Found a new Firefox add-on called W-Foxxer 0.45:
Easily removed with FreeFixer:
Thanks for reading!
Category Archives: freefixer
Remove ask.couplose.com Pop-Up Ads
Does this sound familiar? You see pop-up ads from ask.couplose.com while browsing websites that usually don’t advertise in pop-up windows. The pop-ups manage to find a way round the built-in pop-up blockers in Mozilla Firefox, Google Chrome, Internet Explorer or Safari. Maybe the ask.couplose.com pop-ups appear when clicking search results from a Google search? Or does the pop-ups appear even when you’re not browsing?
Here’s how the ask.couplose.com pop-up looked like when I got it on my machine.
(I know, lots of watermarks. Have to do it to stop the copy-cats.)
Does this sounds like your computer, you almost certainly have some adware installed on your system that pop up the ask.couplose.com ads. Don’t flame the people that owns the website you were at, the ads are almost certainly not coming from that website, but from the adware that’s running on your computer. I’ll do my best to help you remove the ask.couplose.com in this blog post.
For those that are new to the blog: Not long ago I dedicated some of my lab computers and deliberately installed a few adware programs on them. I have been monitoring the behaviour on these computers to see what kinds of ads that are displayed. I’m also looking on other interesting things such as if the adware updates itself automatically, or if it downloads and installs additional unwanted software on the machines. I first found the couplose.com pop-up on one of these lab systems.
ask.couplose.com resolves to the 208.43.241.245 address. ask.couplose.com was registered on 2014-09-18.
So, how do you remove the ask.couplose.com pop-up ads? On the machine where I got the ask.couplose.com ads I had TinyWallet, BuyNSave and BlockAndSurf installed. I removed them with FreeFixer and that stopped the ask.couplose.com pop-ups and all the other ads I was getting in Mozilla Firefox.
BlockAndSurf was the adware that caused the pop-ups in my case. I know this since the pop-up ad had a label with the adware name: “BlockAndSurf“.
What label did your pop-up ad have? Please share in the comments area below.
The issue with this type of pop-up is that it can be launched by many variants of adware. I think that adware such as NewPlayer, Salus, CheckMeUp and SaferSurf can also be responsible for the couplose.com popups. And there are probably other variants too. This makes it impossible to say exactly what you need to remove to stop the pop-ups.
Anyway, here’s my suggestion for the ask.couplose.com ads removal:
- Check what programs you have installed in the Add/Remove programs dialog in the Windows Control Panel. Do you see something that you don’t remember installing or that was recently installed?
- You can also examine the add-ons you installed in your browsers. Same thing here, do you see something that you don’t remember installing?
- If that didn’t help, I’d recommend a scan with FreeFixer to manually track down the adware. FreeFixer is a freeware tool that I’m working on that scans your computer at lots of locations, such as browser add-ons, processes, Windows services, recently modified files, etc. If you want to get additional details about a file in the scan result, you can click the More Info link for that file and a web page will open up with a VirusTotal report which will be very useful to determine if the file is safe or malware:
An example of FreeFixer’s “More Info” links. Click for full size.
Here’s a video tutorial which shows FreeFixer in action removing adware causing pop-up ads:
Are you a Mac or Linux user and get the ask.couplose.com pop-ups? What did you do to stop the pop-up in your browser? Please share in the comments below. Thanks!
Did you find any adware on your machine? Did that stop the ask.couplose.com ads? Please post the name of the adware you uninstalled from your machine in the comment below.
Thank you!
Remove GadgetPrise Ads – Adware Removal Instructions
Just wanted to write a short post before going back to programming on FreeFixer. I was reviewing some files that recently were submitted to the FreeFixer library and found a new BrowseFox variant called GadgetPrise.
GadgetPrise is, as many of the other BrowseFox variants, bundled with downloads such as media player, PDF converters, etc. Bundled means that it is included in another software’s installer. Generally, you can avoid bundled software such as GadgetPrise by being careful when installing software and declining the bundled offers in the installer.
When I test some new bundled software I always upload it to VirusTotal to test if the antiviruses there detect anything fishy. 44% of the antivirus scanners detected the file. BitDefender reports GadgetPrise as Gen:Variant.Adware.SwiftBrowse.1, DrWeb reports Trojan.BPlug.281, ESET-NOD32 detects it as Win32/BrowseFox.V and Kaspersky reports not-a-virus:AdWare.Win32.Yotoon.bfm.
