MyBestOffersToday – Pop Up Removal Instructions.

September 14, 2014adware, freefixerEorezo, Tuto4PC, Tuto4PC.comRoger Karlsson

Getting pop-up ads from MyBestOffersToday?

Removing MyBestOffersToday is easy. Just uninstall it from the Windows Control Panel…

.. or if you’d like to use FreeFixer, select the MyBestOffersToday files for removal. They will have “mbot” as part of the filename:

I uploaded one of the file to VirusTotal. Here’s the scan result for mybestofferstoday_widget.exe. The files are signed by Tuto4PC.com. Tuto4PC and Eorezo are two of the detection names:

My Best Offers Today is bundled with other software downloads. Here’s how it was disclosed in one of the installers where I found it:

How did you get My Best Soft Today on your machine? Please share in the comments.

Remove GoSave – Ads by GoSave Removal Instructions

September 11, 2014adware, freefixerMultiPlugRoger Karlsson

Morning readers! I just found a new adware called GoSave. This appears to be a variant of the GoSaveNow adware that I wrote about yesterday. If you got GoSave on your machine, you will see ads labeled Ad by GoSave, Ads by GoSave or Brought by GoSave. Here’s a few examples of the ads I noticed when GoSave was installed on my machine:

You can also see GoSave in your web browser’s add-on menu:

GoSave is currently bundled with a large number of downloads. Here’s how it was disclosed in one of the installers:

If you’d like to remove GoSave you can do so with the freeware FreeFixer tool. Selected the GoSave files for removal in FreeFixer, click Fix, reboot your machine and the ad problem will be gone. Here’s a few screenshots to point you in the right direction:

GoSave is often installed with three other unwanted programs called GS_Booster, GS_Sustainer 1.80 and YoutubeAdBlocke, that you probably want to remove too.

Hope you found this useful.

Any idea how GoSave was installed on your machine? Please share in the comments below.

Browser+ Apps+ Removal – Ads by Browser+ Apps+ Removal Instructions

September 10, 2014adware, freefixerCrossRiderRoger Karlsson

Found another adware variant called Browser+ Apps+ right now. If you got this on your machine, you will see some ads labeled “Ads by Browser+ Apps+” in the web browser. It adds a bunch of files and installs itself in your web browser. Here’s how it appears in Firefox:

The Browser+ Apps+ removal with FreeFixer is pretty easy. Check all the Browser+ Apps+ files for removal and click fix. Here’s a few screenshots from the removal that should help you:

Thanks for reading.

GS_Booster and GS_Sustainer 1.80 – Removal Instructions

September 10, 2014freefixerMultiPlugRoger Karlsson

Did something called GS_Booster and GS_Sustainer 1.80 appear on your machine? These two programs often appear with an adware called Gosavenow which I’ve written about earlier today. Here’s the scan result from VirusTotal for the file:

You can remove GS_Booster and GS_Sustainer 1.80 with the FreeFixer removal tool. All you need to do is to check the GS_Booster and GS_Sustainer 1.80 files in the scan result and click the Fix button. Here’s a few screenshots that should help you along the way:

Hope that helped you with the removal.

Any idea how you got GS_Booster and GS_Sustainer 1.80 on your machine? Please share by posting a comment.

Remove Ads By GoSaveNow – Adware Removal Instructions

September 10, 2014adware, freefixerAdware.Win32.MultiPlug, MultiPlugRoger Karlsson

Are you seeing ads labelled Ads By GoSaveNow, Ad By GoSaveNow or Brought by GosaveNow? Do you also see links inserted into the web page that have a small green icon and says “Click to Continue > by Gosavenow“? If so, you have the GosaveNow adware installed on your machine. I’ll show how to remove Gosavenow in this blog post with the FreeFixer removal tool.

I’ve also found a variant of this adware called GoSave.

Here are a few examples on how the Gosavenow ads looks like:

The Gosavenow ads also appears on search engines such as Google:

The following Gosavenow ad was inserted on Wikipedia.org:

Gosavenow installs itself in Internet Explorer, Mozilla Firefox and Google Chrome. You can spot it if you open up the add-ons manager in the web browsers.

Some of the antivirus programs are detecting the GosaveNow adware, but the detection rate is rather low. Only 4 of the 55 anti-virus scanners at VirusTotal detected it. That’s a 7% detection rate. MultiPlug seems to be the common detection name:

So, the GosaveNow removal. You can easily remove GosaveNow with FreeFixer. Just select the Gosavenow files for removal and click the Fix button. You may have to reboot your machine to complete the removal:

That’s it. Hope that helped you unistall GosaveNow.

Did you also get GosaveNow on your machine? Any idea how it was installed? Please share by posting a comment below.

Thank you for reading!

Bestop-app – 22% detection rate – InstallCore

September 10, 2014digital signatureRoger Karlsson

Hello readers, just a short post on a publisher called Bestop-app before going back to some coding on FreeFixer. By looking at the embedded certificate we can see that Bestop-app appears to be located in Tel Aviv in Israel.

After uploading the Bestop-app file – FlvPlayerSetup.exe – to VirusTotal, it was clear that it’s probably better to delete the file than running it. The detection rate was 22% and some of the detection names were: PUP.Optional.InstallCore, CryptInno and Install Core Click run software.

