iWeBar – Removal Instruction

December 12, 2013adware, freefixerCyprus, iWeBar, NicosiaRoger Karlsson

Just a quick update. I’ve just uploaded a small removal tutorial for the iWeBar software.

If you have the iWeBar installed on your machine, you’ll probably see iWebar-bg.exe running in the Windows Task Manager and ads labeled “Powered by iwebar” in Chrome, Firefox and Internet Explorer.

There’s also a bunch of other iWeBar files that will be run by the Windows Task Scheduler that appears in FreeFixer’s scan result.

iWebar-bho.dll
iWebar-chromeinstaller.exe
iWebar-codedownloader.exe
iWebar-enabler.exe
iWebar-firefoxinstaller.exe
iWebar-updater.exe
iwebar.exe

Here’s the video:

Update 5th November: The iWebar adware is still distributed. Now the iWebar files are digitally signed by Gogo Network Club. According to the embedded certificate Gogo Network Club is located in Nicosia, Cyprus.

Powered by Object Browser and Brought by Object Browser Ads and Coupons – How To Remove

December 12, 2013adware, freefixerArmageddon Labs (BrightCircle Investments Limited), Bright Circle Investments Ltd, Cyprus, Nicosia, object browser, Sara Kodama Project, Tita-nium Great MindsRoger Karlsson

Are you getting ads labeled “Powered by Object Browser” or “Brought by Object Browser” while browsing sites such as BestBuy, E-Bay, Walmart or Amazon?

If so, you have the ObjectBrowser adware installed on your machine. Here’s a tutorial on how to remove Object Browser:

Update 2014-11-13: Now the Object Browser files are digitally signed by “Sara Kodama Project“.

Update 2014-11-19: Now the files are signed by Tita-nium Great Minds. Titanium is also located in Nicosia, Cyprus.

Update 2014-12-19: Now the files are signed by Armageddon Labs (BrightCircle Investments Limited).

FreeSoftToday – Removal Instructions

December 11, 2013UncategorizedRoger Karlsson

Found another bundled piece of software today called FreeSoftToday. It opens up a pop-up with free software offers.

These are the main files for FreeSoftToday:

The FreeSoftToday files are detected by some of the anti-virus programs when I uploaded them to VirusTotal. Here are the detection names:

Avast – Win32:Eorezo-CB [PUP] 20131211
Microsoft – Adware:Win32/EoRezo 20131211
Malwarebytes – Adware.Tuto4PC 20131211
ESET-NOD32 – a variant of Win32/Adware.EoRezo.AT 20131211

Here’s a short video tutorial on how to remove FreeSoftToday:

How To Remove Albrechto Ads, Deals and Coupons.

December 11, 2013UncategorizedRoger Karlsson

Found another variant of the WebCake adware called Albrechto. As usual it is bundled with free downloads.

If you have Albrechto on your machine, you will see an extension listed in Mozilla Firefox and AlbrechtoBHO.dll loaded into Internet Explorer.

Albrechto can be uninstalled from the Add/Remove programs dialog.

Albrechto in the Add Remove programs dialog

You can also remove Albrechto with FreeFixer. Here’s a video tutorial:

BrowseSmart – How To Uninstall – A Video Tutorial

December 11, 2013UncategorizedRoger Karlsson

Yesterday I found another adware program called BrowseSmart. BrowseSmart can show various types of ads. During my testing it added a frame on the left side of the web browser window with “Related Searches“.

BrowseSmart is bundled with free downloads. I found it in a program called “File Extractor”. The screenshot also explains what types of ads BrowseSmart can show.

BrowseSmart is bundled with software downloads

If you have BrowseSmart installed on your machine, you’ll see it listed in Internet Explorer’s and Mozilla Firefox’s extension list:

You will also see BrowseSmartBHO.dll loaded into Internet Explorer.

BrowseSmart can be uninstalled from the Add/Remove programs dialog.

