Category Archives: pop-ups

Remove aim.couphomegame.com Pop-Up Ads

November 8, 2014adware, pop-upsCoup Pop-UpRoger Karlsson

If there’s pop-ups from aim.couphomegame.com appearing on your machine, that managed to sneak through the built-in pop-up blockers in your browser and that appears on web sites that normally does not have any pop-ups, you probably have some adware installed on your computer.

As you can see above, I got the aim.couphomegame.com pop-up while browsing in Mozilla Firefox, but the pop-ups can appear if you are using other browsers, such as Google Chrome or Microsoft’s Internet Explorer.

If you’ve been visiting this blog the for the last month you probably know that I’ve been building a little lab with machines, where I’ve deliberately installed some software that shows advertisements. This type of software is often called adware and most people think is unwanted and wants to uninstall it right away. I totally agree with that. On the lab machine where I found the aim.couphomegame.com pop-ups ads, I had installed BlockAndSurf and TinyWallet. I removed these with FreeFixer and the problem was solved. If you got any of these on your machine, that’s a pretty good start: Removing those may solve the aim.couphomegame.com problem.

The problem is that the aim.couphomegame.com can be caused by other variants of adware too. So, unfortunately I cannot say exactly what should be removed. Here’s my suggested removal procedure:

Review the programs you have installed on your machine in the “Remove programs” list in the Windows Control Panel. Do you see anything there that you don’t remember installing or that appeared about the same time as you first noticed then aim.couphomegame.com pop-ups? If you find any adware or other types of unwanted software, uninstall it.
Open up the add-ons menu in your browser. Do you see something there that looks suspicious or that you don’t remember installing. If you find some unwanted software, remove it.
If that still did not help, you can give FreeFixer a shot. It’s a freeware tool designed to help users track down and remove unwanted software on your Windows machine. FreeFixer’s removal feature is not crippled like many other removal tools out there and will not require you to pay just when you are about to remove the unwanted files or settings that you found. I’m the developer of this free tool and If it helped you solve the aim.couphomegame.com problem, please help me spread the word and let your friends now about it.

If you are having difficulties to determine if a files is safe or malware in FreeFixer’s scan result, please check out what’s behind the More Info links. You can find lots of useful info there that will help you, among other things a scan report from VirusTotal that can be very useful when tracking down the adware.

freefixer-more-info-skype_setup — Demonstrating the More Info links and the VirusTotal report. Click for full size.

Well, hope that helped you remove the aim.couphomegame.com ads. What adware did you uninstall to stop the pop-ups? Please share by posting a comment below.

By they way, if you like this blog or the FreeFixer program, please follow me on Twitter, YouTube, Facebook or Google+.

Thanks for reading!

Remove aal.coupmatch.com Pop-Up Ads

November 6, 2014adware, freefixer, pop-upsCoup Pop-UpRoger Karlsson

Just wanted to let you know about the aal.coupmatch.com pop-ups. If you see these ads on your machine, you most likely have some adware on your machine that launch these pop-ups.

I’m in a hurry, so please bare with this short post. Here’s my suggested removal for the aal.coupmatch.com pop-ups ads.

1. Examine the programs installed on your machine in the Add/Remove programs dialog in the Windows Control Panel. Uninstall if you find some adware.

2. Go through the add-ons installed in your browser. If you find some adware, remove it.

3. If that did not help, you can use FreeFixer to manually track down the adware files that opened the aal.coupmatch.com pop-up. Tip: Use the More Info links to open up a VirusTotal report for a particular file in the scan result.

freefixer-more-info-blockandsurf — The More Info links. Click for full size

Did you find some adware on your machine? Please post the name of the adware in the comments below to help other users with the aal.coupmatch.com popup problem.

On my machine, the adware responsible for the aal.coupmatch.com pop-up was called Safer-Surf.

Thank you for reading!

Remove mwl.petuniasaucecockup.com Pop-Up Ads

November 4, 2014adware, freefixer, pop-upsRoger Karlsson

Did a pop-up ad from mwl.petuniasaucecockup.com just appear while you were browsing, perhaps when clicking on a search result in one of the major search engines, such as Google, Bing or Yahoo? Did the built-in pop-up stoppers in Chrome, Firefox or Internet Explorer fail to block the mwl.petuniasaucecockup.com popup? If so, you most likely have some adware installed on your machine that pop up these ads. I’ll show how to remove the mwl.petuniasaucecockup.com pop-ups in this blog post.

