Tag Archives: CrossRider

Remove Hold Page and the Hold Page Ads

Hello readers. Another day, another blog post. Did something called Hold Page appear on your system? This is a variant of CrossRider that I’ve written about many times before. If you have Hold Page installed on your machine, you will see new add-ons installed in Mozilla Firefox and Internet Explorer. Nothing was installed in Google Chrome. I’ll show how to remove Hold Page in this blog post with the FreeFixer removal tool.

Hold Page 1.0.1 firefox

Hold Page is bundled with other software. Bundled means that it is included in another software’s installer. Generally, you can avoid bundled software such as Hold Page by being careful when installing software and declining the bundled offers in the installer and making sure that you have downloaded the software from the official site and not from some third party.

When I find some new bundled software I normally upload it to VirusTotal to verify if the anti-virus progams there detect something suspicious. 11 of the 55 scanners detected the file. The Hold Page files are detected as BrowseFox.F by AVG, Trojan.BPlug.215 by DrWeb and PUP.Optional.HoldPage.A by Malwarebytes.

Hold Page virustotal

If you would like to remove HoldPage you can do so with the FreeFixer removal tool. Here’s a few screengrabs from the removal that should help you: You may have to restart your computer to complete the removal.

remove Hold Page firefox remove Hold Page Internet Explorer

Hope this helped you solved the HoldPage problem.

I stumbled upon Hold Page while testing out some downloads that are known to bundled lots of unwanted software. Any idea how Hold Page was installed on your machine? Please share your story the comments below. Thank you very much!

Thanks for reading. Welcome back!

Remove HQ-Video-Pro-2.1cV02.11 Ads

Hello readers. Hope you are doing ok. Did you just spot something called HQ-Video-Pro-2.1cV02.11 on your system? HQ-Video-Pro-2.1cV02.11 appears to be a variant of CrossRider that I’ve written about before. If the HQ-Video-Pro-2.1cV02.11 adware is installed on your machine, you will notice ads labeled Visual Search Results and Powered by HQ-Video-Pro-2.1cV02.11 in Google’s search results. I’ll show how to remove HQ-Video-Pro-2.1cV02.11 in this blog post with the FreeFixer removal tool.

powered by HQ-Video-Pro-2.1cV02.11

Here it is in Firefox’ add-on menu:

HQ-Video-Pro-2.1cV02.11 firefox add-on

HQ-Video-Pro-2.1cV02.11 is distributed by a tactic called bundling. Bundling means that a piece of software is included in other software’s installers. When I first found HQ-Video-Pro-2.1cV02.11, it was bundled with a piece of software called FastPlayer.

Generally, you can avoid bundled software such as HQ-Video-Pro-2.1cV02.11 by being careful when installing software and declining the bundled offers in the installer.

When I find some new bundled software I always upload it to VirusTotal to verify if the anti-malware software there detect anything suspicious. The detection rate is 7/54. Some of the detection names for HQ-Video-Pro-2.1cV02.11 are Trojan.NSIS.GoogUpdate.dt, PUP.Optional.HQVideo.A and Crossrider (fs). The files are signed by “Radon Battery Technologies“.

hq-video-pro-virustotal

Removing HQ-Video-Pro-2.1cV02.11 is pretty easy with FreeFixer. The screen capture that should help you along the way: You might have to restart your machine to complete the removal. HQ-Video-Pro-2.1cV02.11 remove

Hope that helped you to figure out how to do the removal.

Any idea how HQ-Video-Pro-2.1cV02.11 was installed on your computer? Please let me and the readers know by posting a comments. Thanks!

Hope you found this useful and thanks you for reading.

