Category Archives: adware

Remove InfiniNet Ads – Adware Removal Guide

August 26, 2014adware, freefixerAltbrowse, BrowseFoxRoger Karlsson

Getting bombarded with ads labeled “InfiniNet Ads” in Internet Explorer and Firefox? Then you got the InfiniNet adware installed on your machine. InfiniNet inserts ads while you browse the web. I’ve seen the ads appear on all types of web pages.

Here InfiniNet inserts ads in search results on the Google search engine:

I found the InfiniNet adware while testing another download that I knew had a history of bundling other types of adwares. Here’s how InfiniNet was disclosed in the installer:

InfiniNet installs itself as an add-on in Firefox and Internet Explorer. Here’s how it shows up in Firefox’s add-on menu:

The anti-virus scanners seems to be pretty up to date when it comes to detecting InfiniNet.

The detection rate is 45% which I think is pretty good. Some of the detection names are BrowseFox and AltBrowse.

The InfiniNet removal is straightforward with Freefixer. Just start the scan, select the InifiniNet files, click Fix and reboot your machine and the ads should be long gone. Here’s a few screenshots that shows FreeFixer in action deleting the InfiniNet files:

How did you get InfiniNet on your machine? Please share by posting a comment.

Plugin Update SL – Warning! Stay away from this file

August 25, 2014adware, digital signature, freefixer, malwareDomaIQ, fake Java software, SoftPulseRoger Karlsson

I’m in a hurry here, trying to wrap up the v1.12 release of FreeFixer, but I though I must write a few lines of about a file, digitally signed by Plugin Update SL, that was promoted as a Java update. Here’s how the ad appeared:

When clicking on the ad, a download for something called Player_Setup.exe appeared. That file, is not a Java Update.

The file is digitally signed by Plugin Update SL, which is a company that appears to be located on Tenerife, and if you run the file, it will start an installation of something called NewPlayer. During the installation, it offers lots of bundled unwanted software, such as Findopolis, FreeSoftToday, IStartSurf, etc, etc.

The VirusTotal scan also clearly shows why you should stay away from the Plugin Update SL malware file:

Some of the scanners report it as DomaIQ and SoftPulse.

Did you also find a file signed by Plugin Update SL? Was it also promoted as a Java update?

If you installed any of the bundled software, you can remove those with FreeFixer.

Hope this helped you avoid the Plugin Update SL software. Thanks for reading.

TubeHD Adware – Removal Instructions

August 19, 2014adware, freefixerCrossRiderRoger Karlsson

I was reviewing some of the files submitted to the FreeFixer database tonight and found something new called TubeHD. This looked like a new variant of the CrossRider adware and the VirusTotal scan result clearly shows that is the case:

Typically, adware such as TubeHD is distributed through bundling. That is, when downloading and installing some application, an additional offer is shown that suggests you should also install TubeHD.

Did you get Tube HD though bundling? If you remember the download link or the name of the software that bundled TubeHD, please let me know by posting a comment below. I’d like to try the installer to see how well TubeHD is disclosed.

Removing TubeHD with FreeFixer is pretty straightforward, assuming it’s just a regular variant of the Crossrider adware. Just select the TubeHD files for removal in the scan result, and then click Fix. The files should all be located in C:\Program Files (x86)\TubeHD-V1.8\ or C:\Program Files\TubeHD-V1.8\. The version number can vary depending on which version of TubeHD you have on your machine.

Thanks for reading!

Ads by Rewin Cinema – Removal Instructions

August 19, 2014adware, freefixerRoger Karlsson

Do you see ads labeled “Ads by Rewin Cinema” in your web browser. If that is the case, you have the Rewin Cinema adware installed and running on your machine. Rewin Cinema is bundled with various free software downloads, and that’s probably how it was installed on your machine. In my case, it was bundled with a download called JDownloader.

You will also see Rewin Cinema installed as an add-on in your web browser. Here’s how it appears in Firefox:

If you would like to uninstall the Rewin Cinema adware you can easily do so by checking the Rewin Cinema files in FreeFixer:

Do you also have the Rewin Cinema adware installed on your machine? Do you remember what download that bundled it? Please share by posting a comment.

What is SurfSafely? – It’s Adware

August 11, 2014adwareRoger Karlsson

Do you have something called SurfSafely installed on your machine and you are wondering what it is? As you can see in the SurfSafely installer, SurfSafely is clearly adware:

Advertising is added to content viewed through your web browser.. may include sponsored links, banner ads, pop-up ads, and other forms of advertising.

Hope that helped you figure out what SurfSafely is. Any idea how you got SurfSafely on your machine? Please share by posting a comment below.

If you’d like to remove SurfSafely you can do so with FreeFixer. Just select the SurfSafely file for removal and the ad problem will be solved.

Website Xplorer Removal Instructions

August 10, 2014adware, freefixerRoger Karlsson

Just a quick post on a browser add-on called Website Xplorer that was installed into Mozilla Firefox while installing another piece of software. I could not see that Website Xplorer was disclosed during the installation.

