Welcome! Just a short post on a publisher called Domains and hosting LLC.
If you have a Domains and hosting LLC file on your machine you may have noticed that Domains and hosting LLC is displayed as the publisher in the UAC dialog when double-clicking on the file.
It’s possible to view additional information about the certificate by right-clicking on the file, choosing properties and then clicking on the Digital Signatures tab. According to the certificate we can see that Domains and hosting LLC is located in Vinnycya/Vinnycka, Ukraine and that the certificate is issued by COMODO RSA Code Signing CA.
35% of the scanners detected the file. Some of the detection names for the MediaPlayer__6741_i1466276160_il50790.exe file are Gen:Variant.Adware.Strictor.77177, PUA.Amonetize!, Trojan.Amonetize.441, not-a-virus:AdWare.Win32.Amonetize.zzl and PUP.Optional.Amonetize.
Did you also find a file digitally signed by Domains and hosting LLC? What kind of download was it and where did you find it?
Just wanted to put up a short post before going to bed. I just found a new adware named UniDeals and wanted to give you some removal instructions. UniDeals appears to be a variant of UniSales that I’ve blogged about before. If UniDeals is installed on your computer, you’ll notice new add-ons installed into Firefox and Internet Explorer, called UniSales and YouTubeAdBlocker and a new extension installed into Chrome, with a name that appears to change with each install. I’ll show how to remove UniDeals in this blog post with the FreeFixer removal tool.
I didn’t see any UniDeals ads on the machine, but if it uses the same labelling as UniSales, the ads will say “Ads by UniDeals“.
UniDeals is bundled with a number of downloads. Bundling means that software is included in other software’s installers. This is how UniDeals was disclosed in the installer when I found it.
Generally, you can avoid bundled software such as UniDeals by being careful when installing software and declining the bundled offers in the installer.
As usual when I stumble upon some new bundled software I uploaded it to VirusTotal to verify if the anti-virus scanners there find anything suspicious. Only 2 of the anti-malware scanners detected the UniDeals file. Avira reports UniDeals as ADWARE/MultiPlug.Gen4 and ESET-NOD32 calls it a variant of Win64/Adware.MultiPlug.F.
Hopefully the others will catch up in the next days.
All you need to do to remove UniDeals is to check the UniDeals files in the scan result and click the Fix button. A reboot of your machine may be required to complete the removal. Here’s a few screenshots that should help you along the way:
Hope this helped you remove the UniDeals adware.
Do you also have UniDeals on your machine? Any idea how it was installed? Please share by posting a comment. Thank you very much!
Hope you found this useful and thanks you for reading.
Do you see a “2015 Browser Survey” survey from a .country domain while browsing websites that usually don’t advertise in pop-up windows? Do the survey pop-ups manage to bypass the built-in pop-up blockers in Chrome, Firefox, Internet Explorer or Safari. Perhaps the .country pop-ups appear when clicking search results from Google? Or does the surveys appear even when you’re not browsing?
Here an example on how the “2015 browser survey” at a .country domain can look like:
Typically, the web page appears in a new tab and shows a “2015 Browser Survey” and claims to give you chance of winning something by completing the survey. In this case, it tempts you with Apple’s iMac, iPhone 6 or an iPad Air. The survey is also localised, poorly, which is good since it makes it easier to dismiss it. In my case, the survey is localised to swedish. The above survey is from the lamptiger.country domain, but I’ve seen the same type of survey pop up from other domains. Here’s a few:
etc.. What .country-domain did you see in the survey that popped up on your machine? Please let me and the readers know by posting a comment.
If you also see this on your machine, you probably have some adware installed on your computer that pops up the .country ads. So don’t write angry emails to the web site you were browsing, the ads are almost certainly not coming from them, but from the adware on your machine. I’ll try help you with the .country survey removal in this blog post.
Those that have been following this blog already know this, but here we go: Not long ago I dedicated some of my lab machines and deliberately installed some adware programs on them. I’ve been tracking the behaviour on these computers to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware updates itself automatically, or if it installs additional unwanted software on the computers. I first noticed the .country pop-up survey on one of these lab machines.
Who owns these .country domains? I don’t know. This is the registrant info from the WHOIS database:
Registrant ID: 283612-MMd1
Registrant Name: PrivacyDotLink Customer 302315
Registrant Organization:
Registrant Street: PO Box 30485
Registrant City: Seven Mile Beach
Registrant State/Province: Grand Cayman
Registrant Postal Code: KY1-1202
Registrant Country: KY
Registrant Phone: +1.3457495465
So, how do you remove the .country pop-up surveys? On the machine where I got the .country ads I had TinyWallet, BlockAndSurf and BrowserWarden installed. I removed them with FreeFixer and that stopped the .country pop-ups and all the other ads I was getting in Mozilla Firefox.