Update 2014-11-04: Today another variant was released called HQ-Video-Pro-2.1cV03.11. I guess we will see more variants where just the version number is increased:

  • HQ-Video-Pro-2.1cV04.11 (Yeah, found 5th Nov 2014)
  • HQ-Video-Pro-2.1cV05.11 (Found on the 6th of November)
  • HQ-Video-Pro-2.1cV06.11
  • HQ-Video-Pro-2.1cV07.11 (Found 13th of November)
  • HQ-Video-Pro-2.1cV08.11
  • HQ-Video-Pro-2.1cV09.11
  • HQ-Video-Pro-2.1cV10.11 (Found 13th of November)
  • HQ-Video-Pro-2.1cV11.11
  • HQ-Video-Pro-2.1cV12.11
  • HQ-Video-Pro-2.1cV13.11
  • HQ-Video-Pro-2.1cV14.11 (Found 15th of Nov)
  • HQ-Video-Pro-2.1cV15.11 (Found 16th of Nov)
  • HQ-Video-Pro-2.1cV16.11 (Found 16th Nov)
  • HQ-Video-Pro-2.1cV17.11 (Found 17th Nov)
  • HQ-Video-Pro-2.1cV18.11 (Found 19th Nov)
  • HQ-Video-Pro-2.1cV19.11 (Found 20th Nov)
  • HQ-Video-Pro-2.1cV20.11
  • HQ-Video-Pro-2.1cV21.11
  • HQ-Video-Pro-2.1cV22.11
  • HQ-Video-Pro-2.1cV23.11 (Found 23 Nov)
  • HQ-Video-Pro-2.1cV24.11 (Found 24 Nov)
  • HQ-Video-Pro-2.1cV25.11
  • HQ-Video-Pro-2.1cV26.11
  • HQ-Video-Pro-2.1cV27.11
  • HQ-Video-Pro-2.1cV28.11 (Found 28 Nov)
  • HQ-Video-Pro-2.1cV29.11
  • HQ-Video-Pro-2.1cV30.11

Update 2014-11-13: Now the files are signed by Space Battleship Creative. They seems to be located in Nicosia, Cyprus.

Space Battleship Creative

 

Update 2014-11-19: Now the files are signed by Winston Project:

Winston Project

 

Update 2014-12-02: New naming convention:

  • HQ-Video-Pro-2.1cV01.12
  • HQ-Video-Pro-2.1cV02.12
  • HQ-Video-Pro-2.1cV03.12
  • HQ-Video-Pro-2.1cV04.12
  • HQ-Video-Pro-2.1cV05.12
  • HQ-Video-Pro-2.1cV06.12
  • HQ-Video-Pro-2.1cV07.12
  • HQ-Video-Pro-2.1cV08.12
  • HQ-Video-Pro-2.1cV09.12
  • (Found 9 Dec 2014)

  • HQ-Video-Pro-2.1cV10.12
  • HQ-Video-Pro-2.1cV11.12
  • HQ-Video-Pro-2.1cV12.12
  • HQ-Video-Pro-2.1cV13.12
  • HQ-Video-Pro-2.1cV14.12
  • HQ-Video-Pro-2.1cV15.12
  • HQ-Video-Pro-2.1cV16.12
  • HQ-Video-Pro-2.1cV17.12
  • HQ-Video-Pro-2.1cV18.12
  • HQ-Video-Pro-2.1cV19.12
  • HQ-Video-Pro-2.1cV20.12
  • HQ-Video-Pro-2.1cV21.12
  • HQ-Video-Pro-2.1cV22.12
  • HQ-Video-Pro-2.1cV23.12
  • HQ-Video-Pro-2.1cV24.12
  • HQ-Video-Pro-2.1cV25.12
  • HQ-Video-Pro-2.1cV26.12
  • HQ-Video-Pro-2.1cV27.12

Remove videosMediaPlayersversion2.1 and videosMediaPlayersv2.2 Ads

Hello guys and gals. I just found another bundled adware named videosMediaPlayersversion2.1 and videosMediaPlayersv2.2 and thought I should give you some removal instructions. videosMediaPlayersversion2.1 and videosMediaPlayersv2.2 seems to be a variant of CrossRider that I wrote about previously. If the videosMediaPlayersversion2.1 and videosMediaPlayerv2.2 adware is running on your machine, you will find new add-ons called videosMediaPlayers installed in Firefox and Internet Explorer. I’ll show how to remove videosMediaPlayersversion2.1 and videosMediaPlayersv2.2 in this blog post with the FreeFixer removal tool in case the removal from the Control Panel fails.videosmediaplayers uninstall

videosMediaPlayersversion2.1 and videosMediaPlayerv2.2 is distributed by a tactic called bundling. Bundling means that a piece of software is included in other software’s installers. I found these two programs bundled with a download called FastPlayer.

