Remove RCore Trojan – RCore.exe Removal Instructions

October 20, 2014freefixer, trojanRoger Karlsson

Hello guys and gals. Just a quick post on the RCore trojan. If RCore is installed on your machine, you will see rcore.exe in in the Windows Task Manager and a new service called rcores pointing to rcore.exe. I’ll show how to remove RCore in this blog post with the FreeFixer removal tool.

RCore is distributed by a method called bundling. Bundling means that a piece of software is included in other software’s installers.

When I find some new bundled software I always upload it to VirusTotal to see if the anti-malware scanners there detect anything fishy. The detection rate is 14/52. The RCore files are detected as Trojan.Win32.Generic.pak!cobra by AVware, a variant of Win32/Agent.WGA by ESET-NOD32 and Artemis!0339F1025037 by McAfee.

You can remove RCore with the FreeFixer removal tool. Here’s a few screenshots from the removal that should help you: A restart of your computer may be required to complete the removal.

Hope that helped you with the removal.

Do you also have RCore on your computer? Any idea how it installed? Please let me and the readers know by posting a comments. Thanks!

Thanks for reading. Welcome back!

Remove ddl.militatesilkfrustum.com Pop-Up Ads

October 20, 2014pop-ups37.58.101.205Roger Karlsson

Morning! I was just examining some adware that I installed on my lab machine before the weekend. While playing around with it, I noticed lots of pop-ups from a web site named ddl.militatesilkfrustum.com. It showed an ad about something called “EuroMillionaireSystem”. The pop-up URL also mentioned a web site called jkc.thespatialists.com. What kind of ad appeared in the pop-up in your case?

Since you probably came here looking for information on how to stop these pop-ups I’ll give you some removal instructions.

The ddl.militatesilkfrustum.com pop-ups are, at least in my case, opened by the adware I had installed on my machine. To get rid of the pop-up ads I uninstalled a program called BlockAndSurf from the Add/Remove programs dialog.

Then I used the freeware FreeFixer tool to remove some other unwanted software, that was not listed under the Add/Remove programs dialog. These where, Browser Warden and TinyWallet. Look for these in the FreeFixer scan result. I also removed a bunch of other files with FreeFixer, located under “C:\Program Files (x86)\Bench\”

bservice.exe
bservice64.exe
wd.exe
updater.exe
bhelper64.dll

These ddl.militatesilkfrustum.com pop-ups can probably be caused by other adware as well, so you might have to review the items in the scan result in more detail if the pop-ups remain after uninstalling the adware and files mentioned above.

Hope that helped you solve the ddl.militatesilkfrustum.com pop-up problem.

Any idea how you got these pop-ups on your machine?

If you needed to remove some additional software or files to stop the ddl.militatesilkfrustum.com pop-ups, please share it the comment below to help other users in the same situation. Thank you very much!

search.sidecubes.com – Removal Instructions

October 17, 2014UncategorizedRoger Karlsson

Did you recently see search.sidecubes.com appear in a new tab in Chrome, Internet Explorer and Firefox? Unfortunately, you probably have some unwanted software on your machine.

I got the search.sidecubes.com web site installed in my browser, after testing out a download that bundled lots of potentially unwanted softwares.

This is how I did to remove search.sidecubes.com:

I went into the Windows Control Panel to uninstall some programs that appeared there recently. I checked the “Installed on” date, and removed SearchSnacks, VideosMediaPlayers, Browsers+Apps+1.1, Browser Warden, Search Protect and Shopop.
I ran FreeFixer to clean up even more.

This fixed the search.sidecubes.com problem for me. If it did not for you, you can also try the “Reset Browser” feature that is available in Chrome, Internet Explorer and Firefox. This will restore your browser into a state that is almost as when you installed it the first time.

Did this help you remove search.sidecubes.com?

Any idea how you got sidecubes.com on your machine?

How To Remove OfferBoulevard

October 17, 2014adware, freefixerLinkuryRoger Karlsson

Hello there. Found another adware called OfferBoulevard right now. OfferBoulevard seems to be a variant of Linkury. If the OfferBoulevard adware is installed on your system, you will see OfferBoulevard.exe and OfferBoulevardW.exe running in the Task Manager. I’ll show how to remove OfferBoulevard in this blog post with the FreeFixer removal tool.

OfferBoulevard is bundled with other software. Bundled means that it is included in another software’s installer. When I first found OfferBoulevard, it was bundled with FastPlayerPro. Here’s how it appeared in the FastPlayerPro installer where I found it:

For some reason it is called Offer Blvd in the EULA.