The issue with pop-ups such as this one is that it can be popped up by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the surveys.
So, what should done to solve the problem? To remove the .country pop-up surveys you need to examine your system for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:
The first thing I would do to remove the .country pop-up surveys is to examine the software installed on the machine, by opening the “Uninstall programs” dialog. You can reach this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows Operating System you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Do you see something dubious listed there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if some program was installed approximately about the same time as you started seeing the .country pop-ups.
Then you can examine you browser add-ons. Adware often appear under the add-ons dialog in Firefox, Chrome, Internet Explorer or Safari. Is there anything that looks suspicious? Something that you don’t remember installing?
I think you will be able to identify and remove the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop many years ago. It’s a tool designed to manually track down and uninstall unwanted software. When you’ve identified the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.
FreeFixer’s removal feature is not locked down like many other removal tools out there. It will not require you to pay for the program just when you are about to remove the unwanted files.
And if you’re having a hard time figuring out if a file is legit or malware in FreeFixer’s scan report, click on the More Info link for the file. That will open up a web page which contains more details about the file. On that web page, check out the VirusTotal report which can be very useful:
An example of FreeFixer’s “More Info” links. Click for full size.
Here’s a video guide showing how to remove pop-up ads with FreeFixer:
Did this blog post help you to remove the .country pop-up ads? Please let me know or how I can improve this blog post.
Did you just get a pop-up from selectgo.net and wonder where it came from? Did the selectgo.net ad appear to have been initiated from a web site that under normal circumstances don’t use aggressive advertising such as pop-up windows? Or did the selectgo.net pop-up show up while you clicked a link on one of the major search engines, such as Google, Bing or Yahoo?
Here’s a screenshot of the selectgo.net pop-up ad when it showed up on my machine:
I had some problems capturing a screenshot since the pop-up usually appeared quickly and then disappeared. At times, selectgo.net can also be seen in the status bar of the browser, saying “Waiting for static.selectgo00.selectgo.net“:
Here’s a screenshot from when I captured selectgo.net in a network monitor:
I’ve also spotted ad.selectgo00.selectgo.net in the network log.
Does this sound like what you see your system, you most likely have some adware installed on your computer that pops up the selectgo.net ads. Contacting the owner of the web site would be a waste of time. They are not responsible for the ads. I’ll do my best to help you with the selectgo.net removal in this blog post.
I found the selectgo.net pop-up on one of the lab computers where I have some adware running. I’ve talked about this in some of the previous blog posts. The adware was installed on purpose, and from time to time I check if anything new has appeared, such as pop-up windows, new tabs in the browsers, injected ads on site that usually don’t show ads, or if some new files have been saved to the hard-drive.
selectgo.net was registered on 2013-08-06. selectgo.net resolves to the 108.174.149.154 IP address and static.selectgo00.selectgo.net to 54.230.193.85.
I’ve also seen the ad.selectgo00.selectgo.net (54.192.98.188) subdomain in use.
So, how do you remove the selectgo.net pop-up ads? On the machine where I got the selectgo.net ads I had TinyWallet, BlockAndSurf and BrowserWarden installed. I removed them with FreeFixer and that stopped the selectgo.net pop-ups and all the other ads I was getting in Mozilla Firefox.
The issue with pop-ups like this one is that it can be initiated by many variants of adware, not just the adware that’s installed on my computer. This makes it impossible to say exactly what you need to remove to stop the pop-ups.
So, what can be done to solve the problem? To remove the selectgo.net pop-up ads you need to review your system for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:
Examine what programs you have installed in the Add/Remove programs dialog in the Windows Control Panel. Do you see something that you don’t remember installing or that was recently installed?
How about your browser add-ons. Anything in the list that you don’t remember installing?
If that didn’t solve the problem, I’d recommend a scan with FreeFixer to manually track down the adware. FreeFixer is a freeware tool that I’m working on that scans your computer at lots of locations, such as browser add-ons, processes, Windows services, recently modified files, etc. If you want to get additional details about a file in the scan result, you can click the More Info link for that file and a web page will open up with a VirusTotal report which will be very useful to determine if the file is safe or malware:
An example of FreeFixer’s “More Info” links. Click for full size.
