Monthly Archives: December 2014

Remove fingerbedroom.xyz Pop-Up Ads Survey

December 9, 2014adware, pop-ups, survey184.73.247.179, 50.116.45.187Roger Karlsson

Did you just get a popup survey from fingerbedroom.xyz and wonder where it came from? Did the fingerbedroom.xyz ad appear to have been initiated from a web site that under normal circumstances don’t use aggressive advertising such as pop-up windows? Or did the fingerbedroom.xyz pop-up show up while you clicked a link on one of the major search engines, such as Google, Bing or Yahoo?

Here’s a screenshot of the fingerbedroom.xyz pop-up survey when it showed up on my computer:

If this sounds like what you are seeing on your machine, you probably have some adware installed on your machine that pops up the fingerbedroom.xyz surveys. So there’s no use contacting the site owner for the site you were at. The ads are not coming from them. I’ll do my best to help you remove the fingerbedroom.xyz pop up in this blog post.

If you have been following this blog already know this, but if you are new: Some time ago I dedicated a few of my lab computers and intentionally installed some adware programs on them. Since then I have been observing the behaviour on these machines to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware updates itself automatically, or if it installs additional unwanted software on the computers. I first found the fingerbedroom.xyz pop-up on one of these lab systems.

fingerbedroom.xyz resolves to the 184.73.247.179 IP address and lcezz.super-promo.fingerbedroom.xyz to 50.116.45.187. fingerbedroom.xyz was created on 2014-12-03.

So, how do you remove the fingerbedroom.xyz pop-up ads? On the machine where I got the fingerbedroom.xyz ads I had TinyWallet, BlockAndSurf and BrowserWarden installed. I removed them with FreeFixer and that stopped the fingerbedroom.xyz pop-ups and all the other ads I was getting in Firefox.

The issue with pop-ups such as this one is that it can be initiated by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

So, what should done to solve the problem? To remove the fingerbedroom.xyz pop-up ads you need to examine your computer for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:

What software do you have installed if you look in the Add/Remove programs dialog in the Windows Control Panel? Something that you don’t remember installing yourself or that was recently installed?
You can also check the add-ons you installed in your browsers. Same thing here, do you see something that you don’t remember installing?
If that didn’t help, you can give FreeFixer a try. FreeFixer is built to assist users when manually tracking down adware and other types of unwanted software. It is a freeware utility that I’ve been working since 2006 and it scans your computer at lots of locations where unwanted software is known to hook into your computer. If you would like to get additional details about a file in FreeFixer’s scan result, you can just click the More Info link for that file and a web page with a VirusTotal report will open up, which can be very useful to determine if the file is safe or malware:
An example of FreeFixer’s “More Info” links. Click for full size.

Here’s a video tutorial on how to remove the pop-ups with FreeFixer:

Are you a Mac or Linux user and get the fingerbedroom.xyz pop-ups? What did you do to stop the pop-up in your browser? Please share in the comments below. Thank you!

Did you find any adware on your machine? Did that stop the fingerbedroom.xyz ads? Please post the name of the adware you uninstalled from your machine in the comment below.

Thank you!

Remove prg.coolappsa.com Pop-Up Ads

December 8, 2014adware, pop-ups208.43.241.244, Coup Pop-UpRoger Karlsson

Did you just get a pop-up from prg.coolappsa.com and wonder where it came from? Did the prg.coolappsa.com ad appear to have been launched from a web site that under normal circumstances don’t use aggressive advertising such as pop-up windows? Or did the prg.coolappsa.com pop-up show up while you clicked a link on one of the major search engines, such as Google, Bing or Yahoo?

Here’s how the prg.coolappsa.com pop-up looked like when I got it on my computer:

When I first spotted the pop-up, it redirected to adcash.com, which then redirected to the actual ad.

If you also see this on your system, you most likely have some adware installed on your system that pops up the prg.coolappsa.com ads. There’s no use contacting the owners of the site you currently were browsing. The ads are not coming from them. I’ll try help you with the prg.coolappsa.com removal in this blog post.