Generally, you can avoid bundled software such as OfferBoulevard by being careful when installing software and declining the bundled offers in the installer.

When I play around with some new bundled software I always upload it to VirusTotal to check if the anti-viruses there detect something fishy. 10 of the 54 anti-virus scanners detected the file. ESET-NOD32 reports OfferBoulevard as a variant of MSIL/Toolbar.Linkury.H, Malwarebytes classifies it as PUP.Optional.Offer and VIPRE detects it as Adware.Linkury (fs).

The OfferBoulevard removal with FreeFixer is pretty easy. Check all the OfferBoulevard files for removal and click fix. Here’s a few screenshots from the removal that should help you:

Hope this helped you remove the OfferBoulevard adware.

Any idea how OfferBoulevard was installed on your computer? Please let me and the readers know by posting a comments. Thank you very much!

Thank you for reading.

DOZ-DEKORUM LLC – 17% Detection Rate at VirusTotal

October 17, 2014digital signatureAmonetize, DownwareRoger Karlsson

Hello! Just a quick post today, since I’m busy working with the next release of FreeFixer. Did you see a file, such as FlashPlayer_6741_i1375671586_il280.exe, on your system signed by DOZ-DEKORUM LLC? Then read on..

Typically you’d see the DOZ-DEKORUM LLC publisher name appear when double-clicking on the FlashPlayer_6741_i1375671586_il280.exe file:

It’s possible to view additional information about the embedded certificate by right-clicking on the file, choosing properties and then clicking on the Digital Signatures tab. According to the certificate we can see that DOZ-DEKORUM LLC is located in Kiev in Ukraine and that the certificate is issued by Thawte Code Signing CA – G2.

The problem here is that if FlashPlayer_6741_i1375671586_il280.exe really was an installer file for Flash Player, it should have been signed by Adobe Inc. and not by some unknown company. I think this looks suspicious.

So, what does the anti-virus programs say about the DOZ-DEKORUM LLC file? No problem, I just uploaded the file to VirusTotal and it turned out that some (17%) of the anti-virus programs detects the DOZ-DEKORUM LLC file, with names such as Generic.AF5, Adware.Downware.8818 and PUP.Optional.Amonetize.

Since some of the anti-virus programs detected the DOZ-DEKORUM LLC file, I got curious and decided to test it to see what it installed. After stepping though the installer, RegClean Pro and Wajam appeared on my computer. Did you also find a file digitally signed by DOZ-DEKORUM LLC? What kind of download was it and where did you find it?

Thanks for reading.

Ads by VideosMediaPlayers – Removal Instructions

October 17, 2014adware, freefixerCrossRiderRoger Karlsson

Getting ads injected into web pages labeled Ads by VideosMediaPlayers_v1.2+ or Ad by VideosMediaPlayers_v1.2+.

No problem, just uninstall it from the Windows Control Panel:

If the uninstaller did not work, you can remove remove it with FreeFixer.

Thank you for reading.

Browsers+Apps+1.1 – Ads by Browsers+Apps+1.1 Removal Instructions

October 17, 2014adware, freefixerCrossRiderRoger Karlsson

Just wanted to put up a short post before going back to programming on FreeFixer. Today I wanted to talk about an adware named Browsers+Apps+1.1 and give you some removal instructions. Browsers+Apps+1.1 seems to be a variant of CrossRider that I’ve blogged about before. If the Browsers+Apps+1.1 adware is running on your machine, you will see ads tagged Ad by Browsers+Apps+1.1 or Ads by Browsers+Apps+1.1 injected into web pages while you browse and new add-ons in Firefox and Internet Explorer. I’ll show how to remove Browsers+Apps+1.1 in this blog post with the FreeFixer removal tool.

Browsers+Apps+1.1 is distributed by a strategy called bundling. Bundling means that a piece of software is included in other software’s installers.

As always when I find some new bundled software I uploaded it to VirusTotal to check if the anti-virus software there find something suspicious. 16% of the antimalware scanners detected the file. Malwarebytes classifies Browsers+Apps+1.1 as PUP.Optional.BrowsersApp.A, McAfee detects it as CrossRider-FRV and VIPRE detects it as Crossrider (fs).

You probably came here looking for removal instructions for Browsers+Apps+1.1 and you can do so with the FreeFixer removal tool. Just select the Browsers+Apps+1.1 files as the screenshots below shows. A restart of your machine may be required to complete the removal.