Here’s a video tutorial on how to remove the pop-ups with FreeFixer:
Did this blog post help you to remove the selectgo.net pop-up ads? Please let me know or how I can improve this blog post.
Did you just get a pop-up from superiends.org and wonder where it came from? Did the superiends.org ad appear to have been popped up from a web site that under normal circumstances don’t use aggressive advertising such as pop-up ads? Or did the superiends.org pop-up show up while you clicked a link on one of the big search engines, such as Google, Bing or Yahoo?
Here’s how the superiends.org pop-up looked like when I got it on my machine:
If you also see this on your computer, you probably have some adware installed on your computer that pops up the superiends.org ads. So there’s no idea contacting the owner of the web site you currently were browsing. The ads are not coming from them. I’ll do my best to help you remove the superiends.org pop-up in this blog post.
I found the superiends.org pop-up on one of the lab machines where I have some adware running. I’ve talked about this in some of the previous blog posts. The adware was installed on purpose, and from time to time I check if something new has appeared, such as pop-up windows, new tabs in the browsers, injected ads on web site that usually don’t show ads, or if some new files have been saved to the hard-drive.
superiends.org was created on 2014-08-20. superiends.org resolves to the 104.28.6.50 IP address.
So, how do you remove the superiends.org pop-up ads? On the machine where I got the superiends.org ads I had TinyWallet, BrowserWarden and BlockAndSurf installed. I removed them with FreeFixer and that stopped the superiends.org pop-ups and all the other ads I was getting in Mozilla Firefox.
It seems as superiends.org is getting quite a lot of traffic, based on Alexa’s traffic rank:
The issue with pop-ups like this one is that it can be initiated by many variants of adware, not just the adware running on my machine. This makes it impossible to say exactly what you need to remove to stop the pop-ups.
To remove the superiends.org pop-up ads you need to review your machine for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:
The first thing I would do to remove the superiends.org pop-ups is to examine the programs installed on the machine, by opening the “Uninstall programs” dialog. You can open this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Do you see something suspicious listed there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if something was installed approximately about the same time as you started seeing the superiends.org pop-ups.
Then I would check the browser add-ons. Adware often show up under the add-ons dialog in Google Chrome, Mozilla Firefox, Internet Explorer, Safari or Opera. Is there something that looks suspicious? Something that you don’t remember installing?
I think you will be able to find and uninstall the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop many years ago. It’s a tool designed to manually identify and remove unwanted software. When you’ve found the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.
FreeFixer’s removal feature is not locked like many other removal tools out there. It won’t require you to pay for the program just when you are about to remove the unwanted files.
And if you’re having troubles determining if a file is legitimate or adware in FreeFixer’s scan report, click on the More Info link for the file. That will open up a web page which contains additional information about the file. On that web page, check out the VirusTotal report which can be quite useful:
An example of FreeFixer’s “More Info” links. Click for full size.
Here’s a video tutorial which shows FreeFixer in action removing adware that caused pop-up ads:
Did this blog post help you to remove the superiends.org pop-up ads? Please let me know how I can improve this blog post.
This page shows how to remove ply.wayreview.com from Mozilla Firefox, Google Chrome and Internet Explorer.
Sound familiar? You see ply.wayreview.com in your web browser’s status bar while browsing sites that generally don’t load any content from third party domains. Maybe the ply.wayreview.com domain show up when performing a search at the Google.com search engine?
Here is how the ply.wayreview.com statusbar message looked like on my computer. It appeared while searching on Google:
Here are some of the status bar messages you may see in your browser’s status bar:
Waiting for ply.wayreview.com…
Transferring data from ply.wayreview.com…
Looking up ply.wayreview.com…
Read ply.wayreview.com
Connected to ply.wayreview.com…
If you also see this on your machine, you presumably have some potentially unwanted program installed on your system that makes the ply.wayreview.com domain appear in your browser. So there’s no use contacting the owner of the site you were browsing. The ply.wayreview.com status bar messages are not coming from them. I’ll do my best to help you with the ply.wayreview.com removal in this blog post.
I found ply.wayreview.com on one of the lab machines where I have some potentially unwanted programs running. I’ve talked about this in some of the previous blog posts. The potentially unwanted programs was installed on purpose, and from time to time I check if anything new has appeared, such as pop-up windows, new tabs in the browsers, injected ads on website that usually don’t show ads, or if some new files have been saved to the hard-drive.
ply.wayreview.com was created on 2014-07-29. ply.wayreview.com resolves to the 50.22.215.24 IP address and wayreview.com to 162.255.119.154. The domain is protected by WhoisGuard INC.