Those that have been spending some time on this blog already know this, but for new visitors: A little while back I dedicated a few of my lab computers and intentionally installed a few adware programs on them. Since then I’ve been tracking the behaviour on these machines to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware updates itself, or if it installs additional unwanted software on the computers. I first spotted the prg.coolappsa.com pop-up on one of these lab computers.

prg.coolappsa.com was registered on 2014-11-23. prg.coolappsa.com resolves to the 208.43.241.244 address. According to YouGetSignal.com’s reverse ip lookup, the following domains is also resolving to the same IP:

control.staticlyrics.com
dss.drivefor.net
gir.driveropti.net
gym.macpath.net
jco.mappre.net
nsl.mapticket.net

So, how do you remove the prg.coolappsa.com pop-up ads? On the machine where I got the prg.coolappsa.com ads I had TinyWallet, BlockAndSurf and Browser Warden installed. I removed them with FreeFixer and that stopped the prg.coolappsa.com pop-ups and all the other ads I was getting in Mozilla Firefox.

BlockAndSurf was the adware that caused the pop-ups in my case. The pop-up was labelled “BlockAndSurf“.

What label did your pop-up ad have? Please share in the comments area below.

The bad news with pop-ups like this one is that it can be initiated by many variants of adware. I think that adware such as CheckMeUp, New Player, Salus and SaferSurf can also be responsible for the prg.coolappsa.com popups. And there are probably other variants too. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

So, what can be done? To remove the prg.coolappsa.com pop-up ads you need to examine your computer for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:

The first thing I would do to remove the prg.coolappsa.com pop-ups is to examine the software installed on the machine, by opening the “Uninstall programs” dialog. You can find this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:

Do you see something suspicious listed there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if some program was installed about the same time as you started getting the prg.coolappsa.com pop-ups.

Then I would check the browser add-ons. Adware often appear under the add-ons menu in Mozilla Firefox, Google Chrome, Internet Explorer or Safari. Is there anything that looks suspicious? Anything that you don’t remember installing?

I think you will be able to track down and uninstall the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop about 8 years ago. Freefixer is a tool built to manually track down and uninstall unwanted software. When you’ve found the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not locked like many other removal tools out there. It will not require you to pay for the program just when you are about to remove the unwanted files.

And if you’re having difficulties determining if a file is legit or adware in FreeFixer’s scan report, click on the More Info link for the file. That will open up a web page which contains more details about the file. On that web page, check out the VirusTotal report which can be very useful:

FreeFixer More Info link example — An example of FreeFixer’s “More Info” links. Click for full size.

Here’s a video guide showing how to remove the prg.coolappsa.com pop-up ads with FreeFixer:

Did this blog post help you to remove the prg.coolappsa.com pop-up ads? Please let me know or how I can improve this blog post.

Thank you!

Remove hdapp1006-a.akamaihd.net from Chrome, Firefox and Internet Explorer

December 6, 2014browser status barRoger Karlsson

This page shows how to remove hdapp1006-a.akamaihd.net from Mozilla Firefox, Google Chrome and Internet Explorer.

Sound familiar? You see hdapp1006-a.akamaihd.net in your web browser’s status bar or in the network log while browsing on sites that mostly don’t load any content from third party domains. Perhaps the hdapp1006-a.akamaihd.net domain appear when performing a search at the Google search engine?

Here’s a screen capture of hdapp1006-a.akamaihd.net when it showed up on my system in the network log when I did a Google search:

When I visited the web site, I was greeted with the following message:

Thank you for your interest in Easyinline. This product has been discontinued.

The following are some of the status bar messages you may see in your browser’s status bar:

Waiting for hdapp1006-a.akamaihd.net…
Transferring data from hdapp1006-a.akamaihd.net…
Looking up hdapp1006-a.akamaihd.net…
Read hdapp1006-a.akamaihd.net
Connected to hdapp1006-a.akamaihd.net…

If this sounds like what you are seeing on your system, you almost certainly have some adware or some other type of potentially unwanted software installed on your computer that makes the hdapp1006-a.akamaihd.net domain appear in your web browser. Contacting the owner of the site you were browsing would be a waste of time. They are not responsible for the hdapp1006-a.akamaihd.net status bar notifications. I’ll try help you to remove the hdapp1006-a.akamaihd.net status bar messages in this blog post.

