Do you have something called Severe Weather Alerts installed on your machine and wonder where it came from?
I found Severe Weather Alerts while testing out an un-official Google Chrome download which bundled the Weather alerts software, as you can see in the screenshot below.
Any idea where you got Severe Weather Alerts?
Are you seeing ads labeled “Ads by SaferSearch” while browsing the web? Then you have the SaferSearch adware installed on your machine.
I found SaferSearch while testing a download. Here’s how it was disclosed in the installer:
Removing SaferSearch can be done with FreeFixer, by selecting the SaferSearch files in the scan result:
How did you get SaferSearch on your computer?
Just found a program called GridMonetize bundled with an unofficial Google Chrome download. The main file of GridMonetize appears to be Ctp.exe. detected as dnSauce, MSIL/Injector.EJO, Worm.Win32.Msil, etc:
You can remove GridMonetize by selecting the CtP.exe file for removal in FreeFixer:
Did you get GridMonetize on your computer?
Just a quick post before going back to working on FreeFixer. Found a “Google Chrome” download this morning, digitally signed by Smart Secure Software S.l.
The problem is that it was not an official Chrome download. The setup file bundled a large number of potentially unwanted programs, such as GridMonetize, IStartSurf, PepperZip, Severe Weather Alerts, Wajam, Browser App and CostMin, as shown in the screenshots below:
And here’s the VirusTotal report:
DomainIQ, SoftPulse and Smart Secure Software are some of the detection names.
Did you also find a file digitally signed by Smart Secure Software S.l.? What kind of download was it and where did you find it?
Do you see an add-on listed in Firefox and Internet Explorer called MySearch?
The MySearch add-on is detected by some of the anti-virus programs, according to VirusTotal:
MultiPlug and QVM30 are some of the detection names.
So, how about the MySearch removal? Easy with FreeFixer, just select the MySearch files:
Getting ads labeled Ads by TheTornTV on top of the Google search results as show in the screenshot below?
As you’ve probably figured out you’ve got an adware called TheTornTV running on your machine. You can also see it in Mozilla’s Add-on dialog:
Removing TheTornTV is pretty easy. Just select the TheTornTV in FreeFixer, as shown in the screenshots:
I’ve made a quick video that shows FreeFixer in action while removing TheTornTV. Hope you find it useful.
Have your web browser been changed to use the websearch.wonderfulsearches.info web site for searches?
No problem, you can use FreeFixer to remove websearch.wonderfulsearches.info. Just select the wonderfulsearches.info items, as shown below:
Here’s a video which shows FreeFixer in action removing websearch.wonderfulsearches.info:
How did you get WondefulSearches on your machine?
I’ve previously written about a program called JDownloader. I just found out that another company, named Meta Installer LLC, is also signing the JDownloader setup file. The setup file is detected by many of the anti-virus scanners at VirusTotal.
Just wanted to let you know. Hope this helped you avoid installing some adware on your machine.
Do you see advertisements labeled Ads By Cinema-Plus 1.2, while browsing the web? If so, you have an adware called CinameHDPure installed on your machine. The CinameHDPure files are digitally signed by a company called Motoko Group. This how the Ads By Cinema-Plus 1.2 looks like:
Removing CinameHDPure is pretty straightforward. Just select the CinameHDPure files in FreeFixer as shown in the screenshots and you’ll be good:
I think there are multiple variants of this adware. The variant I found was named CinameHDPureV9.5.
How did you get the Ads By Cinema-Plus ads on your machine?
Did your search settings and home page in Mozilla Firefox and Internet Explorer get changed to Groovorio.com . No problem, just select the Groovorio.com items in FreeFixer‘s scan result and the problem will be solved.
How did you get Groovorio.com on your computer? I found it bundled in a downloader program. Here’s how it was disclosed in the installer:
Hope you found this useful.