Category Archives: adware

Remove GoSave – Ads by GoSave Removal Instructions

September 11, 2014adware, freefixerMultiPlugRoger Karlsson

Morning readers! I just found a new adware called GoSave. This appears to be a variant of the GoSaveNow adware that I wrote about yesterday. If you got GoSave on your machine, you will see ads labeled Ad by GoSave, Ads by GoSave or Brought by GoSave. Here’s a few examples of the ads I noticed when GoSave was installed on my machine:

You can also see GoSave in your web browser’s add-on menu:

GoSave is currently bundled with a large number of downloads. Here’s how it was disclosed in one of the installers:

If you’d like to remove GoSave you can do so with the freeware FreeFixer tool. Selected the GoSave files for removal in FreeFixer, click Fix, reboot your machine and the ad problem will be gone. Here’s a few screenshots to point you in the right direction:

GoSave is often installed with three other unwanted programs called GS_Booster, GS_Sustainer 1.80 and YoutubeAdBlocke, that you probably want to remove too.

Hope you found this useful.

Any idea how GoSave was installed on your machine? Please share in the comments below.

Browser+ Apps+ Removal – Ads by Browser+ Apps+ Removal Instructions

September 10, 2014adware, freefixerCrossRiderRoger Karlsson

Found another adware variant called Browser+ Apps+ right now. If you got this on your machine, you will see some ads labeled “Ads by Browser+ Apps+” in the web browser. It adds a bunch of files and installs itself in your web browser. Here’s how it appears in Firefox:

The Browser+ Apps+ removal with FreeFixer is pretty easy. Check all the Browser+ Apps+ files for removal and click fix. Here’s a few screenshots from the removal that should help you:

Thanks for reading.

Remove Ads By GoSaveNow – Adware Removal Instructions

September 10, 2014adware, freefixerAdware.Win32.MultiPlug, MultiPlugRoger Karlsson

Are you seeing ads labelled Ads By GoSaveNow, Ad By GoSaveNow or Brought by GosaveNow? Do you also see links inserted into the web page that have a small green icon and says “Click to Continue > by Gosavenow“? If so, you have the GosaveNow adware installed on your machine. I’ll show how to remove Gosavenow in this blog post with the FreeFixer removal tool.

I’ve also found a variant of this adware called GoSave.

Here are a few examples on how the Gosavenow ads looks like:

The Gosavenow ads also appears on search engines such as Google:

The following Gosavenow ad was inserted on Wikipedia.org:

Gosavenow installs itself in Internet Explorer, Mozilla Firefox and Google Chrome. You can spot it if you open up the add-ons manager in the web browsers.

Some of the antivirus programs are detecting the GosaveNow adware, but the detection rate is rather low. Only 4 of the 55 anti-virus scanners at VirusTotal detected it. That’s a 7% detection rate. MultiPlug seems to be the common detection name:

So, the GosaveNow removal. You can easily remove GosaveNow with FreeFixer. Just select the Gosavenow files for removal and click the Fix button. You may have to reboot your machine to complete the removal:

That’s it. Hope that helped you unistall GosaveNow.

Did you also get GosaveNow on your machine? Any idea how it was installed? Please share by posting a comment below.

Thank you for reading!

Gogo Network Club – 13% Detection Rate – Win32.Adware.CrossRider

September 8, 2014adware, digital signatureCrossRiderRoger Karlsson

Just a quick post today, since I’m busy working with the next release of FreeFixer. If you see some files on your system, such as Browser+ Apps-be.exe, that are digitally signed by Gogo Network Club, you probably have the CrossRider adware on your machine. Here’s the scan result from VirusTotal:

Hope this helped you figure out what the Gogo Network Club files are.

OUTbrowse Ltd – 13% Detection rate: Trojan.Win32.OutBrowse and Adware.Win32.OutBrowse

September 3, 2014adware, digital signatureAdware.Win32.OutBrowse, PUP.Optional.OutBrowse, Trojan.Win32.OutBrowseRoger Karlsson

If you’ve been following me for the last months you know that I’ve been examining many software publishers that put a digital signature on their downloads. Yesterday I found another publisher called OUTbrowse Ltd. This is how it appears when running the file:

To get more details on the publisher, you can view the certificate by right-clicking on the file, and looking under the Digital Signatures tab:

According to the certificate information, OUTbrowse Ltd appears to be located in Israel. The certificate is about two weeks old.

When running the OUTbrowse file, it displayed a link to the OUTbrowse Terms and Conditions, which were located on www.mixi.dj.

So, why did I put up this blog post? Well, the thing is that the OUTbrowse file is detected by some anti-virus programs, according to VirusTotal:

PUP.Optional.OutBrowse, Trojan.Win32.OutBrowse and Adware.Win32.OutBrowse are a few of the detection names. The detection rate is 7/54, that is 13%.

Hope this blog post helped you avoid some unwanted software on your machine.

Did you also find an OUTbrowse file? Do you remember the download link? Please post it in the comments below and I’ll upload it to VirusTotal to see if that one is also detected.

YouTubeAdBlocke – Removal Instructions

September 3, 2014adware, freefixerAdware.Win32.MultiPlug, PUP.Optional.MultiPlug, Win32/Adware.MultiPlugRoger Karlsson

Hello there! As usual I was looking around on the Internet to see what is being bundled with some software downloads. This time I found something called YouTubeAdBlocke, which is installed as an add-on in Internet Explorer and Mozilla Firefox.

YouTubeAdBlocke was installed with a bunch of other unwanted softwares called PC_Booster, PC_Sustainer 1.80 and PriceChop.

Just to set the record straight. YouTubeAdBlocke is not official software from Google.

