Monthly Archives: November 2014

Remove aft.coupplayoff.com Pop-Up Ads

adware, pop-ups,

Did you just get a pop up from aft.coupplayoff.com and ponder where it came from? Did the aft.coupplayoff.com ad appear to have been launched from a web site that under normal circumstances don’t use aggressive advertising such as pop-up windows? Or did the aft.coupplayoff.com pop-up show up while you clicked a link on one of the major search engines, such as Google, Bing or Yahoo?

Here’s how the aft.coupplayoff.com pop-up looked like when I got it on my computer:aft.coupplayoff.com pop-up in Firefox

(I know, lots of watermarks. Have to do it to stop the copy-cats.)

I got the pop-up in Firefox, but it can also appear in Chrome and Internet Explorer. Does this sounds like your experience, you probably have some adware installed on your system that pop up the aft.coupplayoff.com ads.

For those that are new to the blog: Not long ago I dedicated some of my lab machines and deliberately installed some adware programs on them. I’ve been following the behaviour on these computers to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware auto-updates, or if it downloads additional unwanted software on the machines. I first found the aft.coupplayoff.com pop-up on one of these lab systems.

So, how do you remove the aft.coupplayoff.com pop-up ads? On the machine where I got the aft.coupplayoff.com ads I had BrowserWarden, BuyNSave and BlockAndSurf installed. I removed them with FreeFixer and that stopped the aft.coupplayoff.com pop-ups and all the other ads I was getting in Mozilla Firefox.

aft.coupplayoff.com resolves to 37.58.101.203. The domain was created 2014-09-18.

BlockAndSurf was the adware that caused the pop-ups in my case. The pop-up was labelled “Ads by BlockAndSurf“.

bxh.mulctsamsaracorbel.com ads by BlockAndSurf

What label did your pop-up ad have? Please share in the comments area.

The issue with this type of pop-up is that it can be launched by many variants of adware. I think that adware such as Salus, CheckMeUp and NewPlayer can also be responsible for the aft.coupplayoff.com popups. And there are probably other variants too. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

Anyway, here’s my suggestion for the aft.coupplayoff.com ads removal:

The first thing I would do to remove the aft.coupplayoff.com pop-ups is to examine the programs installed on the machine, by opening the “Uninstall programs” dialog. You can reach this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Uninstall a program search

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Uninstall a program dialog

Do you see something strange-looking in there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if some program was installed approximately about the same time as you started seeing the aft.coupplayoff.com pop-ups.

I think you will be able to identify and uninstall the adware with the two steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop about 8 years ago. FreeFixer is a tool designed to manually identify and uninstall unwanted software. When you’ve tracked down the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not crippled like many other removal tools out there. It won’t require you to pay for the program just when you are about to remove the unwanted files.

And if you’re having issues deciding if a file is legitimate or malware in the FreeFixer scan result, click on the More Info link for the file. That will open up a web page which contains additional details about the file. On that web page, check out the VirusTotal report which can be quite useful:

FreeFixer More Info link example
An example of FreeFixer’s “More Info” links. Click for full size.

Are you a Mac or Linux user and get the aft.coupplayoff.com pop-ups? What did you do to stop the pop-up in your browser? Please share in the comments below. Thank you!

Did this blog post help you to remove the aft.coupplayoff.com pop-up ads? Please let me know or how I can improve this blog post.

Thank you!

Remove sampleshill.xyz Pop-Up Survey Ads

pop-ups, survey,

Having issues with survey pop-ups from sampleshill.xyz? If that is the case, you might have adware installed on your machine. I got the sampleshill.xyz popups in Firefox, but they can appear if you are using Chrome, Internet Explorer, Safari or Opera too.

The sampleshill.xyz pop-up survey

I’ll try help you with the sampleshill.xyz removal in this blog post.