So, how do you remove ply.wayreview.com from your browser? On the machine where ply.wayreview.com showed up in the status bar I had WebWaltz, YTDownloader, SpeedChecker and PriceFountain installed. I removed them with FreeFixer and that stopped the browser from loading data from ply.wayreview.com.
The issue with status bar messages like the one described in this blog post is that it can be caused by many variants of potentially unwanted programs. This makes it impossible to say exactly what you need to remove to stop the status bar messages.
Anyway, here’s my suggestion for the ply.wayreview.com removal:
What software do you have installed if you look in the Add/Remove programs dialog in the Windows Control Panel? Something that you don’t remember installing yourself or that was recently installed?
How about your browser add-ons. Anything in the list that you don’t remember installing?
If that did not help, you can give FreeFixer a try. FreeFixer is built to assist users when manually tracking down potentially unwanted programs. It is a freeware utility that I’ve been working since 2006 and it scans your computer at lots of locations where unwanted software is known to hook into your computer. If you would like to get additional details about a file in FreeFixer’s scan result, you can just click the More Info link for that file and a web page with a VirusTotal report will open up, which can be very useful to determine if the file is safe or malware:
An example of FreeFixer’s “More Info” links. Click for full size.
Did you find any potentially unwanted program on your machine? Did that stop ply.wayreview.com? Please post the name of the potentially unwanted program you uninstalled from your machine in the comment below.
This page shows how to remove apiwebwaltznet-a.akamaihd.net and api.webwaltz.net from Mozilla Firefox, Google Chrome and Internet Explorer.
Did you just see apiwebwaltznet-a.akamaihd.net in the status bar of your browser and ask yourself where it came from? Or did apiwebwaltznet-a.akamaihd.net show up while you search for something on one of the major search engines, such as the Google.com search engine?
Here are some of the status bar messages you may see in your browser’s status bar:
Waiting for apiwebwaltznet-a.akamaihd.net…
Transferring data from apiwebwaltznet-a.akamaihd.net…
Looking up apiwebwaltznet-a.akamaihd.net…
Read apiwebwaltznet-a.akamaihd.net
Connected to apiwebwaltznet-a.akamaihd.net…
Does this sound like your experience, you apparently have some potentially unwanted program installed on your system that makes the apiwebwaltznet-a.akamaihd.net domain appear in your browser. So there’s no use contacting the owner of the site you were browsing. The apiwebwaltznet-a.akamaihd.net status bar messages are not coming from them. I’ll try help you with the apiwebwaltznet-a.akamaihd.net removal in this blog post.
I found apiwebwaltznet-a.akamaihd.net and api.webwaltz.net on one of the lab computers where I have some potentially unwanted programs running. I’ve talked about this in some of the previous blog posts. The potentially unwanted programs was installed on purpose, and from time to time I check if anything new has appeared, such as pop-up windows, new tabs in the browsers, injected ads on web site that usually don’t show ads, or if some new files have been saved to the hard-drive.
apiwebwaltznet-a.akamaihd.net resolves to the 23.62.6.88 address. api.webwaltz.net resolves to 70.186.131.239.
Update 2015-03-19: Noticed a connection to wwwwebwaltznet-a.akamaihd.net too.
So, how do you remove apiwebwaltznet-a.akamaihd.net from your browser? On the machine where apiwebwaltznet-a.akamaihd.net showed up in the status bar I had PriceFountain, SpeedChecker, YTDownloader and WebWaltz installed. I removed them with FreeFixer and that stopped the web browser from loading data from apiwebwaltznet-a.akamaihd.net. Most likely, WebWaltz was responsible for the apiwebwaltznet-a connection.
The problem with status bar messages like this one is that it can be caused by many variants of potentially unwanted programs. This makes it impossible to say exactly what you need to remove to stop the status bar messages.
So, what can be done to solve the problem? To remove apiwebwaltznet-a.akamaihd.net you need to check your machine for potentially unwanted programs and uninstall them. Here’s my suggested removal procedure:
The first thing I would do to remove apiwebwaltznet-a.akamaihd.net is to examine the programs installed on the machine, by opening the “Uninstall programs” dialog. You can find this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Do you see something shady listed there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if some program was installed about the same time as you started observing the apiwebwaltznet-a.akamaihd.net status bar messages.
Then you can examine you browser add-ons. Potentially unwanted program often appear under the add-ons menu in Google Chrome, Mozilla Firefox, Internet Explorer, Safari or Opera. Is there anything that looks suspicious? Something that you don’t remember installing?