If you have been reading this blog post during the autumn you know that I’ve been playing around with some of the most common adware variants by installing them on a few of my lab machines and monitoring their behaviours. That’s where I found the mwl.petuniasaucecockup.com pop-up. On the machine where I found the pop-up I had installed the BlockAndSurf adware, so if you also have it on your computer, uninstall it and the mwl.petuniasaucecockup.com problems should be gone. As usual I tested to remove mwl.petuniasaucecockup.com with FreeFixer which worked without any hiccups. I always do that to make sure FreeFixer successfully removes the adware.

The problem with the mwl.petuniasaucecockup.com pop-ups is they can be caused by other adware variants, which makes it impossible to say exactly what should be removed on your computer to stop the popups.

To remove the mwl.petuniasaucecockup.com pop-ups I’d start looking in the “Uninstall Programs” dialog which can be found in the Windows Control Panel. Do you see something that you don’t remember installing? Do you see something that was installed about the same time as the mwl.petuniasaucecockup.com ads started to pop up? Tip: Sort on the “Installed On” column. You might need to do a few Google searches on the program names you find.

If that did not help, I would look in the add-ons menu in the browser to see if something suspicious is found. Do you also see something that you don’t remember installing?

If that still did not help you can try FreeFixer, which is a tool that I’ve developed for some time now. It’s a freeware tool that will help you identify and remove unwanted software from your computer. Basically, it scans lots of locations on your machine, such browser add-ons, drivers, processes, search settings, etc. Then it removes safe items by using a whitelist, to reduce the number of items in the scan result. Sometimes it can be difficult to determine if an item FreeFixer has found is safe or malware, but the “More Info” links can most likely help you there. The More Info links in the scan result will, as the screenshot shows, open up a web page, which contains a VirusTotal report for the file you just clicked. That should probably help you sort the goodies from the baddies.

Hope this helped you remove the mwl.petuniasaucecockup.com pop-ups ads. What adware did you remove to stop the mwl.petuniasaucecockup.com ads? Please share in the comment.

Remove dvj.eggnogthrushdeemster.com Pop-Up Ads

November 4, 2014pop-upsRoger Karlsson

Did you just get pop-up ads from dvj.eggnogthrushdeemster.com? Did these pop-ups appear when browsing web sites that normally don’t show any pop-ups? Did the dvj.eggnogthrushdeemster.com pop-ups also managed to pass the pop-up killers that are built into Chrome, Firefox and Internet Explorer?

If so, I would say that the probability is high that you have some software installed on your machine that opens these pop-ups rather than that the pop-ups are initiated from the web site you were browsing. This type of software is often called adware. And adware was the reason I was getting the dvj.eggnogthrushdeemster.com pop-up ads. I’ll show how I removed the dvj.eggnogthrushdeemster.com pop-ups ads in this this blog post. Hopefully it will help you to stop the eggnogthrushdeemster.com ads too.

If you’ve been visiting this blog for the last two three weeks or so, you are aware of how I catch these pop-up ads. If not, just a short recap: I’ve deliberately installed some adware on a few of my lab machines. From time to time I check what kinds of advertising that the adware show on the machine. That’s how I found the eggnogthrushdeemster.com pop-up.

On the lab machine where I was getting the dvj.eggnogthrushdeemster.com pop-up, I had installed the Safer-Surf and SmartOnes adware. After removing these adwares with FreeFixer, the dvj.eggnogthrushdeemster.com pop-up ads stopped. So, if you got any of these, removing them might solve the pop-up problem. But unfortunately, it may not, and the reason for that is that I think the dvj.eggnogthrushdeemster.com pop-up ads are opened by other adware variants too.