Following the standard procedure when I test some new bundled software I uploaded it to VirusTotal to check if the anti-virus progams there find anything suspicious. 13% of the scanners detected the file. Kaspersky names videosMediaPlayersversion2.1 and videosMediaPlayervs2.2 as Trojan.NSIS.GoogUpdate.dp, Malwarebytes reports PUP.Optional.VideosMediaPlayer.A and VIPRE detects it as Crossrider (fs). The file was digitally signed by Railroad Party Apps.

videosMediaPlayers virustotal

 

According to the certificate, Railroad Party Apps is located in the city of Nicosia on Cyprus.

Railroad Party Apps certificate

Removing videosMediaPlayersversion2.1 and videosMediaPlayerv2.2 is pretty easy with FreeFixer. Here’s a few screen dumps from the removal that should help you. All files are located under the “videosMediaPlayers..” folder. You may have to restart your machine to complete the removal.

videosmediaplayerv2.2 remove

Hope that helped you to figure out how to do the removal.

Did you also find videosMediaPlayersversion2.1 and videosMediaPlayerv2.2 on your system? Any idea how it installed? Please share your story the comments below. Thanks!

Hope you found this useful and thanks you for reading.

Remove “Powered by HQ-Video-Pro-2.1cV26.10” Ads in Google Search results

Hello readers. Welcome to the blog. Did something called HQ-Video-Pro-2.1cV26.10 appear on your computer? HQ-Video-Pro-2.1cV26.10 seems to be a variant of CrossRider that I’ve talked about previously. If the HQ-Video-Pro-2.1cV26.10 Adware is installed on your computer, you will find ads labeled powered by HQ-Video-Pro-2.1cV26.10 in Google’s search results. I’ll show how to remove HQ-Video-Pro-2.1cV26.10 in this blog post with the FreeFixer removal tool.

powered by hq-video-pro-2.1

Here’s HQ-Video-Pro-2.1cV26.10 in Firefox’ add-on menu:

hq-video-pro-2.1v26 in mozilla firefox

HQ-Video-Pro-2.1cV26.10 is bundled with other software. Bundled means that it is included in another software’s installer.

You can remove HQ-Video-Pro-2.1cV26.10 with the FreeFixer removal tool. Just select the HQ-Video-Pro-2.1cV26.10 files as shown in the screen dumps below. You may have to restart your computer to complete the removal.

How to remove the hq-video-pro-2.1v26.10 tasks Removal of HQ-video-pro-2.1cv26 from Firefox How to remove hq video pro 2.1 in Internet Explorer

Hope this helped you solved the HQ-Video-Pro-2.1cV26.10 problem.

I stumbled upon HQ-Video-Pro-2.1cV26.10 while testing out some downloads that are known to bundled lots of unwanted software. Any idea how HQ-Video-Pro-2.1cV26.10 was installed on your machine? Please share by posting a comment. Thank you!

Thank you for reading.

Remove HQ-Video-Pro-2.1cV22.10 Ads

Hello there and welcome to the FreeFixer blog. Did something called HQ-Video-Pro-2.1cV22.10 appear on your machine? HQ-Video-Pro-2.1cV22.10 seems to be a variant of CrossRider that I’ve written about before. If you have HQ-Video-Pro-2.1cV22.10 on your machine, you will find ads labeled powered by HQ-Video-Pro-2.1cV22.10 in Google search results. You will also see new add-ons installed in Internet Explorer and Mozilla Firefox. I’ll show how to remove HQ-Video-Pro-2.1c in this blog post with the FreeFixer removal tool.powered by hq-video-pro-2.1

HQ-Video-Pro-2.1 firefox

HQ-Video-Pro-2.1cV22.10 internet explorer

HQ-Video-Pro-2.1c is bundled with a number of downloads. Bundling means that software is included in other software’s installers. When I first found HQ-Video-Pro-2.1cV22.10, it was bundled with a download called FlvPlayer. Generally, you can avoid bundled software such as HQ-Video-Pro-2.1c by being careful when installing software and declining the bundled offers in the installer.