Did you also find a Bestop-app file?

OOO Alians – 7% Detection Rate at VirusTotal

September 10, 2014digital signaturefake flash softwareRoger Karlsson

Just a short post on a publisher called OOO Alians. I just found a download named adobe_flash_setup.exe that was digitally by this publisher, and it turns out that it is detected by some of the anti-virus programs.

Adware/InstallCore, AdWare.Win32.InstallCore and PUA.Alians are some of the detection names.

Did you also find a OOO Alians download? Was that also promoted as Adobe’s Flash Player.

Now, back to programming on the FreeFixer tool 🙂

Gogo Network Club – 13% Detection Rate – Win32.Adware.CrossRider

September 8, 2014adware, digital signatureCrossRiderRoger Karlsson

Just a quick post today, since I’m busy working with the next release of FreeFixer. If you see some files on your system, such as Browser+ Apps-be.exe, that are digitally signed by Gogo Network Club, you probably have the CrossRider adware on your machine. Here’s the scan result from VirusTotal:

Hope this helped you figure out what the Gogo Network Club files are.

findamo.com and websearch.searchiseasy.info – Removal Instructions

September 3, 2014freefixerRoger Karlsson

Getting redirected to findamo.com when starting your web browser? It appears that another web site, websearch.searchiseasy.info, is currently redirected to findamo.com. So, if you are trying to remove findamo.com, you might have to look for searchiseasy.info instead of findamo.com in your browser’s home page and search settings.

I stumbled upon the findamo.com search engine while testing out some downloads that are known to bundled lots of unwanted software. How did you get findamo.com on your computer? Please share by posting a comment.

Back to the findamo.com removal. One way to do the removal is to use the FreeFixer tool.

Download and install FreeFixer.
Click the Start scan button. It should complete in about 5 minutes.
Check the websearch.searchiseasy.info items in the scan result.
Click the Fix button.
Restart your web browsers.

You can also use the reset function in Firefox, Chrome and Internet Explorer. The reset feature restores most of the settings of the web browser to its default state. The problem is that it may do a little to much.

How to reset Mozilla Firefox settings:

Click the menu button in the upper-right corner of the browser.
Then click the Help button at the bottom of the Firefox menu.
From the Help menu, choose Troubleshooting Information.
If you cannot access the Help menu, type about:support in the address bar to open up the Troubleshooting Information page.
Click the Reset Firefox… button in the upper-right corner of the Troubleshooting Information page.
A dialog will pop up explaining what settings Firefox tries to preserve. Notice that everything else will be removed! To continue, click the Reset Firefox button in the confirmation window that opens..
Firefox will close and reset itself. When the reset is done, a window will list the information that was imported. Click Finish and you’re done.

How to reset Google Chrome settings:

Click the Chrome menu in the upper-right corner of Chrome.
Select Settings.
Click Show advanced settings and locate the “Reset browser settings” section.
Click the Reset browser settings button.
In the confirmation dialog that appears, review the changes the reset feature performs, then click Reset.

How to reset Internet Explorer settings

Start Internet Explorer.
On the Tools menu, that appears in the upper-right corner of the browser, clickInternet options. If you can’t see the Tools menu, press Alt on your keyboard.
In the Internet Options window, click the Advanced tab.
Click Reset… If you’re using Internet Explorer 6, click Restore Default.
In the Reset Internet Explorer Settings dialog box, click Reset.
Select the Delete personal settings check box if you want to reset home pages, search providers and accelerators. Delete temporary Internet files, history, cookies, web form information, ActiveX Filtering data, Tracking Protection data, Do Not Track data and passwords.
When Internet Explorer has finished applying the default settings, click the Close button.
Reboot your machine.

Hope that helped you remove findamo.com. Thank you for reading.

OUTbrowse Ltd – 13% Detection rate: Trojan.Win32.OutBrowse and Adware.Win32.OutBrowse

September 3, 2014adware, digital signatureAdware.Win32.OutBrowse, PUP.Optional.OutBrowse, Trojan.Win32.OutBrowseRoger Karlsson

If you’ve been following me for the last months you know that I’ve been examining many software publishers that put a digital signature on their downloads. Yesterday I found another publisher called OUTbrowse Ltd. This is how it appears when running the file:

To get more details on the publisher, you can view the certificate by right-clicking on the file, and looking under the Digital Signatures tab:

According to the certificate information, OUTbrowse Ltd appears to be located in Israel. The certificate is about two weeks old.

When running the OUTbrowse file, it displayed a link to the OUTbrowse Terms and Conditions, which were located on www.mixi.dj.

So, why did I put up this blog post? Well, the thing is that the OUTbrowse file is detected by some anti-virus programs, according to VirusTotal:

PUP.Optional.OutBrowse, Trojan.Win32.OutBrowse and Adware.Win32.OutBrowse are a few of the detection names. The detection rate is 7/54, that is 13%.

Hope this blog post helped you avoid some unwanted software on your machine.

Did you also find an OUTbrowse file? Do you remember the download link? Please post it in the comments below and I’ll upload it to VirusTotal to see if that one is also detected.