Tag Archives: AddLyrics

SpeeditApp Ads Removal Instructions

Hi there. Found an adware called SpeeditApp tonight and wanted give you some removal instructions. SpeeditApp appears to be a variant of Graftor. If SpeeditApp is running on your machine, you will see ads labeled SpeeditApp Ads appearing while searching at Google.

SpeeditApp ads google

I’ll show how to remove SpeeditApp in this blog post with the FreeFixer removal tool.

SpeeditApp is distributed by a method called bundling. Bundling means that a piece of software is included in other software’s installers. This is how SpeeditApp was disclosed in the installer when I found it.

SpeeditApp by Revizer

As always when I run into some new bundled software I uploaded it to VirusTotal to check if the anti-malware programs there detect anything interesting. Of the 57 scanners, 16 detected the file. The SpeeditApp files are detected as AddLyrics_r.ME by AVG, a variant of Win32/Adware.AddLyrics.DW by ESET-NOD32, Gen:Variant.Graftor.179236 by GData, Trj/Genetic.gen by Panda and Adware.AddLyrics/Variant by SUPERAntiSpyware.

You probably want to remove SpeeditApp. You can just select the SpeeditApp files in FreeFixer for removal. A restart of your computer may be required to complete the removal. Problem taken care of.

remove speeditapp ie

Hope that helped you with the removal.

Did you also find SpeeditApp on your computer? Any idea how it installed? Please share by posting a comment. Thank you!

Thanks for reading!

Remove bxh.mulctsamsaracorbel.com Pop-Up Ads

Are you getting pop-ups from bxh.mulctsamsaracorbel.com while browsing in Chrome, Firefox or Internet Explorer? Do the pop-ups appear even though the built-in pop-up blocker in your browser is enabled? If that is the case, you probably have some sort of adware installed on your machine. This blog post will hopefully help you remove the bxh.mulctsamsaracorbel.com pop-ups ads.

bxh.mulctsamsaracorbel.com pop-up

If you have been following me here on the blog you know that I’ve installed some adware on purpose on my lab machines and that I’m currently monitoring what kind of advertisements that appears, the domain names of the pop-ups and other actions that the adware performs. The adware I have installed on this lab machines are TinyWallet, Browser Warden and BlockAndSurf. As you you can see in the screenshot below, the bxh.mulctsamsaracorbel.com pop-up is labeled BlockAndSurf, so there we have the adware that was responsible for the pop-up on my machine. So, in my case, the BlockAndSurf removal stopped the bxh.mulctsamsaracorbel.com pop-ups.

bxh.mulctsamsaracorbel.com ads by BlockAndSurf

There’s a problem though. BlockAndSurf is not the only adware that launch the bxh.mulctsamsaracorbel.com pop-ups. If your pop-up also is labeled with the adware name, go ahead and uninstall it, that should solve the problem.

However, the pop-ups are not always nicely labeled like that, so you might have to get your hands dirty to track down the adware that pop up the ads. The Add/Remove programs dialog in the Windows Control Panel and you browser’s add-on menu is a good start to search for suspicious software.

BlockAndSurf is variant of an adware family, often referred to as “AddLyrics” by the anti-virus programs. I think that the pop-ups are opened by some of the other variants too, not just BlockAndSurf. I’ve seen the following labels on the bxh.mulctsamsaracorbel.com pop-up type: Salus, CheckMeUp, Safer-Surf and NewPlayer.

I did a search in FreeFixer’s library of files to dig up a few more AddLyrics variants. It’s possible that one of these could be responsible for the bxh.mulctsamsaracorbel.com ads:

  • TubeSaver
  • SuperLyrics
  • LyricXeeker
  • MarkKit
  • PassShow
  • PassWidget
  • Plus-HD
  • Re-markit
  • ViewPassword
  • Re-Markable
  • Better Mark-it

If that does not help, you can try FreeFixer, a tool that I’m working on that assists users to track down and remove unwanted software. It’s a freeware tool. Tip, if you have difficulties determining if a file in FreeFixer’s scan result is legitimate or malware, click on the More Info links. That will bring up the file information page, which contains useful information about the file, such as a VirusTotal report for the file.