Here’s my suggested removal procedure for the dvj.eggnogthrushdeemster.com pop-ups:

Open up the Uninstall Programs dialog from the Windows Control Panel. Do you see something suspicious there, that perhaps was installed about the same time as you started seeing the dvj.eggnogthrushdeemster.com pop-ups ads? Do you see something that you don’t remember installing. Look into these to figure out if they should be removed.
Check which add-ons you have installed in your browser. If you see something that you don’t remember that you installed, research it to see if it should be removed.
If that did not solve the problem, you can try FreeFixer. It’s a tool that I’ve been working on for many years now, designed to help users manually track down and remove unwanted software. It’s a freeware tool and its features are not crippled like many other anti-malware tools that required you to pay for the program just when you are about to remove some unwanted files or settings. If you find FreeFixer useful, please help me spread the word by letting your friends know about it.

Tip: If you are having problems to determine if a file in FreeFixer’s scan result is safe or if it should be removed, please test the More Info link to find out more about the file. The information page that is opened up in your web browser when clicking the link contains a VirusTotal report for the file, which can be very useful:

Hope you found this useful.

What adware did you uninstall from your machine to stop the dvj.eggnogthrushdeemster.com pop-up ads?

Thanks for reading.

Remove bxh.mulctsamsaracorbel.com Pop-Up Ads

November 2, 2014adware, freefixer, pop-upsAddLyricsRoger Karlsson

Are you getting pop-ups from bxh.mulctsamsaracorbel.com while browsing in Chrome, Firefox or Internet Explorer? Do the pop-ups appear even though the built-in pop-up blocker in your browser is enabled? If that is the case, you probably have some sort of adware installed on your machine. This blog post will hopefully help you remove the bxh.mulctsamsaracorbel.com pop-ups ads.

If you have been following me here on the blog you know that I’ve installed some adware on purpose on my lab machines and that I’m currently monitoring what kind of advertisements that appears, the domain names of the pop-ups and other actions that the adware performs. The adware I have installed on this lab machines are TinyWallet, Browser Warden and BlockAndSurf. As you you can see in the screenshot below, the bxh.mulctsamsaracorbel.com pop-up is labeled BlockAndSurf, so there we have the adware that was responsible for the pop-up on my machine. So, in my case, the BlockAndSurf removal stopped the bxh.mulctsamsaracorbel.com pop-ups.

bxh.mulctsamsaracorbel.com ads by BlockAndSurf

There’s a problem though. BlockAndSurf is not the only adware that launch the bxh.mulctsamsaracorbel.com pop-ups. If your pop-up also is labeled with the adware name, go ahead and uninstall it, that should solve the problem.

However, the pop-ups are not always nicely labeled like that, so you might have to get your hands dirty to track down the adware that pop up the ads. The Add/Remove programs dialog in the Windows Control Panel and you browser’s add-on menu is a good start to search for suspicious software.

BlockAndSurf is variant of an adware family, often referred to as “AddLyrics” by the anti-virus programs. I think that the pop-ups are opened by some of the other variants too, not just BlockAndSurf. I’ve seen the following labels on the bxh.mulctsamsaracorbel.com pop-up type: Salus, CheckMeUp, Safer-Surf and NewPlayer.

I did a search in FreeFixer’s library of files to dig up a few more AddLyrics variants. It’s possible that one of these could be responsible for the bxh.mulctsamsaracorbel.com ads:

TubeSaver
SuperLyrics
LyricXeeker
MarkKit
PassShow
PassWidget
Plus-HD
Re-markit
ViewPassword
Re-Markable
Better Mark-it

If that does not help, you can try FreeFixer, a tool that I’m working on that assists users to track down and remove unwanted software. It’s a freeware tool. Tip, if you have difficulties determining if a file in FreeFixer’s scan result is legitimate or malware, click on the More Info links. That will bring up the file information page, which contains useful information about the file, such as a VirusTotal report for the file.

Screenshot showing how FreeFixer's "More Info" links opens up the file information page with a VirusTotal report. — FreeFixer’s More Info links. Click for full size.

Please let me know if you managed to track down what caused the bxh.mulctsamsaracorbel.com pop-ups in your case. What adware did you uninstall from your machine? Your comment will help other users in the same situation.

Thanks for reading, and welcome back to the blog.