I think you will be able to identify and remove the potentially unwanted program with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the potentially unwanted program. FreeFixer is a freeware tool that I started develop about 8 years ago. It’s a tool designed to manually find and remove unwanted software. When you’ve identified the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.
FreeFixer’s removal feature is not crippled like many other removal tools out there. It won’t require you to pay a fee just when you are about to remove the unwanted files.
And if you’re having problems determining if a file is safe or potentially unwanted in FreeFixer’s scan result, click on the More Info link for the file. That will open up a web page which contains more information about the file. On that web page, check out the VirusTotal report which can be very useful:
An example of FreeFixer’s “More Info” links. Click for full size.
Did this blog post help you to remove apiwebwaltznet-a.akamaihd.net? Please let me know or how I can improve this blog post.
Did you just get a pop-up from tracking.ibexnetwork.com and wonder where it came from? Did the tracking.ibexnetwork.com ad appear to have been popped up from a web site that under normal circumstances don’t use aggressive advertising such as pop-up windows? Or did the tracking.ibexnetwork.com pop-up show up while you clicked a link on one of the big search engines, such as Google, Bing or Yahoo?
Here’s how the tracking.ibexnetwork.com pop-up looked like when I got it on my system:
After a while, the pop-up opened the option.fm page where the actual ad was displayed.
Does this sound like what you are seeing, you probably have some adware installed on your computer that pops up the tracking.ibexnetwork.com ads. There’s no use contacting the owners of the site you currently were browsing. The ads are not coming from them. I’ll try help you with the tracking.ibexnetwork.com removal in this blog post.
If you have been reading this blog already know this, but if you are new: A little while back I dedicated a few of my lab machines and deliberately installed a few adware programs on them. Since then I have been tracking the actions on these machines to see what kinds of ads that are displayed. I’m also looking on other interesting things such as if the adware updates itself, or if it downloads additional unwanted software on the computers. I first noticed the tracking.ibexnetwork.com pop-up on one of these lab computers.
tracking.ibexnetwork.com resolves to the 54.173.20.116 IP address and ibexnetwork.com to 50.7.157.124. tracking.ibexnetwork.com was created on 2012-01-16.
So, how do you remove the tracking.ibexnetwork.com pop-up ads? On the machine where I got the tracking.ibexnetwork.com ads I had BlockAndSurf, TinyWallet and BrowserWarden installed. I removed them with FreeFixer and that stopped the tracking.ibexnetwork.com pop-ups and all the other ads I was getting in Mozilla Firefox.
The issue with pop-ups like the one described in this blog post is that it can be initiated by many variants of adware, not just the adware on my machine. This makes it impossible to say exactly what you need to remove to stop the pop-ups.
Anyway, here’s my suggestion for the tracking.ibexnetwork.com ads removal:
The first thing I would do to remove the tracking.ibexnetwork.com pop-ups is to examine the programs installed on the machine, by opening the “Uninstall programs” dialog. You can open this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Do you see something dubious listed there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if something was installed approximately about the same time as you started observing the tracking.ibexnetwork.com pop-ups.
Then you can examine you browser add-ons. Adware often show up under the add-ons menu in Firefox, Chrome, Internet Explorer or Safari. Is there anything that looks suspicious? Anything that you don’t remember installing?
I think you will be able to track down and remove the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I started develop about 8 years ago. It’s a tool built to manually track down and remove unwanted software. When you’ve tracked down the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.
FreeFixer’s removal feature is not locked down like many other removal tools out there. It won’t require you to pay a fee just when you are about to remove the unwanted files.
And if you’re having difficulties figuring out if a file is legit or adware in the FreeFixer scan result, click on the More Info link for the file. That will open up your browser with a page which contains more information about the file. On that web page, check out the VirusTotal report which can be very useful:
An example of FreeFixer’s “More Info” links. Click for full size.
Here’s a video tutorial on how to remove the pop-ups with FreeFixer:
Did this blog post help you to remove the tracking.ibexnetwork.com pop-up ads? Please let me know or how I can improve this blog post.
Welcome! Just a quick post on the Binkilandadware. This appears to be a variant of Vosteran and Taplika that I’ve previously written about. If you got Binkiland installed and running on your computer, you will see lots of Binkiland.exe processes running in the Windows Task Manager, the search provider and start page changed to binkiland.com in Internet Explorer and a custom-built Chrome browser installed on the computer, named Binkiland. I’ll show how to remove Binkiland in this blog post with the FreeFixer removal tool.
