This page shows how to remove gnw.cisection.net from Mozilla Firefox, Google Chrome and Internet Explorer.

Does this sound like your story? You see gnw.cisection.net in your browser’s status bar or in the network log while browsing on websites that mostly don’t load any content from third party domains. Maybe the gnw.cisection.net domain appear when performing a search at the Google.com search engine?

Here is a screen capture on gnw.cisection.net from my system when it showed up in the network log when I did a search at Google:

The actual URL is https://gnw.cisection.net/sd/3333/5611.js. When loaded in the browser, the following is returned:

var _rvz=_rvz||{};var _rvz3333x5611=_rvz3333x5611||_rvz;if(!_rvz3333x5611.addonname){_rvz3333x5611.addonname="[Enter Product Name]"}(function(){var a=a||{};a.addonname=_rvz3333x5611.addonname;a.affid=3333;a.subaffid=5611;a.clientuid=_rvz3333x5611.clientuid;a.subID=_rvz3333x5611.publisher_subid;a.arm=_rvz3333x5611.arm||"";var c="addonname="+a.addonname+"&affid="+a.affid;c+="&subaffid="+a.subaffid+"&subID="+a.subID+"&clientuid="+a.clientuid+"&origaffid=3333&origsubaffid=5611&href="+encodeURIComponent(window.location.href)+"&arm="+a.arm;var b=document.createElement("script");b.src=("https:"==document.location.protocol?"https://":"http://")+"lop.guardpair.com/affs?"+c;document.body.appendChild(b)})();

The javascript code mentions the lop.guardpair.com domain. It resolves to 37.58.102.36. The domain is protected by WhoisGuard INC and was registered on 2014-07-29. Later on a connection to lop.guardpair.com was done:

Here’s how lop.guardpair.com appears in the browser’s status bar:

The following are some of the status bar messages you may see in your browser’s status bar related to gnw.cisection.net:

• Waiting for gnw.cisection.net…
• Transferring data from gnw.cisection.net…
• Looking up gnw.cisection.net…
• Read gnw.cisection.net
• Connected to gnw.cisection.net…

If you also see this on your machine, you probably have some adware installed on your machine that makes the cisection.net domain appear in your browser. There’s no use contacting the owners of the website you were browsing. The gnw.cisection.net status bar messages are not coming from them. I’ll do my best to help you remove the gnw.cisection.net message in this blog post. This is done by removing the unwanted adware from your machine.

If you have been following this blog already know this, but if you are new: Not long ago I dedicated some of my lab machines and deliberately installed a few adware programs on them. I’ve been following the behaviour on these machines to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware auto-updates, or if it downloads additional unwanted software on the machines. I first observed the gnw.cisection.net in Mozilla Firefox’s status bar on one of these lab computers.

gnw.cisection.net resolves to 208.43.241.245. gnw.cisection.net was created on 2013-06-26. The domain is protected by Domains By Proxy, LLC.

So, how do you remove cisection.net from your browser? On the machine where gnw.cisection.net showed up in the status bar I had CheckMeUp installed. I removed it with FreeFixer and that stopped the browser from loading data from gnw.cisection.net.

The problem with statusbar messages like this one is that it can be caused by many variants of adware, not just the adware that’s installed on my machine. I think that adware such as SaferSurf, NewPlayer, BlockAndSurf and SpeedCheck can also be responsible for gnw.cisection.net appearing in the browser. And there are probably other variants too. This makes it impossible to say exactly what you need to remove to stop the status bar messages.

Anyway, here’s my suggestion for the gnw.cisection.net removal:

1. Examine what programs you have installed in the Add/Remove programs dialog in the Windows Control Panel. Do you see anything that you don’t remember installing or that was recently installed?
2. You can also review the browser add-ons. Same thing here, do you see something that you don’t remember installing?
3. If that didn’t help, I’d recommend a scan with FreeFixer to manually track down the adware. FreeFixer is a freeware tool that I’m working on that scans your computer at lots of locations, such as browser add-ons, processes, Windows services, recently modified files, etc. If you want to get additional details about a file in the scan result, you can click the More Info link for that file and a web page will open up with a VirusTotal report which will be very useful to determine if the file is safe or malware:

   

Did this blog post help you to remove gnw.cisection.net? Please let me know or how I can improve this blog post.

Thank you!