For those that are new to the blog: Not long ago I dedicated some of my lab computers and deliberately installed some adware programs on them. I have been monitoring the behaviour on these machines to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware updates itself automatically, or if it downloads additional unwanted software on the computers. I first spotted the sampleshill.xyz pop-up surveys on one of these lab machines.

sampleshill.xyz resolves to the following IP: 199.59.243.120. And fuvzz.promorewards.sampleshill.xyz is located at 199.59.243.121. The sampleshill domain was created just a few days ago: 2014-11-19.

So, how do you remove the sampleshill.xyz pop-up survey ads? On the machine where I got the sampleshill.xyz ads I had CheckMeUp, PennyBee and BuyNSave installed. I removed them with FreeFixer and that stopped the sampleshill.xyz surveys and all the other ads I was getting in Mozilla Firefox.

The issue with this type of pop-up is that it can be launched by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

To remove the sampleshill.xyz popup ads you need to review your computer for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:

  1. Check what software you have installed in the Add/Remove programs dialog in the Windows Control Panel.
  2. What add-ons do you have in your browser?
  3. If that does not help, I’d recommend a scan with FreeFixer to track down the unwanted software. FreeFixer is a tool that I’m working on that scans your computer at lots of locations, such as browser add-ons, processes, Windows services, recently modified files, etc. If you want to get additional details about a file in the scan result, you can click the More Info link for that file and a web page will open up with a VirusTotal report which will be very useful to determine if the file is safe or malware:

    FreeFixer More Info link example
    An example of FreeFixer’s “More Info” links. Click for full size.

Did this blog post help you to remove the sampleshill.xyz pop up surveys? Please let me know or how I can improve this blog post.

Thank you!

Remove Hold Page and the Hold Page Ads

adware, freefixer

Hello readers. Another day, another blog post. Did something called Hold Page appear on your system? This is a variant of CrossRider that I’ve written about many times before. If you have Hold Page installed on your machine, you will see new add-ons installed in Mozilla Firefox and Internet Explorer. Nothing was installed in Google Chrome. I’ll show how to remove Hold Page in this blog post with the FreeFixer removal tool.

Hold Page 1.0.1 firefox

Hold Page is bundled with other software. Bundled means that it is included in another software’s installer. Generally, you can avoid bundled software such as Hold Page by being careful when installing software and declining the bundled offers in the installer and making sure that you have downloaded the software from the official site and not from some third party.

When I find some new bundled software I normally upload it to VirusTotal to verify if the anti-virus progams there detect something suspicious. 11 of the 55 scanners detected the file. The Hold Page files are detected as BrowseFox.F by AVG, Trojan.BPlug.215 by DrWeb and PUP.Optional.HoldPage.A by Malwarebytes.

Hold Page virustotal

If you would like to remove HoldPage you can do so with the FreeFixer removal tool. Here’s a few screengrabs from the removal that should help you: You may have to restart your computer to complete the removal.

remove Hold Page firefox remove Hold Page Internet Explorer

Hope this helped you solved the HoldPage problem.

I stumbled upon Hold Page while testing out some downloads that are known to bundled lots of unwanted software. Any idea how Hold Page was installed on your machine? Please share your story the comments below. Thank you very much!

Thanks for reading. Welcome back!

How To Remove superworldonline.xyz Pop-Up Surveys

pop-ups, survey,

Getting pop-up surveys from superworldonline.xyz? Then you have adware on your machine. I used FreeFixer to remove BlockAndSurf, TinyWallet and BrowserWarden and that stopped the superworldonline.xyz pop-ups.

superworldonline.xyz

 

superworldonline.xyz resolves to 184.73.247.179 and 8awzz.rewardszone.superworldonline.xyz resolves to 208.87.34.65.

.

What adware did you find on your machine?

Remove fastwindowlink.xyz Pop-Up Survey Ads

adware, pop-ups, survey,

Did you just get a pop-up survey from fastwindowlink.xyz and wonder where it came from? Did the fastwindowlink.xyz ad appear to have been initiated from a web site that under normal circumstances don’t use aggressive advertising such as pop-up windows? Or did the fastwindowlink.xyz pop-up surveys show up while you clicked a link on one of the major search engines, such as Google, Bing or Yahoo.?