For those that are new to the blog: Some time ago I dedicated a few of my lab computers and deliberately installed some adware programs on them. Since then I have been tracking the behaviour on these computers to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware auto-updates, or if it installs additional unwanted software on the machines. I first spotted the hdapp1006-a.akamaihd.net in Mozilla Firefox’s status bar on one of these lab machines.

hdapp1006-a.akamaihd.net resolves to 23.62.7.40.

So, how do you remove hdapp1006-a.akamaihd.net from your web browser? On the machine where hdapp1006-a.akamaihd.net showed up in the status bar I had Taplika and Clock Hand installed. I removed them with FreeFixer and that stopped the browser from loading data from hdapp1006-a.akamaihd.net.

The issue with status bar messages like the one described in this blog post is that it can be caused by many variants of adware, not just the adware running on my system. This makes it impossible to say exactly what you need to remove to stop the statusbar messages.

So, what can be done? To remove hdapp1006-a.akamaihd.net you need to examine your machine for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:

The first thing I would do to remove hdapp1006-a.akamaihd.net is to examine the programs installed on the machine, by opening the “Uninstall programs” dialog. You can find this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows Operating System you can just type in “uninstall” in the Control Panel’s search field to find that dialog:

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:

Do you see something suspicious listed there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if some program was installed approximately about the same time as you started getting the hdapp1006-a.akamaihd.net status bar messages.

Then you can examine you web browser add-ons. Adware often appear under the add-ons dialog in Google Chrome, Mozilla Firefox, Internet Explorer or Safari. Is there anything that looks suspicious? Something that you don’t remember installing?

I think most users will be able to identify and remove the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop about 8 years ago. It’s a tool designed to manually find and uninstall unwanted software. When you’ve identified the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not locked down like many other removal tools out there. It won’t require you to pay a fee just when you are about to remove the unwanted files.

And if you’re having a hard time determining if a file is safe or unsafe in FreeFixer’s scan report, click on the More Info link for the file. That will open up a web page which contains additional details about the file. On that web page, check out the VirusTotal report which can be very useful:

Did you find any adware on your machine? Did that stop hdapp1006-a.akamaihd.net? Please post the name of the adware you uninstalled from your machine in the comment below.

Thank you!

IMALI – N.I. MEDIA TD – Detection Rate: 1/54 – Legit or malware?

December 5, 2014digital signatureIsrael, Ramat Gan, Tel AvivRoger Karlsson

Hi there! Just a quick post this Friday evening. Did you see a file, such as setup.exe, on your system signed by IMALI – N.I. MEDIA TD? Then read on..

You can see who the signer is when double-clicking on an executable file. IMALI – N.I. MEDIA TD appears in the publisher field in the dialog that pops up.

It is also possible to check a digital signature by looking at a file’s properties. Here’s a screenshot of the IMALI – N.I. MEDIA TD certificate.

The detection rate is only 1/54, that is 2%. The setup.exe file is detected as suspected of Trojan.Downloader.gen.h by VBA32. What do you think, is it a false positive or should the other anti-virus programs detect it?

Did you also find a IMALI – N.I. MEDIA TD file? Do you remember where you downloaded it?

Thank you for reading.

Update 2015-01-28: Found another file signed by IMALI – N.I. MEDIA TD. It’s called ESy1Avb1ax.exe and it is detected by 7 of the 57 anti-virus programs at VirusTotal:

Update 2015-02-16: Found another file, with a slightly different publisher name: “IMALI – N.I. MEDIA LTD“. The publisher is located in Ramat Gan, Israel according to the certificate. These are the detections (8/57):

Avira TR/Dldr.Agent.443648
AVware Trojan.Win32.Generic!BT
GData Win32.Trojan.Agent.W8AUB8
Ikarus Trojan-Downloader.Agent
Qihoo-360 HEUR/QVM10.1.Malware.Gen
Symantec Infostealer.Limitail
TrendMicro-HouseCall Suspicious_GEN.F47V0210
VIPRE Trojan.Win32.Generic!BT

Remove ale.coupthree.com Pop-Up Ads

December 4, 2014adware, pop-ups208.43.241.245, Coup Pop-UpRoger Karlsson

Does this sound like what you are seeing right now? You see pop-up ads from ale.coupthree.com while browsing sites that mostly don’t advertise in pop-up windows. The pop-ups manage to circumvent the built-in pop-up blockers in Google Chrome, Mozilla Firefox, Internet Explorer, Safari or Opera. Maybe the ale.coupthree.com popups appear when clicking search results from the Google search engine? Or does the pop-ups appear even when you’re not browsing?