I’m sure you’d like to remove GadgetPrise, and that’s easy with FreeFixer. You can identify the GadgetPrise files, since they are digitally signed by GadgetPrice as shown in the screen capture above. After selecting the files, click Fix, and reboot your machine and the problem should be gone.
Hope that helped you to figure out how to do the removal.
Do you also have GadgetPrice on your machine? Any idea how it was installed? Please share by posting a comment. Thanks!
Hope you found this useful. Thanks for reading.
Remove Hold Page and the Hold Page Ads
Hello readers. Another day, another blog post. Did something called Hold Page appear on your system? This is a variant of CrossRider that I’ve written about many times before. If you have Hold Page installed on your machine, you will see new add-ons installed in Mozilla Firefox and Internet Explorer. Nothing was installed in Google Chrome. I’ll show how to remove Hold Page in this blog post with the FreeFixer removal tool.
Hold Page is bundled with other software. Bundled means that it is included in another software’s installer. Generally, you can avoid bundled software such as Hold Page by being careful when installing software and declining the bundled offers in the installer and making sure that you have downloaded the software from the official site and not from some third party.
When I find some new bundled software I normally upload it to VirusTotal to verify if the anti-virus progams there detect something suspicious. 11 of the 55 scanners detected the file. The Hold Page files are detected as BrowseFox.F by AVG, Trojan.BPlug.215 by DrWeb and PUP.Optional.HoldPage.A by Malwarebytes.
If you would like to remove HoldPage you can do so with the FreeFixer removal tool. Here’s a few screengrabs from the removal that should help you: You may have to restart your computer to complete the removal.
Hope this helped you solved the HoldPage problem.
I stumbled upon Hold Page while testing out some downloads that are known to bundled lots of unwanted software. Any idea how Hold Page was installed on your machine? Please share your story the comments below. Thank you very much!
Thanks for reading. Welcome back!
What is FoxWebber 1.2 and How To Remove It
FoxWebber is a Firefox add-on that comes bundled with other software. I think you should remove it. You can remove it with FreeFixer on manually in Firefox.
I’d recommend that you review your computer for additional unwanted software.
Any idea how you got FoxWebber 1.2 on your machine?
Thanks for reading.
How To Remove cloudtracked.com Pop-Up Ads
Having issues with pop-ups or new tabs appearing from cloudtracked.com? If that is the case, you may have adware installed on your computer. I got the cloudtracked.com pop-ups in Firefox, but they can appear if you are using Chrome, Internet Explorer, Safari or Opera too.
(Sorry for the ridiculous use of watermarks. I have to do it to stop the copy-cats.)
If this sounds like your experience, you most likely have some adware installed on your machine that pop up the cloudtracked.com ads. I’ll do my best to help you with the cloudtracked.com removal in this blog post.
Those that have been reading this blog already know this, but for new visitors: A little while back I dedicated some of my lab machines and intentionally installed a few adware programs on them. I’ve been following the behaviour on these computers to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware auto-updates, or if it downloads and installs additional unwanted software on the systems. I first spotted the cloudtracked.com pop-up on one of these lab systems.
So, how do you remove the cloudtracked.com pop-up ads? On the machine where I got the cloudtracked.com ads I had BlockAndSurf, TinyWallet and BrowserWarden installed. I removed them with FreeFixer and that stopped the cloudtracked.com pop-ups and all the other ads I was getting in Mozilla Firefox. I don’t know which one of the adware that were responsible for the pop-ups.
It seems as cloudtracked.com is getting quite a lot of traffic, based on Alexa’s traffic rank:
Or that probably an understatement. Rank 853 means they are getting a tremendous amount of traffic. Their traffic seems to have boomed in end of July/beginning of August judging from diagram above. www.cloudtracked.com resolves to the 54.183.91.145 IP address. There’s another site on the same IP called media770.com.
The issue with this type of pop-up is that it can probably be launched by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.
To remove the cloudtracked.com pop-up ads you need to review your machine for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:
The first thing I would do to remove the cloudtracked.com pop-ups is to examine the software installed on the machine, by opening the “Uninstall programs” dialog. You can reach this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows Operating System you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Do you see something shady in there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if some program was installed approximately about the same time as you started seeing the cloudtracked.com pop-ups.
I think most users will be able to identify and remove the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I’ve developed since 2006. FreeFixer is a tool built to manually find and uninstall unwanted software. When you’ve found the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.
FreeFixer’s removal feature is not locked like many other removal tools out there. It will not require you to purchase the program just when you are about to remove the unwanted files.