Here’s how the fastwindowlink.xyz pop-up survey looked like when I got it on my machine:

fastwindowlink.xyz

It claims that by completing the poll, you have a chance of winning a 10.000 SEK gift card that can be used at Willys, ICA and Hemköp. These are 3 major grocery stores in Sweden.

Does this sounds like what you are seeing, you almost certainly have some adware installed on your computer that pop up the fastwindowlink.xyz survey ads. Don’t blame the people that runs the web site you were at, the ads are most likely not coming from that web site, but from the adware that’s running on your system. I’ll do my best to help you with the fastwindowlink.xyz removal in this blog post.

edbzz.exclusiverewards.fastwindowlink.xyz resolves to the 50.116.43.198 IP, and fastwindowlink.xyz to 208.87.34.65. The domain was registered on 2014-11-19.

For those that are new to the blog: Recently I dedicated some of my lab machines and wilfully installed some adware programs on them. I’ve been observing the behaviour on these computers to see what kinds of ads that are displayed. I’m also looking on other interesting things such as if the adware updates itself, or if it installs additional unwanted software on the computers. I first spotted the fastwindowlink.xyz pop-up on one of these lab computers.

So, how do you remove the fastwindowlink.xyz pop-up survey ads? On the machine where I got the fastwindowlink.xyz ads I had Wajam, WindowsMangerProtect and Browser Warden installed. I removed them with FreeFixer and that stopped the fastwindowlink.xyz pop-ups and all the other ads I was getting in Firefox.

The issue with this type of pop-up is that it can be launched by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

To remove the fastwindowlink.xyz pop-up surveys you need to review your system for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:

The first thing I would do to remove the fastwindowlink.xyz pop-ups is to examine the software installed on the machine, by opening the “Uninstall programs” dialog. You can find this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Uninstall a program search

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Uninstall a program dialog

Do you see something dubious listed there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if some program was installed approximately about the same time as you started observing the fastwindowlink.xyz pop-ups.

I think you will be able to find and uninstall the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I’ve developed since 2006. Freefixer is a tool built to manually identify and remove unwanted software. When you’ve found the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not locked like many other removal tools out there. It won’t require you to pay a fee just when you are about to remove the unwanted files.

And if you’re having problems figuring out if a file is clean or adware in FreeFixer’s scan result, click on the More Info link for the file. That will open up a web page which contains more details about the file. On that web page, check out the VirusTotal report which can be very useful:

FreeFixer More Info link example
An example of FreeFixer’s “More Info” links. Click for full size.

Are you a Mac or Linux user and get the fastwindowlink.xyz pop-up surveys? What did you do to stop the pop-up in your browser? Please share in the comments below. Thank you!

Did this blog post help you to remove the fastwindowlink.xyz pop-up survey ads? Please let me know or how I can improve this blog post.

Thank you!

Remove ars.couphole.com Pop-Up Ads

adware, pop-ups, ,

Did you just get a pop-up ad from ars.couphole.com and wonder where it came from? Did the ars.couphole.com ad appear to have been popped up from a web site that under normal circumstances don’t use aggressive advertising such as pop-up windows? Or did the ars.couphole.com pop-up show up while you clicked a link on one of the big search engines, such as Google, Bing or Yahoo.?

Here’s how the ars.couphole.com pop-up looked like when I got it on my machine:

ars.couphole.com pop-up

(Sorry for the large number of watermarks. If I don’t add them, the screenshot will be used without attribution at some other blogs)

Does this sounds like what you are seeing, you most likely have some adware installed on your machine that pop up the ars.couphole.com ads. So don’t write angry emails to the site you were browsing, the advertisements are almost certainly not coming from them, but from the adware on your system. I’ll do my best to help you with the ars.couphole.com removal in this blog post.