Here is a screenshot on the ale.coupthree.com pop-up from my computer:

In my case, the pop-up sometimes redirected to adcash.com, which then redirect me again to the actual advert, but in most cases the browser remained at ale.coupthree.com and showed various types of ads, mostly casino/gambling related.

If this sounds like what you are seeing on your system, you almost certainly have some adware installed on your system that pops up the ale.coupthree.com ads. Contacting the site owner would be a waste of time. The advertisements are not coming from them. I’ll try help you with the ale.coupthree.com removal in this blog post.

Those that have been visiting this blog already know this, but here we go: Some time ago I dedicated some of my lab computers and deliberately installed a few adware programs on them. Since then I have been following the actions on these machines to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware updates itself, or if it downloads and installs additional unwanted software on the computers. I first found the ale.coupthree.com pop-up on one of these lab systems.

ale.coupthree.com resolves to the 208.43.241.245 IP address. Here’s a bunch of other domains resolving that server according to YouGetSignal.com’s reverse IP:

article.wn.com
control.staticlyrics.com
dvl.cooloideas.com
enl.trepage.net
gip.driverdiv.net
gir.driveropti.net
gys.mappingdo.net
jxs.mappingjava.net
jxw.javadrive.net
nsl.mapticket.net
vei.screedkeywaybrookite.com

So, how do you remove the ale.coupthree.com pop-up ads? On the machine where I got the ale.coupthree.com ads I had TinyWallet, BrowserWarden and BlockAndSurf installed. I removed them with FreeFixer and that stopped the ale.coupthree.com pop-ups and all the other ads I was getting in Mozilla Firefox.

BlockAndSurf was the adware that caused the pop-ups in my case. The pop-up was labelled “Ads by BlockAndSurf“.

What label did your pop-up ad have? Please share by posting a comment below.

The problem with pop-ups such as this one is that it can be popped up by many variants of adware. I think that adware such as SpeedCheck, CheckMeUp, SaferSurf and NewPlayer can also be responsible for the ale.coupthree.com popups. And there are probably other variants too. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

To remove the ale.coupthree.com pop-up ads you need to review your system for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:

The first thing I would do to remove the ale.coupthree.com pop-ups is to examine the programs installed on the machine, by opening the “Uninstall programs” dialog. You can reach this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:

Do you see something dubious in there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if something was installed approximately about the same time as you started getting the ale.coupthree.com pop-ups.

Then you can examine you browser add-ons. Adware often appear under the add-ons dialog in Mozilla Firefox, Google Chrome, Internet Explorer or Safari. Is there anything that looks suspicious? Something that you don’t remember installing?

I think most users will be able to find and remove the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop about 8 years ago. Freefixer is a tool designed to manually track down and remove unwanted software. When you’ve identified the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not locked like many other removal tools out there. It will not require you to purchase the program just when you are about to remove the unwanted files.

And if you’re having difficulties figuring out if a file is clean or adware in FreeFixer’s scan report, click on the More Info link for the file. That will open up a web page which contains more information about the file. On that web page, check out the VirusTotal report which can be quite useful:

Here’s a video tutorial which shows FreeFixer in action removing the adware that caused the ale.coupthree.com pop-up ads:

Are you a Mac or Linux user and get the ale.coupthree.com pop ups? What did you do to stop the pop-up in your browser? Please share in the comments below. Thanks!

Did this blog post help you to remove the ale.coupthree.com pop-up ads? Please let me know or how I can improve this blog post.

Thank you!

How To Remove adservercentral.com Pop-Up Ads

December 2, 2014adware, pop-ups207.34.202.27, 209.15.247.29Roger Karlsson

Did you just get a popup or new tab from adservercentral.com and wonder where it came from? Did the adservercentral.com ad appear to have been popped up from a web site that under normal circumstances don’t use aggressive advertising such as pop-up windows? Or did the adservercentral.com pop-up show up while you clicked a link on one of the big search engines, such as Google, Bing or Yahoo?