Binkiland is bundled with other software. Bundled means that it is included in another software’s installer.
When I run into some new bundled software I usually upload it to VirusTotal to check if the anti-viruses there detect something interesting. 25% of the scanners detected the file. The Binkiland files are detected as Trojan.Generic.12750616 by Ad-Aware, Hacktool.Win32.ADInstaller.d by Baidu-International, Artemis!D946977D16BD by McAfee and Win32/Virus.RiskTool.a62 by Qihoo-360.
All you need to do to remove Binkiland is to check the Binkiland files in the scan result and click the Fix button. You may have to reboot your computer to complete the removal. Here’s a few screenshots that should help you along the way:
Hope this helped you remove the Binkiland adware.
Did you also find Binkiland on your computer? Any idea how it was installed? Please share your story the comments below. Thank you!
Sound familiar? You see pop-up ads from micepopcorn.country while browsing web sites that mostly don’t advertise in pop-up windows. The pop-ups manage to escape the built-in pop-up blockers in Chrome, Firefox, Internet Explorer or Safari. Maybe the micepopcorn.country pop-ups appear when clicking search results from a Google search? Or does the pop-ups appear even when you’re not browsing?
Here’s how the micepopcorn.country pop-up looked like when I got it on my machine:
If this sounds like what you are seeing on your computer, you most likely have some adware installed on your system that pops up the micepopcorn.country ads. There’s no use contacting the owners of the site you were browsing. The ads are not coming from them. I’ll do my best to help you with the micepopcorn.country removal in this blog post.
Those that have been spending some time on this blog already know this, but for new visitors: Not long ago I dedicated a few of my lab computers and intentionally installed some adware programs on them. Since then I’ve been tracking the behaviour on these computers to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware auto-updates, or if it installs additional unwanted software on the machines. I first spotted the micepopcorn.country pop-up on one of these lab computers.
micepopcorn.country was created on 2015-01-07. micepopcorn.country resolves to the 184.73.247.179 IP address and kovzz.super-promo.micepopcorn.country to 104.207.140.57.
So, how do you remove the micepopcorn.country pop-up ads? On the machine where I got the micepopcorn.country ads I had TinyWallet, BlockAndSurf and BrowserWarden installed. I removed them with FreeFixer and that stopped the micepopcorn.country pop-ups and all the other ads I was getting in Mozilla Firefox.
The issue with pop-ups like this one is that it can be launched by many variants of adware, not just the adware on my computer. This makes it impossible to say exactly what you need to remove to stop the pop-ups.
So, what can be done to solve the problem? To remove the micepopcorn.country pop-up ads you need to review your machine for adware or other types of unwanted software and uninstall it. Here’s my suggested removal procedure:
The first thing I would do to remove the micepopcorn.country pop-ups is to examine the software installed on the machine, by opening the “Uninstall programs” dialog. You can open this dialog from the Windows Control Panel. If you are using one of the more recent versions of Windows Operating System you can just type in “uninstall” in the Control Panel’s search field to find that dialog:
Click on the “Uninstall a program” link and the Uninstall programs dialog will open up:
Do you see something dubious in there or something that you don’t remember installing? Tip: Sort on the “Installed On” column to see if something was installed about the same time as you started observing the micepopcorn.country pop-ups.
Then you can examine you browser add-ons. Adware often appear under the add-ons dialog in Chrome, Firefox, Internet Explorer or Safari. Is there anything that looks suspicious? Anything that you don’t remember installing?
I think most users will be able to track down and uninstall the adware with the steps outlined above, but in case that did not work you can try the FreeFixer removal tool to identify and remove the adware. FreeFixer is a freeware tool that I’ve developed since 2006. Freefixer is a tool designed to manually find and uninstall unwanted software. When you’ve found the unwanted files you can simply tick a checkbox and click on the Fix button to remove the unwanted file.
FreeFixer’s removal feature is not locked like many other removal tools out there. It won’t require you to pay for the program just when you are about to remove the unwanted files.
And if you’re having problems figuring out if a file is clean or adware in FreeFixer’s scan report, click on the More Info link for the file. That will open up your web browser with a page which contains more details about the file. On that web page, check out the VirusTotal report which can be quite useful:
An example of FreeFixer’s “More Info” links. Click for full size.
Here’s a video tutorial which shows FreeFixer in action removing adware that caused pop-up ads:
Did this blog post help you to remove the micepopcorn.country pop-up ads? Please let me know or how I can improve this blog post.