Those that have been reading this blog already know this, but for new visitors: Recently I dedicated a few of my lab computers and wilfully installed a few adware programs on them. Since then I have been observing the behaviour on these computers to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware auto-updates, or if it downloads and installs additional unwanted software on the computers. I first found the ars.couphole.com pop-up on one of these lab machines. I got the pop up in Firefox, but it can appear in Chrome and Internet Explorer too.

ars.couphole.com resolves to the 37.58.101.205 IP address. The ars.couphole.com domain was created on 2014-09-18, and the Whois record was updated today. The domain inb.csrvrgroup.com is mentioned in the URL. That domain seems to appear in all pop-ups of this type.

So, how do you remove the ars.couphole.com pop-up ads? On the machine where I got the ars.couphole.com ads I had BlockAndSurf, TinyWallet and BrowserWarden installed. I removed them with FreeFixer and that stopped the ars.couphole.com pop-ups and all the other ads I was getting in Mozilla Firefox.

BlockAndSurf was the adware that caused the pop-ups in my case. The pop up was labelled “BlockAndSurf“.

bxh.mulctsamsaracorbel.com ads by BlockAndSurf

What label did your pop-up ad have? Please share in the comments area below.

The issue with this type of pop-up is that it can be launched by many variants of adware. I think that adware such as NewPlayer, CheckMeUp and SaferSurf can also be responsible for the ars.couphole.com popups. And there are probably other variants too. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

Anyway, here’s my suggestion for the ars.couphole.com ads removal:

The first thing I would do to remove the ars.couphole.com pop-ups is to examine the programs installed on the machine, by opening the “Uninstall programs” dialog. You can find this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Uninstall a program search

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Uninstall a program dialog

Do you see something dubious listed there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if some program was installed about the same time as you started seeing the ars.couphole.com pop-ups.

I think you will be able to identify and uninstall the adware with the two steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop about 8 years ago. Freefixer is a tool built to manually identify and uninstall unwanted software. When you’ve identified the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not locked like many other removal tools out there. It won’t require you to pay for the program just when you are about to remove the unwanted files.

And if you’re having a mess deciding if a file is legit or adware in FreeFixer’s scan report, click on the More Info link for the file. That will open up a web page which contains more details about the file. On that web page, check out the VirusTotal report which can be very useful:

FreeFixer More Info link example
An example of FreeFixer’s “More Info” links. Click for full size.

Are you a Mac or Linux user and get the ars.couphole.com pop-ups? What did you do to stop the pop-up in your browser? Please share in the comments below. Thank you very much!

Did this blog post help you to remove the ars.couphole.com pop-up ads? Please let me know or how I can improve this blog post.

Thank you!

How To Stop blisteringadserver.biz Pop-Up Ad Surveys

pop-ups, survey

Having problems with pop-up surveys from blisteringadserver.biz? If so, you may have adware installed on your system. I got the blisteringadserver.biz pop-ups in Firefox, but they can appear if you are using Chrome, Internet Explorer, Safari or Opera too.

blisteringadserver.biz pop-up survey

Does this sounds like your experience, you almost certainly have some adware installed on your computer that pop up survey the blisteringadserver.biz ads.  I’ll try help you to remove the blisteringadserver.biz in this blog post.

For those that are new to the blog: Some time ago I dedicated a few of my lab systems and knowingly installed a few adware programs on them. I’ve been observing the actions on these machines to see what kinds of ads that are displayed. I’m also looking on other interesting things such as if the adware updates itself automatically, or if it downloads and installs additional unwanted software on the machines. I first observed the blisteringadserver.biz pop-up survey on one of these lab computers.

So, how do you remove the blisteringadserver.biz pop-up ads? On the machine where I got the blisteringadserver.biz ads I had CheckMeUp, SmartOnes and BrowserWarden installed. I removed them with FreeFixer and that stopped the blisteringadserver.biz pop-ups and all the other ads I was getting in Mozilla Firefox.

The blisteringadserver.biz domain is attracting some traffic, just check out the Alexa traffic rank:

blisteringadserver.biz traffic rank

The issue with this type of pop-up is that it can be launched by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

Anyway, here’s my suggestion for the blisteringadserver.biz ads removal:

The first thing I would do to remove the blisteringadserver.biz pop-ups is to examine the software installed on the machine, by opening the “Uninstall programs” dialog. You can reach this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Uninstall a program search

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Uninstall a program dialog

Do you see something dubious in there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if something was installed approximately about the same time as you started seeing the blisteringadserver.biz surveys.