Hope that helped you with the removal.

I stumbled upon Browsers+Apps+1.1 while testing out some downloads that are known to bundled lots of unwanted software. Any idea how you got Browsers+Apps+1.1 on your computer? Please let me and the readers know by posting a comments. Thanks!

Hope you found this useful. Thanks for reading.

AdvanceElite Adware Removal Instructions

October 17, 2014adware, freefixerAltbrowse, artemis, BrowseFoxRoger Karlsson

Hello guys and gals. Today I wanted to talk about an adware called AdvanceElite and give you some removal instructions. AdvanceElite seems to be a variant of BrowseFox that I’ve written about before. If AdvanceElite is installed and running on your machine, you will see ads labeled AdvanceElite Ads in and new add-on called AdvanceElite 1.0.1 in Internet Explorer and Mozilla Firefox. I’ll show how to remove AdvanceElite in this blog post with the FreeFixer removal tool.AdvanceElite is bundled with a number of downloads. Bundling means that software is included in other software’s installers. Here’s one example how it appears in an installer for an unrelated program.Generally, you can avoid bundled software such as AdvanceElite by being careful when installing software and declining the bundled offers in the installer.

When I play around with some new bundled software I always upload it to VirusTotal to test if the anti-virus tools there find something interesting. Of the 55 anti-virus scanners, 13 detected the file. Some of the detection names for AdvanceElite are BrowseFox.F, PUP.Optional.AdvanceElite.A and Artemis.

You probably came here looking for removal instructions for AdvanceElite and you can do so with the FreeFixer removal tool. Here’s a few screenshots from the removal that should help you: A restart of your system may be required to complete the removal.

Hope this helped you remove the AdvanceElite adware.

Do you also have AdvanceElite on your machine? Any idea how it installed? Please share your story the comments below. Thanks!

Thank you for reading and welcome back.

Astromenda and Astromenda.com Removal Instructions

October 16, 2014adware, freefixerRoger Karlsson

Hello readers. Welcome to the blog. I just found another bundled adware called Astromenda and thought I should give you some removal instructions. If you have Astromenda on your computer, you’ll spot home page and search settings changed to astromenda.com and add-ons added into Internet Explorer and Firefox. I’ll show how to remove Astromenda in this blog post with the FreeFixer removal tool.

Here’s how astromenda.com appears in Internet Explorer:

Astromenda is bundled with other software. Bundled means that it is included in another software’s installer. The following screenshot shows how Astromenda was disclosed when I found it.Generally, you can avoid bundled software such as Astromenda by being careful when installing software and declining the bundled offers in the installer.

The Astromenda removal with FreeFixer is pretty straightforward. Check all the Astromenda items for removal and click fix. Here’s a few screenshots from the removal that should help you:

Hope this helped you remove the Astromenda adware.

Do you also have Astromenda on your computer? Any idea how it installed? Please share in the comments below. Thanks!

Hope you found this useful and thanks you for reading.

Browser Warden Ads – Removal Instructions

October 15, 2014adware, freefixerGamePlayLabsRoger Karlsson

Just wanted to put up a short post before going back to programming. Today I wanted to talk about an adware called Browser Warden and give you some removal instructions. If the Browser Warden adware is installed on your machine, you’ll spot ads labeled Ads by Browser Warden in Google’s search results and a new add-on installed in Mozilla Firefox. You will also see banners tagged as “Ad by Browser Warden” injected into web pages. I’ll show how to remove Browser Warden in this blog post with the FreeFixer removal tool.

You will probably also see browserwarden-a.akamaihd.net in the browser’s status bar:

BrowserWarden is bundled with a number of downloads. Bundling means that software is included in other software’s installers.

Generally, you can avoid bundled software such as BrowserWarden by being careful when installing software and declining the bundled offers in the installer, but in this case I could not see any disclosure in the installer that bundled Browser Warden.

Here’s the scan results from VirusTotal. It also shows that the signer is Gratifying Apps. GamePlayLabs is one of the detection names.

If you’d like to remove Browser Warden you can do so with the FreeFixer removal tool. Just check the Browser Warden files as shown in the screenshots below. You might have to restart your computer to complete the removal.

Hope that helped you to figure out how to do the removal.

Do you also have Browser Warden on your computer? Any idea how it installed? Please share by posting a comment. Thank you very much!

Thank you for reading.