Remove consumers-response.org Pop-Up Surveys

October 30, 2014pop-ups, surveyRoger Karlsson

Did you just get a pop-up survey from consumers-response.org while browsing in Google Chrome, Mozilla Firefox or Internet Explorer? Did the survey from consumers-response.org pop up while browsing a web site that normally does not have any pop-ups? If so, you probably have some software installed on your machine that shows the pop-ups rather than that they are coming from the web site you currently visit. I’ll give you some advice on how remove the consumers-response.org surveys in this blog post.

If you’ve been reading the FreeFixer blog during the last week you already know that I’ve installed a bunch of adware on my labs machine, and that I’m monitoring the advertising that these adwares display to the user. I noticed the consumers-response.org pop-up on one of the lab machines where I had installed the BlockAndSurf and SmartOnes adware. So that’s a good starting point if you’d like to remove the consumers-response.org surveys.

However, I’d like to point out that the consumers-response.org surveys are probably launched by other variants of adware, in addition to the ones I mentioned above, which makes it difficult to point out exactly what needs to be remove to stop the consumers-response.org pop-ups. More on the consumers-response.org removal later on.

Generally, this type of surveys often tries to make it appear as if they are official surveys from the web site you were currently browsing, typically by showing the domain name of the site you were browsing. Sometimes they also claim that your feedback will improve the site that you were currently visiting and that you will get some type of reward when completing the survey. As you can see in the screenshot the above, the survey claims to be from freefixer.com, which of course is fake. I own the freefixer.com web site and I do not show surveys like this. If you can read Swedish you can also see that the consumers-response.org survey promises you will get an “exclusive gift from freefixer.com”, which is a lie.

If you are wondering if you are the only one getting the consumers-response.org surveys. The answer is NO. Just check out the traffic report from Alexa. This web site is getting a ton of traffic. There are probably tens of thousands of users that see some content from consumers-response.org every day. I wish I had that traffic rank on freefixer.com 😉

So the consumers-response.org removal? Personally I would start to check the Add/Remove programs dialog in the Windows Control Panel to see if anything suspicious appears there and remove it. Do you see stuff that you don’t remember installing? In particular, if you sort on the “Installed on” date, do you see something that was installed about the same time as you first spotted the consumers-response.org surveys?

I would also check the add-ons installed into Chrome, Firefox, Internet Explorer or whatever browser you are using. Do you see anything suspicious? Is there something listed that you don’t remember installing?

If that did not solve the problem, you can try FreeFixer, a tool that I’ve been working on for quite some time now. FreeFixer is a tool designed to help users manually identify and remove unwanted software, such as the adware that’s running on your machine. Basically it scans the processes running on your machine, browser add-ons, startups, scheduled tasks, recently modified files, and lots of other locations. FreeFixer is freeware and its removal feature is not crippled liked many other cleaners out there. If FreeFixer solved your problem, I’d appreciate it a lot if you let your friends know about the tool.

Tip: If you are having difficulties to figure out whether a file or setting in FreeFixer’s scan result is legitimate or if it should be removed, please check out the information shown on the More Info page. It will show a VirusTotal report which can be quite useful when trying to determine whether to keep or remove a file.

Hope you found this useful and that it helped you with the consumers-response.org removal.

What adware did you remove to stop the consumers-response.org pop-ups on your computer? Please share by posting a comment below. That will help other users in the same situation. Thank you very much!

How To Remove enh.guzzlepraxiscommune.com Pop-Up Ads

October 27, 2014adware, freefixer, pop-upsRoger Karlsson

Getting pop-ups from enh.guzzlepraxiscommune.com? If those pop-ups also sneak through the built-in pop-up blockers in Chrome, Firefox and Internet Explorer, you most likely have some adware installed on your machine. I’ll give some advice on how to remove the enh.guzzlepraxiscommune.com pop-up in this blog post.

The enh.guzzlepraxiscommune.com removal is pretty straightforward, I uninstalled the adware that was installed on my machine with help from the FreeFixer removal tool. The adware were BlockAndSurf, Browser Warden and Tiny Wallet. In my case, BlockAndSurf was responsible for the pop-ups. Please keep in mind, that the enh.guzzlepraxiscommune.com pop-ups can be launched by other variants of adware. I think Safer-Surf and CheckMeUp, SpeedCheck and Salus can also be responsible for the pop-ups.