I think you will be able to find and uninstall the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I’ve developed since 2006. It’s a tool designed to manually track down and remove unwanted software. When you’ve found the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not locked down like many other removal tools out there. It will not require you to pay for the program just when you are about to remove the unwanted files.

And if you’re having a hard time figuring out if a file is clean or malware in the FreeFixer scan result, click on the More Info link for the file. That will open up a web page which contains additional details about the file. On that web page, check out the VirusTotal report which can be quite useful:

FreeFixer More Info link example
An example of FreeFixer’s “More Info” links. Click for full size.

Did this blog post help you to remove the blisteringadserver.biz pop-up surveys? Please let me know or how I can improve this blog post.

Thank you!

How To Remove cloudtracked.com Pop-Up Ads

adware, freefixer, pop-ups

Having issues with pop-ups or new tabs appearing from cloudtracked.com? If that is the case, you may have adware installed on your computer. I got the cloudtracked.com pop-ups in Firefox, but they can appear if you are using Chrome, Internet Explorer, Safari or Opera too.

cloudtracked.com pop-up

(Sorry for the ridiculous use of watermarks. I have to do it to stop the copy-cats.)

If this sounds like your experience, you most likely have some adware installed on your machine that pop up the cloudtracked.com ads. I’ll do my best to help you with the cloudtracked.com removal in this blog post.

Those that have been reading this blog already know this, but for new visitors: A little while back I dedicated some of my lab machines and intentionally installed a few adware programs on them. I’ve been following the behaviour on these computers to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware auto-updates, or if it downloads and installs additional unwanted software on the systems. I first spotted the cloudtracked.com pop-up on one of these lab systems.

So, how do you remove the cloudtracked.com pop-up ads? On the machine where I got the cloudtracked.com ads I had BlockAndSurf, TinyWallet and BrowserWarden installed. I removed them with FreeFixer and that stopped the cloudtracked.com pop-ups and all the other ads I was getting in Mozilla Firefox. I don’t know which one of the adware that were responsible for the pop-ups.

It seems as cloudtracked.com is getting quite a lot of traffic, based on Alexa’s traffic rank:

cloudtracked.com traffic rank

Or that probably an understatement. Rank 853 means they are getting a tremendous amount of traffic. Their traffic seems to have boomed in end of July/beginning of August judging from diagram above. www.cloudtracked.com resolves to the 54.183.91.145 IP address. There’s another site on the same IP called media770.com.

The issue with this type of pop-up is that it can probably be launched by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

To remove the cloudtracked.com pop-up ads you need to review your machine for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:

The first thing I would do to remove the cloudtracked.com pop-ups is to examine the software installed on the machine, by opening the “Uninstall programs” dialog. You can reach this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows Operating System you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Uninstall a program search

Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Uninstall a program dialog

Do you see something shady in there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if some program was installed approximately about the same time as you started seeing the cloudtracked.com pop-ups.

I think most users will be able to identify and remove the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I’ve developed since 2006. FreeFixer is a tool built to manually find and uninstall unwanted software. When you’ve found the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.

FreeFixer’s removal feature is not locked like many other removal tools out there. It will not require you to purchase the program just when you are about to remove the unwanted files.

And if you’re having troubles figuring out if a file is legit or unsafe in FreeFixer’s scan report, click on the More Info link for the file. That will open up your browser with a page which contains additional information about the file. On that web page, check out the VirusTotal report which can be quite useful:

FreeFixer More Info link example
An example of FreeFixer’s “More Info” links. Click for full size.

Are you a Mac or Linux user and get the cloudtracked.com pop-ups? What did you do to stop the pop-up in your browser? Please share in the comments below. Thanks!

Did this blog post help you to remove the cloudtracked.com pop-up ads? Please let me know or how I can improve this blog post.

Thank you!