid WinAntiVirus shit that is also popping up continuously. HELP MUCH APPRECIATED… WHERE DID ALL THE TECH SAVVIES/GEEKS GO??

  29. alecm
    re: Evil Advertising from ErrorSafe.COM

    >WHERE DID ALL THE TECH SAVVIES/GEEKS GO??

    They all bought iBooks and left, seven years ago.

    Sorry.

  30. irate
    re: Evil Advertising from ErrorSafe.COM

    I am one of those that thought this was an actual program and downloaded from a legitimate site. My computer is destroyed, all my info is gone. Files that are important to me only, as well as Tax info, SS# out there somewhere. I want to know who to report this to!!! How do I get this info back and out of the hands of criminals. I am at the library while my computer is rebuilt and a search is bringing up nothing to help me. Thanks

  31. sarah hollingsworth
    re: Evil Advertising from ErrorSafe.COM

    i am new to computers i only got on line a few days ago{i am slow to catch on to new things} i have jst been reading your comments about this errorsafe.com and am now shitting myself can some one please tell me what it is and how o avoid it. thanks

  32. alecm
    re: Evil Advertising from ErrorSafe.COM

    Hi Sarah,

    The short version is: be a little sensitive and cynical about what you get offered “for free” on the net.

    Offers which seem to be “too good to be true”, typically are – especially when they try to thrust stuff upon you (“CLICK HERE FOR FREE DOWNLOAD!!!!!”)

    Stuff like that. Also: if you use Windows, make sure you have AntiVirus software and keep it up to date; also make backup copies of your most critical bits of data, at regular intervals.

    Also: brush your teeth, *and* floss. 🙂

    Basically follow the same advice you would give kids about talking to strangers. it’s not too scary, in truth. I’ve been using this stuff for 20+ years, only been burned a couple of times.

  33. sarah hollingsworththankc al
    re: Evil Advertising from ErrorSafe.COM

    thanks alecm for your ifo i’m sure i will pick it up as i go along just have to pray i don’t get burned.oh yeah i brush twice a day and floss every other and i also eat a healthy diet.

  34. 203.143.159.19
    re: Evil Advertising from ErrorSafe.COM

    Fucking ErrorSafe.COM. Kill ErrorSafe.COM

  35. Mr. Matt
    re: Evil Advertising from ErrorSafe.COM

    Norton Antivirus found my yesterday. Cleaned it right up. Yay!

  36. Mike Ecal

    I was fooled as Errorsafe came up as ‘Internet Explorer’ window and I unfortunately expected it would be safe to accept it … We can all make mistakes but when such Sh.. is advertised by obviously (now) fraudulent claims why cant the authorities take appropriate action TRADING STANDARDS I SUGGEST.

  37. bnefriends

    Yeah, and hopefully Errorsafe won’t exist much longer thanks to me reporting it to abuse@shawbusinesssolutions.ca, abuse@setupahost.net, and the FBI. Tracert (an MS DOS command that can trace most websites, in this case, tracert errorsafe.com) reports that it is hosted by Setupahost.net in Ontario Canada who uses shawbusinesssolutions.ca for the wireline, a Canadian cable company. It may also be of interest to know that as sloppy and useless as the site may look, it actually PLANTS ERRORS IN COMPUTERS! Go to http://www.trendmicro.com/vinfo/virusencyclo/default2.asp?m=q&virus=errorsafe%2Ecom&alt=errorsafe%2Ecom and let the antivirus experts tell u all there is to know about the trojan horses the so called Error remover puts in your computer.

  38. MarkMark

    Symantec AV 10.1.5.5000 is unable to fix it (partially fixed)

  39. Microsoft and the State of Washington have filed suits against a bunch of these scareware vendors..

    http://www.schneier.com/blog/archives/2008/10/scareware_vendo.html

Leave a Reply

Your email address will not be published. Required fields are marked *