According to the description, Website Xplorer 0.1 will:

“Searches for matching web site, relevant to you.”

I could not find much info about it. If you have some additional details, please share by posting a comment. The extension .RDF file does mention a domain named weliketheweb.com.

The removal is pretty easy. Just select the file for removal in FreeFixer or remove it directly in Firefox’s add-on menu.

Any idea how you got Website Xplorer on your machine?

Ads by SaferSurf – Removal Instructions

August 9, 2014adware, freefixerRoger Karlsson

Are there are advertisements labeled Ads by SaferSurf while you browse the web, even on web pages that normally does not show any ads? Do you see “Visual Search results” labeled powered by safer-surf in when using the Google search engine. Then chances are you have the Safer-Surf adware installed on your machine.

You can also see Safer-Surf in your browser’s add-on menu. Here it is in Mozilla Firefox:

Software such as SaferSurf is generally distributed with bundling. That is, SaferSurf is included inside another software’s installer file. During the installation the user is offered to also install SaferSurf. Most often, the bundled software’s “I agree” radio button is already selected which will result in some users proceeding through the installer without realising that they accepted the bundled software.

Some of the anti-virus programs at VirusTotal are detecting the SaferSurf files, under names such as Strictor or AddLyrics.

If you’d like to get rid of the Safer-Surf ads you can simply uninstall it from the Add/Remove programs dialog. You can also nuke the SaferSurf adware with FreeFixer. Start the FreeFixer scan, and then select the Safer-Surf files in the scan result:

How did you get SaferSurf on you machine? Please share by posting a comment.

CouponSupport – Removal Instructions

August 8, 2014adware, freefixergen.variant.symmi, MultiPlug, Trojan.Cafelom, ZBotRoger Karlsson

Just found another adware, called CouponSupport. As usual with this type of software, it was bundled with another software download. If you have this little CouponSupport bugger running on your machine, you’ll see couponsupport.exe running in the background in the Windows Task Manager.

The detection rate for couponsupport.exe is impressive. 41 of 50 anti-virus programs detected it. Trojan.Cafelom, Gen:Variant.Symmi, PUP.Optional.MultiPlug.A and ZBot are some of the detection names.

Regarding the removal, there is an entry in the Add/Remove programs dialog, but I have not tried it. Notice the faked “Installed On” date in the screenshot. It was installed today, the 8th of August 2014, not in 2012.

You can also remove it with FreeFixer with a few clicks. Select the couponsupport.exe file and scheduled task for removal as shown in the screenshots below. You may have to restart your machine to complete the removal.

Did you also get CouponSupport on your machine? Any idea how you got it?

File Monarch & java_setup.exe – Stay away from it – 34% detection rate

August 7, 2014adware, digital signaturejavaRoger Karlsson

If you are a regular here on the FreeFixer blog you know that I’ve been looking on the certificates used to sign files that bundled various types of unwanted software.

While I was looking around on some recently submitted files here on freefixer.com I found a file called java_setup.exe signed by a company called File Monarch. The problem here is that if this really was a setup file for Java, it would have been digitally signed by Oracle and not by some unknown company. This looks very suspicious. And the VirusTotal report shows that the File Monarch file should be avoided, since java_setup.exe is detected as Adware.IBryte, Optimum Installer and Trojan.Win32.Buzus.

This tactic appears to be pretty common to get users to install something that they didn’t want: Pop up some file and claim that Java or the Flash Player needs to be updated.

Well, hope that helped you avoid some adware or whatever this java_setup.exe file would install.

Did you also find some file signed by File Monarch, or a file falsely claiming to be a Java setup file? Where did you find them?

I’ll dig around a bit more in the FreeFixer database to see if there’s some other faked Java setup files.

BrowseBurst – Software Description and Removal Instructions

August 3, 2014adware, freefixerRoger Karlsson

Did you see some ads labeled BrowseBurst, find a folder called BrowseBurst in “c:\Program Files” or the BrowseBurst item in the Add/Remove programs dialog and wonder what it is?

The screenshot from the BrowseBurst installer explains what the software does. It will show various types of advertisements, such as “offers”, coupons, website ratings, related search results, etc. Some of the ads are inserted into web pages while you browse the web, even though the underlying web site is not affiliated with BrowseBurst. BrowseBurst will also collect user information for ad relevance and “other purposes”.

Typically adware such as BrowseBurst is bundled with free software downloads and can be avoided by carefully navigating through the software installer, unchecking or declining the bundled offers, such as BrowseBurst.

How is BrowseBurst removed? You can uninstall BrowseBurst from the Add/Remove programs dialog. If that would fail from some reason, you can also remove BrowseBurst with FreeFixer. Just check the BrowseBurst files for removal, reboot and the ads will be gone.

How did you get BrowseBurst on your machine and how did you notice it?