Here is a screenshot on the adservercentral.com pop-up from my machine:

If this description sounds like your story, you probably have some adware installed on your system that pop up the adservercentral.com ads. So there’s no use contacting the site owner. The ads are not coming from them. I’ll try help you with the adservercentral.com removal in this blog post.

Those that have been visiting this blog already know this, but here we go: Some time ago I dedicated some of my lab machines and intentionally installed a few adware programs on them. I have been observing the behaviour on these machines to see what kinds of ads that are displayed. I’m also looking on other interesting things such as if the adware updates itself automatically, or if it downloads additional unwanted software on the systems. I first spotted the adservercentral.com pop-up on one of these lab machines.

adservercentral.com was created on 2002-10-22. adservercentral.com resolves to the 207.34.202.27 IP address and promo2.adservercentral.com to 209.15.247.29.

So, how do you remove the adservercentral.com pop-up ads? On the machine where I got the adservercentral.com ads I had TinyWallet, BrowserWarden and BlockAndSurf installed. I removed them with FreeFixer and that stopped the adservercentral.com pop-ups and all the other ads I was getting in Firefox.

BlockAndSurf was the adware that caused the pop-ups in my case. I know this since the pop-up ad had a label with the adware name: “Brought to you by BlockAndSurf“.

What label did your pop-up ad have? Please share in the comments area below.

If you are wonder if there are many others out there also getting the adservercentral.com ads, the answer is probably yes. Check out the traffic rank from Alexa:

The issue with this type of pop-up is that it can be launched by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

Anyway, here’s my suggestion for the adservercentral.com ads removal:

The first thing I would do to remove the adservercentral.com pop-ups is to examine the software installed on the machine, by opening the “Uninstall programs” dialog. You can open this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:

Do you see something suspicious listed there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if something was installed about the same time as you started observing the adservercentral.com pop-ups.

Then I would check the browser add-ons. Adware often show up under the add-ons dialog in Firefox, Chrome, Internet Explorer or Safari. Is there anything that looks suspicious? Anything that you don’t remember installing?

I think you will be able to track down and uninstall the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop many years ago. Freefixer is a tool designed to manually track down and remove unwanted software. When you’ve found the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not crippled like many other removal tools out there. It will not require you to purchase the program just when you are about to remove the unwanted files.

And if you’re having issues figuring out if a file is clean or adware in the FreeFixer scan report, click on the More Info link for the file. That will open up your web browser with a page which contains more information about the file. On that web page, check out the VirusTotal report which can be very useful:

Did you find any adware on your machine? Did that stop the adservercentral.com ads? Please post the name of the adware you uninstalled from your machine in the comment below.

Thank you!

Prompt Distribution – 7% Detection Rate – InstallCore

December 2, 2014digital signatureInstallCoreRoger Karlsson

Hello readers! Just a note on a publisher called Prompt Distribution (Fried Cookie Ltd.). The Prompt Distribution (Fried Cookie Ltd.) download – Skype_Setup.exe – was detected when I uploaded it to VirusTotal. Did you also find a download by Prompt Distribution (Fried Cookie Ltd.)? Was it also detected when you uploaded it to VirusTotal?

By examining the certificate, we can see that Prompt Distribution (Fried Cookie Ltd.) is located in Tel Aviv in Israel. The certificate is issued by GlobalSign CodeSigning CA – G2.

What caught my attention was that the download was called Skype_Setup.exe. This might look like an official Skype download, but it is not. If it was an official download, it should have been signed by Skype Software Sarl.

These are the current VirusTotal detections for the file. Generic.48E, a variant of Win32/InstallCore.SC and InstallCore (fs) as a few of the detection names for the Skype_Setup.exe file.

Did you also find a file digitally signed by Prompt Distribution? What kind of download was it and where did you find it?

Thank you for reading.

