Monthly Archives: June 2014

Unitech LLC – Digital Signature Warning!

June 28, 2014digital signatureRoger Karlsson

Short on time today, but I just wanted to give you the heads up on a publisher called Unitech LLC.

I found this file while browsing around at torrent site a few days ago. The file is digitally signed by Unitech LLC, which according to the digital certificate is located in Moscow, Russia:

The reason I’m writing this post is that the Unitech LLC file is detected by some of the anti-virus programs:

Did you also find a Unitech LLC file? What kind of download was it? Was it also detected by the anti-virus programs at VirusTotal?

Igor Moroz – Digital Signature Warning!

June 28, 2014digital signatureRoger Karlsson

Just wanted to give you the heads up on another publisher, named Igor Moroz, that bundles some software. If you have a Igor Moroz file on your machine you may have noticed that Igor Moroz is displayed as the publisher in the UAC dialog when double-clicking on the file.

You can also look at the Igor Moroz certificate and digital signature by looking under the Digital Signatures tab on the file’s properties. According to the certificate, Igor Moroz is located in Kiev, Ukraine.

These are the current VirusTotal detections for the file. TSULoader, InstallRex, InstalleRex and AntiFW are some of the detections shown by the anti-virus scanners.

If you already have installed the software packaged with the Igor Moroz file, you can delete these unwanted programs, files and settings with help from the FreeFixer tool.

Where did you find the Igor Moroz file? What kind of download was it?

How To Remove The Focusbase Adware

June 20, 2014adware, freefixerRoger Karlsson

Just stumbled on a new adware called Focusbase this morning. You might have noticed it on your machine by new ads labeled Ads by Focusbase appearing or the Focusbase add-ons listed in Firefox and Internet Explorer.

I found the Focusbase adware bundled with another program. The installer file was called FlvPlayer.exe and was digitally signed by a company called Outbrowse LTD.

Here’s how Focusbase was disclosed in the installer:

Focusbase content includes advertisements and is not affiliated with any underlying web sites.

So, how about the Focusbase removal? Easy peasy with FreeFixer. Just select the Focusbase files for removal in FreeFixer as shown in the screenshots below:

Hope this helped you figure out what Focusbase is, how it is installed on user’s computers and how to remove it.

How did you get the Focusbase adware on your machine?

Search App by Ask – What is it?

June 18, 2014UncategorizedRoger Karlsson

Are you looking in the Add/Remove Programs dialog and see something called Search App by Ask and wonder what is it and how you got it on your machine?

Search App by Ask is a Web browser toolbar. Below is an example how Search App appears in Firefox. Search App also installs a custom search engine that appears in the search field in the upper right corner of Firefox.

I found Search App while installing a program called FreeTorrentViewer. FreeTorrentViewer bundled Search App. Here’s how Search App was disclosed in the FreeTorrentViewer installer:

How did you get Search App on your machine? Was it also bundled with another download?

Sergey Panov Publisher – Warning!

June 16, 2014digital signatureRoger Karlsson

If you are a regular here on the FreeFixer blog, you know that I’ve been examining files that have a digital signature and bundle various types of potentially unwanted software. Today I found another publisher named Sergey Panov that bundles some software.

If you have a Sergey Panov file on your computer you may have noticed that Sergey Panov pops up as the publisher in the User Account Control dialog when running the file.

You can also examine the Sergey Panov certificate and digital signature by looking under the Digital Signatures tab on the file’s properties. According to the certificate, Sergey Panov is located in Kiev, Ukraine.

These are the current VirusTotal detections for the file. I’d say the 16/52 detection rate by the anti-virus programs is ok.

In case you have already installed the programs bundled with the Sergey Panov download, you can remove these unwanted programs, files and settings with help from the FreeFixer tool.

Where did you find the Sergey Panov download? What kind of download was it?

How To Remove Bubble Dock

June 15, 2014UncategorizedRoger Karlsson

Stumbled on something called Bubble Dock today. You might notice it since it opens up pop-ups in the lower right corner on the Windows desktop. Here are two examples:

I found Bubble Dock bundled with a free download. Here’s how it was disclosed in the installer:

Some of the anti-virus programs over at VirusTotal detects the Bubble Dock files:

If you’d like to uninstall Bubble Dock, you can do so from the Add/Remove programs dialog or with FreeFixer. Check the Firefox extension, LBubble Dock.exe, Bubble Dock.exe and axSurfMatch.dll for removal as shown in the screenshots:

Do you also have Bubble Dock on your machine? Any idea how it got there?

How To Remove V-Bates

June 15, 2014freefixerRoger Karlsson

Another quick post before getting to bed. I just found something called V-Bates, bundled with a free download. Here’s how V-Bates was disclosed in the installer:

The Terms and Condition link opened up a 404 Page Not Found, which can make it difficult for users to take an informed decision whether to install V-Bates or not.

Only a few of the anti-virus programs detects the V-Bates files:

Baidu and VIPRE refers to it as Wajam and Wajamu.

If you’d like to remove V-Bates you can simply do so by uninstalling it from the Add/Remove programs dialog.

If that fails for some reason you can also remove V-Bates with FreeFixer by checking notifier.exe, guardsvc.exe, extensionupdaterservice.exe, PrefHelper.exe, extension32.dll and extension64.dll for removal:

Do you have V-Bates on your machine? Any idea how it was installed?

Context2pro, conadvanced.exe, contextprod.exe and contextfr.exe – Removal Instructions

June 15, 2014freefixerCycloneAd, EldoradoRoger Karlsson

Just a quick post. Found something called Cyclon or Context2Pro bundled in a free download. This is how it appeared in the installer.

Clicking the EULA link opened up a 404 Not Found page. Once installed I noticed pop-ups from markettizer.net.

The anti-virus programs have a relatively good detection rate for Context2Pro:

To remove Context2Pro, check conadvanced.exe, contextprod.exe and contextfr.exe for removal in FreeFixer. During my testing there was no entry in the Add/Remove programs dialog for Context2pro.

How did you get Context2Pro on your computer?

What is PC Faster?

June 15, 2014UncategorizedRoger Karlsson

PC Faster is a program from Baidu with various scanning and cleaning features:

If PC Faster appeared unexpectedly on your machine, it may have been bundled with another download. Here’s how it was disclosed when I found it, while bundled with a download manager.

During my testing, the Terms and Condition link opened up a 404 Page Not Found browser tab.

Are you using PC Faster? Do you like it and does it speed up your computer as much as it claims?

How To Remove Sharp Savings Ads

June 15, 2014adware, freefixerRoger Karlsson

Gettings ads labeled “Ads by Sharp Savings” or text links with a mouse-over saying “Click to Continue > by Sharp Savings”.

Sharp Savings is bundled with free downloads. Here’s how it was disclosed when I found it:

You can remove Sharp Savings from the Windows Control Panel. During the uninstall you need to solve a CAPTCHA.

If the removal fails for some reason, you can remove Sharp Savings with FreeFixer, by selecting the Sharp Savings files (bservice.exe, wd.exe, updater.exe, framworkBHO.dll, etc) as shown in the screenshots. You will also need to manually restore your browser’s proxy settings.