And if you’re having troubles figuring out if a file is legit or unsafe in FreeFixer’s scan report, click on the More Info link for the file. That will open up your browser with a page which contains additional information about the file. On that web page, check out the VirusTotal report which can be quite useful:
Are you a Mac or Linux user and get the cloudtracked.com pop-ups? What did you do to stop the pop-up in your browser? Please share in the comments below. Thanks!
Did this blog post help you to remove the cloudtracked.com pop-up ads? Please let me know or how I can improve this blog post.
Thank you!
How To Remove Augmenter and Augmenter.exe
Did you find Augmenter on your machine?
You can remove Augmenter with FreeFixer:
Or from the Windows Control Panel:
Did that solve the problem?
Remove BrickBooster / BrickBooster.exe – Reported as Adware and Trojan
Just a short post on this. If you’ve found the BrickBooster trojan / adware on your machine, you should remove it. Either using FreeFixer or from the Add/Remove programs dialog.
The BrickBooster.exe process:
Here’s how to remove BrickBooster from the Windows Control Panel:
Thanks for reading.
Remove BrickStrengthener – BrickStrengthener.exe Uninstall Guide
Hello readers. Welcome to the blog. Today I wanted to talk about an adware/trojan called BrickStrengthener and thought I should give you some removal instructions. If the BrickStrengthener adware is running on your machine, you will see BrickStrengthener.exe running in the Task Manager and a new scheduled task called “BrickStrengthener” added on the computer. I’ll show how to remove BrickStrengthener in this blog post with the FreeFixer removal tool.
BrickStrengthener.exe is located in C:\ProgramData\Trusted Publisher\BrickStrengthener\.
BrickStrengthener is distributed by a tactic called bundling. Bundling means that a piece of software is included in other software’s installers.
As always when I stumble upon some new bundled software I uploaded it to VirusTotal to check if the anti-virus software there detect anything suspicious. 30% of the scanners detected the file. The BrickStrengthener files are detected as TR/Crypt.ZPACK.73153 by Avira, Trojan.GenericKD.1867152 by F-Secure, Artemis!DEBA33DB1675 by McAfee and BehavesLike.Win32.FakeAlert.bc by McAfee-GW-Edition.
Since you probably want to remove BrickStrengthener, these are the items you should check for removal if you want to remove it with FreeFixer. A reboot of your machine may be required to complete the removal. Problem solved.
Hope this helped you remove the BrickStrengthener adware.
I stumbled upon BrickStrengthener while testing out some downloads that are known to bundled lots of unwanted software. Any idea how BrickStrengthener was installed on your system? Please share by posting a comment. Thank you very much!
Hope you found this useful. Thanks for reading.
Remove BuyNSave and BrickProvider Adware
Just wanted to write a short blog post before going back to coding. I just found another bundled adware called BuyNSave / BrickProvider and give you some removal instructions. If you got BuyNSave / BrickProvider on your computer, you will see BrickProvider.exe running in the Task Manager, an add-on named BuyNSave added into Internet Explorer and Mozilla Firefox and a new scheduled task called BrickProvider. Chrome dodged the adware. I’ll show how to remove BuyNSave / BrickProvider in this blog post with the FreeFixer removal tool.
Here’s BrickProvider.exe in the Task Manager:
BuyNSave add-on in Firefox:
And BuyNSave in Internet Explorer:
BuyNSave / BrickProvider is bundled in other software’s installers. Here’s how it was disclosed in the installer where I found it:
YouTubeAdBlocke was also included in the installer.
As always when I find some new bundled software I uploaded it to VirusTotal to test if the anti-malwares there find something. The detection rate is 11/55. Malwarebytes classifies BuyNSave / BrickProvider as PUP.Optional.MultiPlug, McAfee-GW-Edition calls it BehavesLike.Win32.PWSYunsip.bm and Qihoo-360 calls it HEUR/QVM30.1.Malware.Gen.
If you’d like to remove BuyNSave / BrickProvider you can do so with the FreeFixer removal tool. Just check the BuyNSave / BrickProvider files as the screenshots below shows. You may have to reboot your computer to complete the removal.
Hope that helped you with the removal.
I stumbled upon BuyNSave / BrickProvider while testing out some downloads that are known to bundled lots of unwanted software. Any idea how BuyNSave / BrickProvider was installed on your system? Please share by posting a comment. Thank you!
Hope you found this useful and thanks you for reading.
Update 2014-11-21: Found some variants that don’t use the BrickProvider name. Instead they are called:
BrickProlonger & SoftwareProlonger. SoftwareProlonger.exe shows up in the Task Manager. The file is located in c:\programdata\trusted publisher\softwareprolonger.