Tip: If you are having problems to determine whether a file or setting in FreeFixer’s scan result is good or bad, please have a look at the information shown on the More Info page, which appears when clicking on the More Info link as shown in the screenshot below. It will show a VirusTotal scan which can be useful when trying to determine whether to keep or remove the file.

FreeFixer More Info opening up the info page for Skype_setup.exe — The More Info links in FreeFixer opens up a VirusTotal report. Click for full size.

Hope that stopped the enh.guzzlepraxiscommune.com pop-ups on your machine.

What adware did you uninstall on your machine to get rid of the enh.guzzlepraxiscommune.com ads? Thank you very much for sharing and helping other users in the same situation.

Thank you for reading and welcome back! I’m going to follow up this one with more info later today or tomorrow.

Update 2014-10-30: Below is the full URL for the pop-up when I spotted it in Chrome. It mentions the datropy.com domain (wkj.datropy.com), it also sends the name of the adware to the server, in this case SaferSurf. The URL also contains www.google.se, which was the web site I was visiting when the pop-up appeared. The URL also contains WhiteLabelBidRequestHandlerServlet, indicating that something in the back-end is written in Java.

http://enh.guzzlepraxiscommune.com/sd/dw32.html?u=http%3A%2F%2Fwkj.datropy.com%2FWhiteLabelBidRequestHandlerServlet%3Foid%3D1%26width%3D1%26height%3D100%26pubid%3D9050%26tagid%3D5771%26noaop%3D1%26revmod%3DCRD%26cb%3Dcybabw%26encoded%3D1%26cirf%3Dhttps%3A%2F%2Fwww.google.se%2F%26pstn%3D90505771&p=SaferSurf&a=&c=9050-5771&b=chrome&bv=37&t1=1414676170615&tt=1414676170615&r=www.google.se&ua=0&n=convertmedia&sn=&mpa=0&mp=0

Based on the traffic I’m getting to this blog post it appears that there’s a large number of users having problems with the enh.guzzlepraxiscommune.com pop-ups. The Alexa traffic rank today shows that the enh.guzzlepraxiscommune.com site has reached a global rank of 26153 in just a few days.

“WARNING! Current version of Adobe Flash Player is outdated! Your computer is vulnerable to malware. Update your Adobe Flash Player now.”

October 25, 2014misleading advertising, pop-upsRoger Karlsson

WARNING! Current version of Adobe Flash Player is outdated! Your computer is vulnerable to malware. Update your Adobe Flash Player now.

Are you getting warning messages saying:

“WARNING! Current version of Adobe Flash Player is outdated! Your computer is vulnerable to malware. Update your Adobe Flash Player now.”

If that is the case, you might have some potentially unwanted software on your machine, typically adware. I got lots of these “Adobe Flash Player is Outdated” messages while I was testing a download on my lab machine, a download that I new bundled lots of software. I was using Mozilla Firefox, but I think these warning can appear if you are browsing with Google Chrome or Microsoft Internet Explorer as well.

And obviously, these “Flash Player is outdated” messages are just fake. When clicking on the OK button, you will get a download that is detected by many of the anti-virus programs. If you want to download or update the Flash Player. Go to the official Adobe site. Trust nothing else for Flash downloads.

http://get.adobe.com/flashplayer/

The “Current version of Adobe Flash Player is outdated” warning messages appears to be hosted on a web site called update-for-pc-1024.com. Did you also see the warning message on this site?

So, if you’d like to get rid of these warning messages, and you have some adware on your machine like me, you need to gets your hands dirty. I had lots of them. Salus, MyBestOffers, WordProser, PriceHorse, etc, etc. Some of them could be uninstalled from the Windows Control Panel, but there remained some processes running. To deal with those, I’d recommend a scan with the freeware tool FreeFixer that I’m developing.

Thank you for reading. Hope this helped you with the removal.