One Floor App LTD – 27% Detection Rate – Widdit / FirstFloor / SimplyInstaller

December 2, 2014digital signatureBnei Brak, FirstFloor, Israel, SimplyInstaller, WidditRoger Karlsson

Hello! Just wanted to give you the heads up on a file called 1Convert.exe that’s digitally signed by One Floor App LTD. You will also see One Floor App LTD listed as the verified publisher in the User Account Control dialog that pops up if you try to run the file:

Information about a digital signature and the certificate can also be found under the Digital Signature tab.. The screenshot below shows the One Floor App LTD certificate. From the certificate info we can see that One Floor App LTD appears to be located in Bnei Brak in Israel.

ESET-NOD32 classifies 1Convert.exe as a variant of Win32/Toolbar.Widdit.A, Kaspersky detects it as not-a-virus:WebToolbar.Win32.FirstFloor.a and Malwarebytes detects it as PUP.Optional.SimplyInstaller.

Did you also find a download that was signed by One Floor App LTD? What kind of download was it and was it detected by the anti-virus software at VirusTotal? Please share by posting a comment.

Thanks for reading.

W-Foxxer Firefox Add-On

December 2, 2014freefixerRoger Karlsson

Found a new Firefox add-on called W-Foxxer 0.45:

Easily removed with FreeFixer:

Thanks for reading!

Remove secureadcenter.com Pop-Up Ads

December 2, 2014adware, pop-ups188.138.75.165Roger Karlsson

Does this sound familiar? You see pop-up ads or new tabs from secureadcenter.com while browsing websites that typically don’t advertise in pop-up windows. The pop-ups manage to evade the built-in pop-up blockers in Firefox, Chrome, Internet Explorer or Safari. Maybe the secureadcenter.com pop-ups appear when clicking search results from Google? Or does the pop-ups appear even when you’re not browsing?

Here’s a screenshot of the secureadcenter.com pop-up ad when it showed up on my system:

There it gets stuck for me. It continues to display the “loading…” progress bar, but nothing happens.

If this description sounds like your system, you most likely have some adware installed on your machine that pop up the secureadcenter.com ads. Contacting the site owner would be a waste of time. The ads are not coming from them. I’ll try help you to remove the secureadcenter.com pop ups in this blog post.

For those that are new to the blog: A little while back I dedicated some of my lab computers and deliberately installed some adware programs on them. I’ve been following the actions on these systems to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware updates itself automatically, or if it downloads additional unwanted software on the computers. I first noticed the secureadcenter.com pop-up on one of these lab computers.

secureadcenter.com was registered on 2013-12-03. secureadcenter.com resolves to the 188.138.75.165 IP address.

So, how do you remove the secureadcenter.com pop-up ads? On the machine where I got the secureadcenter.com ads I had Salus, PriceFountain, TinyWallet and BuyNSave installed. I removed them with FreeFixer and that stopped the secureadcenter.com pop-ups and all the other ads I was getting in Mozilla Firefox. Sorry, I don’t know which of them was responsible for the pop-up/new tab.

If you are wonder if there are many others out there also getting the secureadcenter.com ads, the answer is probably yes. Check out the traffic rank from Alexa:

Rank 13k is means its getting lots of traffic. It seems it gets lots of traffic from Sweden.

The issue with this type of pop-up is that it can be launched by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

To remove the secureadcenter.com pop-up ads you need to examine your machine for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:

The first thing I would do to remove the secureadcenter.com pop-ups is to examine the software installed on the machine, by opening the “Uninstall programs” dialog. You can reach this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:

Do you see something suspicious in there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if something was installed approximately about the same time as you started observing the secureadcenter.com pop-ups.

The next thing to check would be your browser’s add-ons. Adware often turn up under the add-ons menu in Firefox, Chrome, Internet Explorer or Safari. Is there anything that looks suspicious? Something that you don’t remember installing?

I think most users will be able to identify and remove the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop many years ago. It’s a tool designed to manually track down and remove unwanted software. When you’ve tracked down the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not crippled like many other removal tools out there. It won’t require you to pay for the program just when you are about to remove the unwanted files.

And if you’re having difficulties figuring out if a file is legitimate or adware in the FreeFixer scan result, click on the More Info link for the file. That will open up a web page which contains additional information about the file. On that web page, check out the VirusTotal report which can be very useful:

Did you find any adware on your machine? Did that stop the secureadcenter.com ads? Please post the name of the adware you uninstalled from your machine in the comment below.

Thank you!