You can also remove BrowseSmart with FreeFixer. Here’s a removal tutorial:

What is Outobox and How To Remove It

December 9, 2013UncategorizedRoger Karlsson

Sorry for not posting or doing any work on the FreeFixer program for the last month. Due to some unexpected events I’ve spent the last 30 days in the hospital with my new born son. Luckily everything is under control and the three of us are back home.

Today I found an adware program called Outobox. It is bundled with downloads from CNET.

outobox-bundled-cnet-download

The Outobox Terms and Conditions describes the Outobox functionality as shown in the screenshot.

Outobox Terms and Conditions

Outobox can show many types of ads, such as search ads, banner ads, text ads, etc.

Unfortunately I’ve not managed to trigger the Outobox ads on my lab machine, therefore no screenshot of the actual ads. I assume the ads are labeled “Outobox”.

Do you see the Outobox ads on your machine? Please send a screenshot and I’ll update this blog post.

If you have Outobox installed on your machine, you’ll see the Outobox Extension listed in Firefox, Chrome and Internet Explorer. You’ll also see outoboxbho.dll loaded into Internet Explorer.

Removing Outobox is easy. Just uninstall it from the Add/Remove programs dialog. If the removal fails you can remove Outobox with FreeFixer.

Please let me know what you think about Outobox by posting a comment.

RunDll BackGroundcontainer.dll Error On Startup By Conduit – How To Fix It

November 3, 2013UncategorizedRoger Karlsson

Are you getting a RunDLL error on startup message saying:

There was a problem starting C:\..\Conduit\..\BackgroundContainer.dll

The specified module could not be found.

RunDLL error - there was a problem starting the Conduit backgroundcontainer.dll error - module not found

You are probably getting this error message because the Conduit file, BackgroundContainer.dll, has been removed from your computer, but your system is still configured to run the BackgroundContainer.dll file with the rundll32.exe tool.

You can get rid of this error message by removing the start-up entry in the registry and in the Windows Task Scheduler. You can also fix the error message with the FreeFixer tool.

I’ve captured a screenshow that shows the two items you need to check for removal in FreeFixer’s scan results. Removing those two items will stop the Run DLL error from popping up during startup.

Did that help you remove the BackgroundContainer.dll RUNDLL error?

By the way, how did you get this error message? Did your anti-virus program remove Conduit’s BackgroundContainer.dll file, or did you remove it manually and forgot the items in the registry and the Task Scheduler?

Browser SafeGuard – How To Remove

October 30, 2013adware, freefixerbrowsersafeguardRoger Karlsson

Do you see an icon labelled Browser Safeguard in the system tray and BrowserSafeguard.exe running in the Windows Task Manager?

Then you have the Browser SafeGuard proxy software installed on your machine. According to the EULA it may show ads:

Furthermore, you understand and agree that: .. some services and/or software provided by Browser Safeguard contain advertising. Additionally, we may supply advertising from time to time on websites that you visit.

Under normal circumstances I usually show how to remove software with FreeFixer, but since Browser Safeguard modifies your computer’s proxy settings I think it’s better to let it handle the uninstall process. FreeFixer does not have any “restore proxy settings” feature, but that is certainly something that I should add.

Please let me know if you have lost your Internet access after removing BrowserSafeguard.exe manually. I’ll post some instructions here on how to restore Internet proxy settings.

Here’s a video tutorial where I show how to remove BrowserSafeguard:

eGdpSvc.exe – How To Uninstall

October 27, 2013freefixer, malware, trojaneGdpSvc.exeRoger Karlsson

Back in July I was first notified about the eGdpSvc.exe file. At that time, only one of the 45 engines at VirusTotal detected the file and I didn’t know how it was distributed or how it ended up and the users’ machines.

Today, I noticed that eGdpSvc.exe is still distributed so I thought I’d make a quick uninstall guide that shows how to delete eGdpSvc.exe with the help of FreeFixer. This video also shows that the “more info” links in FreeFixer can be quite useful to determine if a file is legitimate or malware.

When looking at the “more info” page of eGdpSvc.exe in the video you’ll see that eGdpSvc.exe is currently detected by 14 of the anti-virus scanners at VirusTotal.

Do you click on the more info links while trying to determine if a files is legitimate or malware?