Tag Archives: 208.43.241.247

Remove nsl.mapticket.net from Firefox, Chrome and Internet Explorer

This page shows how to remove nsl.mapticket.net from Mozilla Firefox, Google Chrome and Internet Explorer.

Does this sound like your story? You see nsl.mapticket.net in your browser’s status bar while browsing sites that usually don’t load any content from third party domains. Maybe the nsl.mapticket.net domain show up when performing a search at the Google search engine?

Here is how the nsl.mapticket.net statusbar message looked like on my machine, when I did a search at the Google search engine:

nsl.mapticket.net status bar

Here are some of the statusbar messages you may see in your browser’s status bar:

  • Waiting for nsl.mapticket.net…
  • Transferring data from nsl.mapticket.net…
  • Looking up nsl.mapticket.net…
  • Read nsl.mapticket.net
  • Connected to nsl.mapticket.net…

Does this sound like your machine, you most likely have some adware installed on your machine that makes the mapticket.net domain appear in your web browser. There’s no use contacting the owners of the site you currently were browsing. The nsl.mapticket.net status bar messages are not coming from them. I’ll do my best to help you remove the nsl.mapticket.net message in this blog post.

I found nsl.mapticket.net on one of the lab systems where I have some adware running. I’ve talked about this in some of the previous blog posts. The adware was installed on purpose, and from time to time I check if anything new has appeared, such as pop-up windows, new tabs in the browsers, injected ads on site that usually don’t show ads, or if some new files have been saved to the hard-drive.

nsl.mapticket.net resolves to 208.43.241.247. nsl.mapticket.net was created on 2013-06-26. The domain is protected by Domains By Proxy, LLC.

According to YouGetSignal’s reverse IP lookup, the following domains has also resolved to the same IP:

  • dso.maptickets.net
  • dss.drivefor.net
  • enl.trepage.net
  • gho.doorknobregorgeasperse.com
  • gin.mapdiv.net
  • gip.driverdiv.net
  • gir.driveropti.net
  • gld.pathticket.net
  • jdt.drivetool.net
  • jgp.makejava.net
  • jgs.prediv.net
  • jsf.jsticket.net
  • lkb.yardarmsweatermothy.com
  • luu.lightquartrate.com
  • nel.dosection.net
  • nll.coupecranklest.com
  • nsl.mapticket.net
  • www.usertube.com
  • yxo.warmportrait.com

So, how do you remove nsl.mapticket.net from your browser? On the machine where nsl.mapticket.net showed up in the status bar I had BlockAndSurf, TinyWallet and BrowserWarden installed. I removed them with FreeFixer and that stopped the web browser from loading data from nsl.mapticket.net.

It seems as nsl.mapticket.net has been getting a lot of traffic, but it has dropped significantly recently, based on Alexa’s traffic rank:

mapticket.net traffic

The problem with status bar messages such as this one is that it can be caused by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the status bar messages.

Anyway, here’s my suggestion for the nsl.mapticket.net removal:

  1. Review what programs you have installed in the Add/Remove programs dialog in the Windows Control Panel. Do you see anything that you don’t remember installing or that was recently installed?
  2. You can also review the browser add-ons. Same thing here, do you see something that you don’t remember installing?
  3. If that didn’t solve the problem, you can give FreeFixer a try. FreeFixer is built to assist users when manually tracking down adware and other types of unwanted software. It is a freeware utility that I’ve been working since 2006 and it scans your system at lots of locations where unwanted software is known to hook into your computer. If you would like to get additional details about a file in FreeFixer’s scan result, you can just click the More Info link for that file and a web page with a VirusTotal report will open up, which can be very useful to determine if the file is safe or malware:

    FreeFixer More Info link example
    An example of FreeFixer’s “More Info” links. Click for full size.

Did you find any adware on your machine? Did that stop nsl.mapticket.net? Please post the name of the adware you uninstalled from your machine in the comment below.

Thank you!

Remove ain.couptwo.com Pop-Up Ads

Does this sound like your story? You see pop-up ads from ain.couptwo.com while browsing websites that typically don’t advertise in pop-up windows. The pop ups manage to escape the built-in pop-up blockers in Google Chrome, Mozilla Firefox, Internet Explorer, Safari or Opera. Maybe the ain.couptwo.com pop-ups show up when clicking search results from Google? Or does the pop-ups appear even when you’re not browsing?

Here’s how the ain.couptwo.com pop-up looked like when I got it on my system:

ain.couptwo.com pop-up

Does this sound like your system, you probably have some adware installed on your computer that pops up the ain.couptwo.com ads. So there’s no idea contacting the owner of the site you were browsing. The advertisements are not coming from them. I’ll do my best to help you with the ain.couptwo.com removal in this blog post.

Those that have been reading this blog already know this, but for new visitors: Not long ago I dedicated some of my lab machines and wilfully installed a few adware programs on them. Since then I have been tracking the behaviour on these systems to see what kinds of advertisements that are displayed. I’m also looking on other interesting things such as if the adware auto-updates, or if it downloads and installs additional unwanted software on the computers. I first noticed the ain.couptwo.com pop-up on one of these lab machines.

ain.couptwo.com resolves to 208.43.241.247. ain.couptwo.com was created on 2014-09-18.

So, how do you remove the ain.couptwo.com pop-up ads? On the machine where I got the ain.couptwo.com ads I had TinyWallet, BrowserWarden and BlockAndSurf installed. I removed them with FreeFixer and that stopped the ain.couptwo.com pop-ups and all the other ads I was getting in Firefox.

BlockAndSurf was the adware that caused the pop-ups in my case.

The problem with this type of pop up is that it can be popped up by many variants of adware. This makes it impossible to say exactly what you need to remove to stop the pop-ups.

Anyway, here’s my suggestion for the ain.couptwo.com ads removal:

  1. What software do you have installed if you look in the Add/Remove programs dialog in the Windows Control Panel? Something that you don’t remember installing yourself or that was recently installed?
  2. You can also review the add-ons you installed in your browsers. Same thing here, do you see anything that you don’t remember installing?
  3. If that didn’t solve the problem, you can give FreeFixer a try. FreeFixer is built to assist users when manually tracking down adware and other types of unwanted software. It is a freeware utility that I’ve been working since 2006 and it scans your system at lots of locations where unwanted software is known to hook into your computer. If you would like to get additional details about a file in FreeFixer’s scan result, you can just click the More Info link for that file and a web page with a VirusTotal report will open up, which can be very useful to determine if the file is safe or malware:

    FreeFixer More Info link example
    An example of FreeFixer’s “More Info” links. Click for full size.

Here you can see FreeFixer in action removing the adware that caused the ain.couptwo.com pop-up ads:

Are you a Mac or Linux user and get the ain.couptwo.com popups? What did you do to stop the pop-up in your browser? Please share in the comments below. Thank you very much!

Did you find any adware on your machine? Did that stop the ain.couptwo.com ads? Please post the name of the adware you uninstalled from your machine in the comment below.

Thank you!

Update 2014-12-18: I’ve been documenting this type of pop-ups. I’m calling them “Coup Pop-Ups“, since they often use “Coup” in the domain name. For example, couptwo.com and coupthree.com. But what about one, four, five, six, etc? I think the following domains are registered by the same company, and that we might see them in pop-ups in the future:

  • CoupFive.com
  • CoupSix.com