Tag Archives: Zusy

Remove PriceMinus – “Ads by PriceMinus” Removal

Welcome! Just a quick post on the PriceMinus adware. PriceMinus seems to be a variant of SalePlus that I blogged about some time ago. If PriceMinus is running on your computer, you will notice ads labeled “Ads by PriceMinus” inserted into Google search results and on other web sites.

Ads by PriceMinus on web site Ads by PriceMinus on Google

You will also see new add-ons installed into Firefox and Internet Explorer. In my case, it was called PriceMinus 2.0.

PriceMinus 2.0 Firefox add-on

 

In my specific case, the installer file was digitally signed by Rodion Veresev. I’ve also seen Saul Perec  signing PriceMinus installer files.

I’ll show how to remove PriceMinus in this blog post with the FreeFixer removal tool.

PriceMinus is bundled in other software’s installers. Here’s how it appeared in the installer:

PriceMinus installer

Generally, you can avoid bundled software such as PriceMinus by being careful when installing software and declining the bundled offers in the installer.

Here’s a screenshot of the adware’s web site, priceminus.info:

priceminus.info web site

Another program, called BestAdBlocker was also bundled side by side with PriceMinus. You probably want to remove BestAdBlocker too.

When I run into some new bundled software I always upload it to VirusTotal to see if the anti-malware programs there detect something suspicious. 36 of the 56 scanners detected the file. ClamAV classifies PriceMinus as Win.Trojan.Multiplug-3213, F-Secure calls it Gen:Variant.Application.Zusy, GData detects it as Gen:Variant.Application.Zusy.139555, Malwarebytes calls it PUP.Optional.MultiPlug.A and TrendMicro reports TROJ_GEN.R08NC0EE515.

PriceMinus anti-virus report

All you need to do to remove PriceMinus is to check the PriceMinus files in the scan result and click the Fix button. You may have to restart your machine to complete the removal. Just select the PriceMinus files as shown in the screenshots below.

PriceMinus remove ie PriceMinus remove firefox

Hope this helped you remove the PriceMinus adware.

Do you also have PriceMinus on your computer? Any idea how it was installed? Please let me and the readers know by posting a comments. Thank you!

Thanks for reading. Welcome back!

Igor Kramoren – Warning for files signed by this publisher!

Stumbled on a file this morning, digitally signed by Igor Kramoren.

Igor Kramoren Certificate Igor Kramoren publisher

The issue with the Igor Kramoren file is that it is detected by many of the anti-virus programs. Here are some of the detection names:

  • BitDefender Gen:Variant.Zusy.100672
  • DrWeb Trojan.Siggen6.21336
  • ESET-NOD32 a variant of Win32/AdWare.MultiPlug.AQ
  • F-Secure Gen:Variant.Zusy.100672
  • Ikarus AdWare.Graftor
  • Malwarebytes PUP.Optional.InstallRex
  • McAfee PUP-FMH
  • Panda Trj/Kazy.AS

Did you also find a file digitally signed by Igor Kramoren? What kind of download was it and where did you find it?