As per usual I uploaded the suspicious YoutubeAdBlocke file to VirusTotal to see if any scanner detects it. The detection rate is quite low.

PUP.Optional.MultiPlug, Adware.Win32.MultiPlug and Win32/Adware.MultiPlug are some of the detection names for the YoutubeAdBlocke file.

You can remove YouTubeAdBlocke from the Windows Control Panel. Please remember to remove the other unwanted softwares too.

If that does not work, you can remove YouTubeAdBlocke with the freeware FreeFixer malware removal tool. Just select the the YouTubeAdBlocke files for removal:

Hope that helped you to figure out how to do the removal.

Did you also get YouTubeAdBlocke on your machine? Any idea how you got it?

Remove RockResult Ads in Firefox and Internet Explorer

August 31, 2014adware, freefixerAltbrowse, BrowseFoxRoger Karlsson

Hello there, hope you are having a great weekend. Just found another adware variant called RockResult. It appears that RockResult has been around for a while, at least a month, judging from the other anti-malware bloggers. But since I found it bundled today, I though I should write a short post about it.

If you have RockResult on your machine, you’ll see ads tagged as “RockResult Ads” while you are browsing the web. Here’s an example of the RockResult ads:

RockResult is added as an add-on in Internet Explorer and Firefox:

So, how did RockResult install on your machine? It was probably bundled with some download that you installed recently. Here’s how RockResult was disclosed when I found it:

I’m sure you’d like to remove RockResult, and that’s pretty easy with FreeFixer. Select the RockResult files, as shown in the screenshots below, click Fix, and reboot your machine and the ads should be gone.

Thanks for reading.

Remove RocketTab – “Ads by RocketTab” Removal Instructions

August 28, 2014adware, freefixerAdware.iBryteRoger Karlsson

Stumbled upon an adware called RocketTab this morning. I’ll show how to remove RocketTab, but first, let’s talk a little on how it is installed and what it does to your computer. RocketTab is distributed by bundling, that is, it is included in another software’s installer. Here’s how RocketTab was disclosed when I found it:

Once installed you’ll notice the RocketTab file Client.exe running in the Windows Task Manager:

RocketTab inserts its ads while you browse the web. Here’s the ads are labeled “Ads by RocketTab” and appear on the Google search results.

As always when I find some new bundled software, such as RocketTab, I upload the files to VirusTotal to see what the other anti-virus programs report. And the detection rate is very low: 4%. The detection name is Adware.iBryte.

Removing RocketTab is pretty easy with the FreeFixer removal tool. Just select the Client.exe process and scheduled task for removal, reboot and the problems is gone.

Hope that helped you figure out what RocketTab is and how to remove it.

How did you get RocketTab on your computer? Please share in the comments below.

Update 2014-09-18: Client.exe is now digitally signed by Inertware.

Remove SnipSmart – Adware Removal Instructions

August 28, 2014adware, freefixerAltbrowse, BrowseFoxRoger Karlsson

Hello readers! Today I’m posting removal instructions for yet another adware variant called snipsmart. The snipsmart adware is bundled with other software downloads. So if snipsmart appeared unexpectedly on your machine, that’s probably how it was installed.

Snipsmart is installed as an add-on in Internet Explorer and Mozilla Firefox. Here’s a screendump from my lab machine which shows snipsmart in the add-ons menu of Firefox:

Typically, this type of adware adds banners on web site while you are browsing the web. The ads are usually tagged with texts such as “Snipsmart ads” or “Ads by Snipsmart“. However, for unknown reasons, I did not see any ads. Do you see the snipsmart ads on your machine? Please take a screenshot of the ad and send it to me and I’ll post it here on the blog. Thank you very much!

As per usual, I uploaded snipsmart to VirusTotal to see what the antivirus scanners report. And the detection rate is low. Only 6 of the 55 anti-virus programs detected the snipsmartBho.dll file:

So, let’s get on with the snipsmart removal. As usual, this type of adware is easy to remove with FreeFixer. Just select the snipsmart files for removal and click Fix. You may have to reboot your machine to complete the removal. Here’s FreeFixer in action uninstalling snipsmart:

Hope that helped you figure out what snipsmart is and how to remove it.

How did you get snipsmart on your machine? Please share by posting a comment.

Remove NeuroWise – Adware Uninstall Guide

August 27, 2014adware, freefixerAltbrowse, BrowseFox, CNETRoger Karlsson

Yesterday I tried one of the downloads listed at CNET’s Download.com site and found that they are bundling a new adware called NeuroWise:

Neurowise appears to be a variant of the Atuzi adware that they previously bundled. According to Download.com’s disclosure,

Neurowise content includes advertisements and is not affiliated with any underlying websites. Browser settings will be adjusted at install.

Typically, this type of adware shows banner ads labeled “Ads by Neurowise” or “Neurowise Ads“, but for some reason I did not see any ads while browsing around with neurowise installed. Did you spot any Neurowise ads? How did they look like and where did they appear?

Neurowise is installed as a browser add-on in Firefox and Internet Explorer. In case you haven’t already spotted it in Firefox, here’s how it appears in the add-on menu:

The majority of the anti-virus programs over at VirusTotal are detecting Neurowise, as shown in the screeshot below. BrowseFox and AltBrowse are some of the detection names.

Removing the Neurowise adware is a piece of cake with FreeFixer. Just start the scan, select the Neurowise files, click Fix, reboot you machine and the problem will be gone. Here’s a few screenshots showing FreeFixer in action removing the Neurowise files:

Hope that helped you figure out what Neurowise is and how to remove it. Did you also get Neurowise from Download.com?