Category Archives: freefixer

Feven Adware – How to Removal

February 11, 2014adware, freefixerfevenRoger Karlsson

Found a new adware called Feven yesterday. The screenshot from the installer should give you some insights in what the Feven software does:

There are a few anti-virus programs that detects Feven, with the following names:

PUP.Optional.Feven.A
AppRider
Crossrider (fs)

Feven can be uninstalled with help from FreeFixer. Here are some of the filenames that I’ve seen the Feven adware use:

You can also try the Feven entry in the Add/Remove programs dialog.

How did Feven find its way into your computer? I found it on a web site which package Feven with third party downloads.

How To Remove HD Streamer

February 6, 2014adware, freefixer, Uncategorizedhd streamerRoger Karlsson

I’m current working on some code for FreeFixer to repair hijacked Internet shortcuts. I’ve installed a few browsers such as Chrome, Mozilla, Safari and Opera on the lab machine, and then l installed a download that I knew messed around with the shortcuts to the browsers. Typically, the Internet shortcuts on the desktop is modified to launch an unwanted web page instead of the web page that the user wants.

While doing this I found a new adware variant called “HD Streamer“. At the moment, only Vipre is picking up ScriptHost.dll, which is the main file of HD Streamer.

HD Streamer Firefox Extension

HDStreamer has an entry in the Add/Remove programs dialog. I haven’t tested it but I suppose it works. HD Streamer in the Add/Remove programs dialog

I did however test that FreeFixer deleted both ScriptHost.dll and the Mozilla Firefox Extension without any problem.

HD Streamer's ScriptHost.dll listed in FreeFixer

Now, back to writing that code.

Ads by PassShow – How To Remove

December 21, 2013adware, freefixergld.pathticket.net, PassShowRoger Karlsson

Do you see ads labeled Ads by PassShow on your machine?

Then you got the PassShow adware installed. You may also see pop-ups from the gld.pathticket.net web site.

PassShow is pretty easy to delete with FreeFixer. The following removal instructions will remove PassShow from Internet Explorer and Mozilla Firefox.

Download, install and start FreeFixer
Start the scan.
Check 150.dll, PsUp.exe and 150.xpi for removal in the scan result, as shown in the screenshots below.
Click Fix
Restart your machine.

That’s it.

How did you get PassShow on your machine? I found it while testing a download from CNet’s Download.com site.

How To Remove ShopperPro By Goobzo

December 14, 2013adware, freefixerGoobzoRoger Karlsson

Found another adware program this morning: ShopperPro. If you got this on your machine, you will see ads popping up while browsing. They ads are labeled “by shopper pro“, “Powered by Shopper-Pro” or “brought by ShopperPro“:

You can remove Shopper Pro by checking the following files in FreeFixer’s scan result:

ShopperPro64.dll
ShopperPro.dll
ShopperPro.exe
ShopperPro.zip
SPRemove.exe
Updater.exe

There’s also a Shopper-Pro entry in the Add/Remove programs window in the Control Panel.

I found ShopperPro bundled with a free download. Where did you find ShopperPro? Did you also find it packaged with another download?

iWeBar – Removal Instruction

December 12, 2013adware, freefixerCyprus, iWeBar, NicosiaRoger Karlsson

Just a quick update. I’ve just uploaded a small removal tutorial for the iWeBar software.

If you have the iWeBar installed on your machine, you’ll probably see iWebar-bg.exe running in the Windows Task Manager and ads labeled “Powered by iwebar” in Chrome, Firefox and Internet Explorer.

There’s also a bunch of other iWeBar files that will be run by the Windows Task Scheduler that appears in FreeFixer’s scan result.

iWebar-bho.dll
iWebar-chromeinstaller.exe
iWebar-codedownloader.exe
iWebar-enabler.exe
iWebar-firefoxinstaller.exe
iWebar-updater.exe
iwebar.exe

Here’s the video:

Update 5th November: The iWebar adware is still distributed. Now the iWebar files are digitally signed by Gogo Network Club. According to the embedded certificate Gogo Network Club is located in Nicosia, Cyprus.

Powered by Object Browser and Brought by Object Browser Ads and Coupons – How To Remove

December 12, 2013adware, freefixerArmageddon Labs (BrightCircle Investments Limited), Bright Circle Investments Ltd, Cyprus, Nicosia, object browser, Sara Kodama Project, Tita-nium Great MindsRoger Karlsson

Are you getting ads labeled “Powered by Object Browser” or “Brought by Object Browser” while browsing sites such as BestBuy, E-Bay, Walmart or Amazon?

If so, you have the ObjectBrowser adware installed on your machine. Here’s a tutorial on how to remove Object Browser:

Update 2014-11-13: Now the Object Browser files are digitally signed by “Sara Kodama Project“.

Update 2014-11-19: Now the files are signed by Tita-nium Great Minds. Titanium is also located in Nicosia, Cyprus.

Update 2014-12-19: Now the files are signed by Armageddon Labs (BrightCircle Investments Limited).

Browser SafeGuard – How To Remove

October 30, 2013adware, freefixerbrowsersafeguardRoger Karlsson

Do you see an icon labelled Browser Safeguard in the system tray and BrowserSafeguard.exe running in the Windows Task Manager?

Then you have the Browser SafeGuard proxy software installed on your machine. According to the EULA it may show ads:

Furthermore, you understand and agree that: .. some services and/or software provided by Browser Safeguard contain advertising. Additionally, we may supply advertising from time to time on websites that you visit.

Under normal circumstances I usually show how to remove software with FreeFixer, but since Browser Safeguard modifies your computer’s proxy settings I think it’s better to let it handle the uninstall process. FreeFixer does not have any “restore proxy settings” feature, but that is certainly something that I should add.

Please let me know if you have lost your Internet access after removing BrowserSafeguard.exe manually. I’ll post some instructions here on how to restore Internet proxy settings.

Here’s a video tutorial where I show how to remove BrowserSafeguard:

eGdpSvc.exe – How To Uninstall

October 27, 2013freefixer, malware, trojaneGdpSvc.exeRoger Karlsson

Back in July I was first notified about the eGdpSvc.exe file. At that time, only one of the 45 engines at VirusTotal detected the file and I didn’t know how it was distributed or how it ended up and the users’ machines.

Today, I noticed that eGdpSvc.exe is still distributed so I thought I’d make a quick uninstall guide that shows how to delete eGdpSvc.exe with the help of FreeFixer. This video also shows that the “more info” links in FreeFixer can be quite useful to determine if a file is legitimate or malware.

When looking at the “more info” page of eGdpSvc.exe in the video you’ll see that eGdpSvc.exe is currently detected by 14 of the anti-virus scanners at VirusTotal.

Do you click on the more info links while trying to determine if a files is legitimate or malware?

FreeFixer v1.07

October 23, 2013freefixerRoger Karlsson

Just wanted to let you know that I’ve just released FreeFixer v1.07.

Have fun!