Do you see ads labeled Ads by PassShow on your machine?
Then you got the PassShow adware installed. You may also see pop-ups from the gld.pathticket.net web site.
PassShow is pretty easy to delete with FreeFixer. The following removal instructions will remove PassShow from Internet Explorer and Mozilla Firefox.
- Download, install and start FreeFixer
- Start the scan.
- Check 150.dll, PsUp.exe and 150.xpi for removal in the scan result, as shown in the screenshots below.
- Click Fix
- Restart your machine.
How did you get PassShow on your machine? I found it while testing a download from CNet’s Download.com site.
Found another adware program this morning: ShopperPro. If you got this on your machine, you will see ads popping up while browsing. They ads are labeled “by shopper pro“, “Powered by Shopper-Pro” or “brought by ShopperPro“:
You can remove Shopper Pro by checking the following files in FreeFixer’s scan result:
There’s also a Shopper-Pro entry in the Add/Remove programs window in the Control Panel.
I found ShopperPro bundled with a free download. Where did you find ShopperPro? Did you also find it packaged with another download?
Just a quick update. I’ve just uploaded a small removal tutorial for the iWeBar software.
If you have the iWeBar installed on your machine, you’ll probably see iWebar-bg.exe running in the Windows Task Manager and ads labeled “Powered by iwebar” in Chrome, Firefox and Internet Explorer.
There’s also a bunch of other iWeBar files that will be run by the Windows Task Scheduler that appears in FreeFixer’s scan result.
Here’s the video:
Update 5th November: The iWebar adware is still distributed. Now the iWebar files are digitally signed by Gogo Network Club. According to the embedded certificate Gogo Network Club is located in Nicosia, Cyprus.
Are you getting ads labeled “Powered by Object Browser” or “Brought by Object Browser” while browsing sites such as BestBuy, E-Bay, Walmart or Amazon?
If so, you have the ObjectBrowser adware installed on your machine. Here’s a tutorial on how to remove Object Browser:
Update 2014-11-13: Now the Object Browser files are digitally signed by “Sara Kodama Project“.
Update 2014-11-19: Now the files are signed by Tita-nium Great Minds. Titanium is also located in Nicosia, Cyprus.
Update 2014-12-19: Now the files are signed by Armageddon Labs (BrightCircle Investments Limited).
Found another bundled piece of software today called FreeSoftToday. It opens up a pop-up with free software offers.
These are the main files for FreeSoftToday:
The FreeSoftToday files are detected by some of the anti-virus programs when I uploaded them to VirusTotal. Here are the detection names:
- Avast – Win32:Eorezo-CB [PUP] 20131211
- Microsoft – Adware:Win32/EoRezo 20131211
- Malwarebytes – Adware.Tuto4PC 20131211
- ESET-NOD32 – a variant of Win32/Adware.EoRezo.AT 20131211
Here’s a short video tutorial on how to remove FreeSoftToday:
Found another variant of the WebCake adware called Albrechto. As usual it is bundled with free downloads.
If you have Albrechto on your machine, you will see an extension listed in Mozilla Firefox and AlbrechtoBHO.dll loaded into Internet Explorer.
Albrechto can be uninstalled from the Add/Remove programs dialog.
You can also remove Albrechto with FreeFixer. Here’s a video tutorial:
Yesterday I found another adware program called BrowseSmart. BrowseSmart can show various types of ads. During my testing it added a frame on the left side of the web browser window with “Related Searches“.
BrowseSmart is bundled with free downloads. I found it in a program called “File Extractor”. The screenshot also explains what types of ads BrowseSmart can show.
If you have BrowseSmart installed on your machine, you’ll see it listed in Internet Explorer’s and Mozilla Firefox’s extension list:
You will also see BrowseSmartBHO.dll loaded into Internet Explorer.
BrowseSmart can be uninstalled from the Add/Remove programs dialog.
You can also remove BrowseSmart with FreeFixer. Here’s a removal tutorial:
Sorry for not posting or doing any work on the FreeFixer program for the last month. Due to some unexpected events I’ve spent the last 30 days in the hospital with my new born son. Luckily everything is under control and the three of us are back home.
Today I found an adware program called Outobox. It is bundled with downloads from CNET.
The Outobox Terms and Conditions describes the Outobox functionality as shown in the screenshot.
Outobox can show many types of ads, such as search ads, banner ads, text ads, etc.
Unfortunately I’ve not managed to trigger the Outobox ads on my lab machine, therefore no screenshot of the actual ads. I assume the ads are labeled “Outobox”.
Do you see the Outobox ads on your machine? Please send a screenshot and I’ll update this blog post.
If you have Outobox installed on your machine, you’ll see the Outobox Extension listed in Firefox, Chrome and Internet Explorer. You’ll also see outoboxbho.dll loaded into Internet Explorer.
Removing Outobox is easy. Just uninstall it from the Add/Remove programs dialog. If the removal fails you can remove Outobox with FreeFixer.
Please let me know what you think about Outobox by posting a comment.