Screenshot showing how FreeFixer's "More Info" links opens up the file information page with a VirusTotal report.
FreeFixer’s More Info links. Click for full size.

Please let me know if you managed to track down what caused the bxh.mulctsamsaracorbel.com pop-ups in your case. What adware did you uninstall from your machine? Your comment will help other users in the same situation.

Thanks for reading, and welcome back to the blog.


Remove Ads by CheckMeUp

Hello there and welcome to the FreeFixer blog. Just a short post on an adware called CheckMeUp. If the CheckMeUp adware is installed on your machine, you’ll find ads labeled “Ads by CheckMeUp”, a new add-on named CheckMeUp added into Internet Explorer and Firefox and a process called CheckMeUp.exe running in the Windows Task Manager. I’ll show how to remove CheckMeUp in this blog post with the FreeFixer removal tool.

Ads by CheckMeUp pop-up Ads by CheckMeUp mouse over pop-up Ads by CheckMeUp banner

checkmeup.exe in the Windows Task Manager

Here’s how CheckMeUp shows up in Firefox and Internet Explorer:

CheckMeUp Internet Explorer CheckMeUp 1.179 firefox add-on

CheckMeUp is distributed by a tactic called bundling. Bundling means that a piece of software – in this case CheckMeUp – is included in other software’s installers. When I first found CheckMeUp, it was bundled with a download called FLV Player by OutBrowse.

OutBrowse LTD

Generally, you can avoid bundled software such as CheckMeUp by being careful when installing software and declining the bundled offers in the installer.

When I find some new bundled software I usually upload it to VirusTotal to see if the anti-malware tools there detect something. 3 of the 55 anti-virus scanners detected the file. The CheckMeUp.exe file is detected as AddLyrics by Sophos and Revizer (fs) by VIPRE.

CheckMeUp.exe virus total report

Since you probably want to remove CheckMeUp, these are the items you should check for removal if you want to remove it with FreeFixer. You might have to restart your machine to complete the removal. Problem taken care of.

CheckMeUp scheduled task CheckMeUp firefox freefixer CheckMeUp browser helper object

Hope that helped you to figure out how to do the removal.

Any idea how CheckMeUp was installed on your computer? Please let me and the readers know by posting a comments. Thank you!

Thanks for reading. Welcome back!

Update 2014-12-06: CheckMeUp is now using files named webinstrNewH.sys184_x64.dll and 184.dll.



How To Remove NewPlayer Ads

Did you see a new type of ads labeled Ads by NewPlayer popping up recently on your computer, even on web sites that normally don’t show any ads? Then you have the NewPlayer adware on your machine. The two types of NewPlayer ads that I’ve seen is a standard banner (to the left), and the Nav-Links roll-over ad type (to the right), as shown in the screenshot below.Ads by NewPlayer

Removing NewPlayer a one minute job with FreeFixer. All you need to do is to selected the NewPlayer files for removal, and then hit the Fix button. The filenames for NewPlayer can vary somewhat. In my case they were called NewPlayerFT171.exeNewPlayerV40.exe and NewPlayerLwruQw.exe. I’m sure you can identify them on your computer. Here’s the NewPlayer files in the FreeFixer scan result:

NewPlayer.exe Service NewPlayer Scheduled Tasks

Newplayer Process in FreeFixer

The detection rate for the NewPlayer adware appears to be pretty low. 3 of the 52 anti-virus scanners at VirusTotal detected the NewPlayer file. Avast refers to it as Win32:Adware-BQV and Baidu and ESET-NOD32 calls it AddLyrics.


How did you get NewPlayer on your computer?