Remove oceancorn.biz Survey Pop-Up Ads

October 25, 2014pop-ups, surveyRoger Karlsson

Are you getting redirected to or pop-ups from a survey site named oceancorn.biz? If these pop-ups are sneaking though your browser’s built-in pop-up blocker, you probably have some adware installed on your machine. I got the pop-ups in Firefox, but they can appear in Chrome and Internet Explorer too. Here’s how the pop-up looked like. The full domain name was jfpzz.exclusiverewards.oceancorn.biz:

I would recommend reviewing your computer with FreeFixer to track down the software that pops up these surveys. I had SmartOnes, Supporer 1.80, SaferSurf, ProtectedBrowsing and MaxiGet Software Manager installed. After removing those, the pop-ups from oceancorn.biz stopped.

Thanks for reading.

“WARNING!!! Your Java Version is Outdated, Have Security Risks, Please Update Now!”

October 25, 2014adware, misleading advertising, pop-upsfake Java softwareRoger Karlsson

Are you getting messages or pop-ups while browsing the web saying:

“The page at http://s.mjytsw com says: WARNING!!! Your Java Version is Outdated, Have Security Risks, Please Update Now!”

When I got this message I was redirected to a “Java Update”. The update was digitally signed by a company called Fileangels, so it’s clearly not an official Java update. The Fileangels file is detected by some of the anti-virus programs at VirusTotal. A real Java update should be digitally signed by the company that owns Java, that is Oracle America, Inc.

I got these faked Java warnings while browsing with Firefox, but they can probably also appear if you are using Chrome or Internet Explorer as you web browser.

So, why are you getting these faked Java Update pop-ups? Most likely you have some adware installed on your machine. When I got these ads, I had lots of adwares installed on my lab machine. After removing them with FreeFixer, the “Java Update” pop-ups stopped. These where the adware programs I had and uninstalled: Browser Warden, SmartOnes, TinyWallet, BlockAndSurf, HQ-Video-Pro-2.1c.

To remove these faked Java warnings I would begin to examine the Add/Remove programs dialog in the Control Panel to see if something suspicious is listed there and remove it. Do you see some program that you don’t remember installing? If you sort the programs on the “Installed On” date, do you see anything that was installed approximately about the same time as you first noticed the “Java” warnings?

I think you should also check the add-ons installed into Chrome, Firefox, Internet Explorer. Do you see anything suspicious? Something that you don’t remember installing?

If that did not fix the problem, you can give FreeFixer a try. It’s a tool that I’ve been working on for some time now. FreeFixer is designed to help you manually identify and remove unwanted software, such as the adware that’s running on your machine. FreeFixer scans the processes running on your computer, browser add-ons, startups, scheduled tasks, recently modified files, and lots of other locations. FreeFixer is freeware and its removal feature is not crippled liked many other malware removers out there. If FreeFixer solved your problem, please help me spread the word and let your friends know about it.

Click the More Info links to get a VirusTotal report about the file. — The “More Info” links in FreeFixer. Click for full size.

Which adware programs did you have to uninstall to get rid of the “Java Update” warnings?

And if you are looking for the real Java download, go to the official Java site: https://www.java.com/en/

Thanks for reading.

Update 2014-10-26: These fake Java warnings are still going on. Found the same type of pop-up, but this time it mentions another web site: d.andoie.com. What web site does your warning message mention?

When clicking on the warning message, the faked Java site at phohyt.com opens up. Is this the site you are redirected to as well?

Update 2014-10-27: The pop-ups are still appearing. Now they mention d.mobcgm.com and d.mobdty.com. If clicking the OK button in the dialog, apprfv.com opens up containing a faked java update site.

Update 2014-10-30: These fake Java warnings and faked Java sites are still popping up. Today the pop-up mention www.qposwe.com and debajxcj.com and the faked site is hosted at irzsmdcs.com:

Update 2014-11-11: This is still going on. zpkaid.com is used host the fake Java Update site. The title of the page is “Update for Your Computer” and the download is signed by Safe Down.

Update 2014-11-13: Today the fake update site is hosted zrmica.com.

Update 2014-11-14: Today the fake site is hosted at zszpkt.com and ztcdnr.com. The downloads are signed by “Safe Down” and Fileangels.

Update 2014-11-16: Now the fake site is hosted at zwkuvp.com.