Did you just get a pop-up from 0c9d8370d.se and wonder where it came from? Did the 0c9d8370d.se ad appear to have been launched from a web site that under normal circumstances don’t use advertising such as pop-up windows? Or did the 0c9d8370d.se pop-up show up while you clicked a link on one of the major search engines, such as Google, Bing or Yahoo?

Here is a screenshot on the 0c9d8370d.se pop-up from my computer:

(Sorry for the large number of watermarks. If I don’t add them, the screenshot will be used without attribution at some other blogs)

If this description sounds like what you are seeing, you probably have some adware installed on your system that pops up the 0c9d8370d.se ads. Contacting the owner of the site would be a waste of time. They are not responsible for the advertisements. I’ll try help you with the 0c9d8370d.se removal in this blog post.

For those that are new to the blog: Not long ago I dedicated some of my lab computers and intentionally installed some adware programs on them. I have been monitoring the behaviour on these systems to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware updates itself, or if it downloads and installs additional unwanted software on the computers. I first spotted the 0c9d8370d.se pop-up on one of these lab machines.

0c9d8370d.se resolves to the 83.140.162.232 address. 0c9d8370d.se was created on 2013-02-22. DomainTools reports the IP as 5.150.195.167. According to YouGetSignal’s reverse lookup (lookup done on Oct 8 2015) are the following domains on the same IP:

• 0427d7.se
• 065b42ba2b.se
• 0aac4e6a54c170b0.se
• 20d625b48e.se
• 32d1d3b9c.se
• 3c41ddc0.se
• 3c45d848d99.se
• 6e2bd3848d2b73.se
• 82d914.se
• 9c1f917.se
• a5cee7.se
• aad73c550c.se
• adrotate.se
• adrotator.se
• d9ae99824.se
• e97527f0.se
• f54d6bf2b1.se
• f8350e7c1.se
• h-5-150-195-167.na.cust.bahnhof.se
• www.9c1f917.se
• www.adrotator.se
• www.d1110e4.se
• www.lowes.com

So, how do you remove the 0c9d8370d.se pop-up ads? On the machine where I got the 0c9d8370d.se ads I had PrimaryColor, FastSearch, YTDownloader, SSFK.exe, PhaseProfessor, mystartsearch, Wajam, WebShield and SFKEX64.exe installed. I removed them with FreeFixer and that stopped the 0c9d8370d.se pop-ups and all the other ads I was getting in Mozilla Firefox.

If you are wonder if there are many others out there also getting the 0c9d8370d.se ads, the answer is probably yes. Check out the traffic rank from Alexa:

The problem with this type of pop-up is that it can be launched by many variants of adware, not just the adware running on my machine. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

To remove the 0c9d8370d.se pop-up ads you need to check your machine for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:

1. What software do you have installed if you look in the Add/Remove programs dialog in the Windows Control Panel? Something that you don’t remember installing yourself or that was recently installed?
2. How about your add-ons you have in your browsers. Anything in the list that you don’t remember installing?
3. If that didn’t solve the problem, I’d recommend a scan with FreeFixer to manually track down the adware. FreeFixer is a freeware tool that I’m working on that scans your computer at lots of locations, such as browser add-ons, processes, Windows services, recently modified files, etc. If you want to get additional details about a file in the scan result, you can click the More Info link for that file and a web page will open up with a VirusTotal report which will be very useful to determine if the file is safe or malware:

   

Here’s a video tutorial showing FreeFixer in action removing pop-up ads:

Did this blog post help you to remove the 0c9d8370d.se pop-up ads? Please let me know or how I can improve this blog post.

Thank you!