As usual when I play around with some new bundled software I uploaded it to VirusTotal to test if the anti-malware software there find something. The detection rate is 4/54 which I’d say is pretty low. Some of the detection names for HQ-Video-Pro-2.1cV22.10 are a variant of Win64/Toolbar.Crossrider.L, PUP.Optional.HQVideo.A and Crossrider (fs). The file is signed by “Radon Battery Technologies“.

HQ-Video-Pro-2.1cV22.10 virustotal

The HQ-Video-Pro-2.1cV22.10 removal with FreeFixer is pretty straightforward. Check all the HQ-Video-Pro-2.1cV22.10 files/settings for removal and click fix. Here’s a few screenshots from the removal that should help you:

HQ-Video-Pro-2.1cV22.10 internet explorer remove HQ-Video-Pro-2.1cV22.10 firefox remove

Hope this helped you remove the HQ-Video-Pro-2.1cV22.10 Adware.

Any idea how you got HQ-Video-Pro-2.1cV22.10 on your computer? Please share in the comments below. Thanks a bunch!

Hope you found this useful. Thanks for reading.

Update 2014-10-24: Found another variant called HQ-Video-Pro-2.1cV23.10.

Update 2014-10-25: Another variant: HQ-Video-Pro-2.1cV24.10.

Seems like the version number is updated every day. So I’ll assume we will see the following variants shortly:

  • HQ-Video-Pro-2.1cV25.10
  • HQ-Video-Pro-2.1cV26.10
  • HQ-Video-Pro-2.1cV27.10
  • HQ-Video-Pro-2.1cV28.10
  • HQ-Video-Pro-2.1cV29.10
  • HQ-Video-Pro-2.1cV30.10

Browsers+Apps+1.1 – Ads by Browsers+Apps+1.1 Removal Instructions

Just wanted to put up a short post before going back to programming on FreeFixer. Today I wanted to talk about an adware named Browsers+Apps+1.1 and give you some removal instructions. Browsers+Apps+1.1 seems to be a variant of CrossRider that I’ve blogged about before. If the Browsers+Apps+1.1 adware is running on your machine, you will see ads tagged Ad by Browsers+Apps+1.1 or Ads by Browsers+Apps+1.1 injected into web pages while you browse and new add-ons in Firefox and Internet Explorer. I’ll show how to remove Browsers+Apps+1.1 in this blog post with the FreeFixer removal tool.

ad by browsers+apps+1.1 Ads by Browsers+Apps+1.1

browsers+apps+1.1 firefox

Browsers+Apps+1.1 is distributed by a strategy called bundling. Bundling means that a piece of software is included in other software’s installers.

As always when I find some new bundled software I uploaded it to VirusTotal to check if the anti-virus software there find something suspicious. 16% of the antimalware scanners detected the file. Malwarebytes classifies Browsers+Apps+1.1 as PUP.Optional.BrowsersApp.A, McAfee detects it as CrossRider-FRV and VIPRE detects it as Crossrider (fs).

You probably came here looking for removal instructions for Browsers+Apps+1.1 and you can do so with the FreeFixer removal tool. Just select the Browsers+Apps+1.1 files as the screenshots below shows. A restart of your machine may be required to complete the removal.

Remove browsers+apps+1.1 in Internet Explorer Remove browsers+apps+1.1 scheduled tasks

Hope that helped you with the removal.

I stumbled upon Browsers+Apps+1.1 while testing out some downloads that are known to bundled lots of unwanted software. Any idea how you got Browsers+Apps+1.1 on your computer? Please let me and the readers know by posting a comments. Thanks!

Hope you found this useful. Thanks for reading.

How To Remove BrowsersApp_Pro_v1.1

Hello there and welcome to the FreeFixer blog. Just a quick post on the BrowsersApp_Pro_v1.1 adware. This appears to be a variant of CrossRider that I’ve previously written about. If the BrowsersApp_Pro_v1.1 adware is installed on your computer, you will find ads labeled Ad by BrowsersApp_Pro_v1.1 while browsing the web, new add-ons added in your web browsers and new files, digitally signed by Numlock Apps, on the hard-drive. I’ll show how to remove BrowsersApp_Pro_v1.1 in this blog post with the FreeFixer removal tool.

BrowsersApp_Pro_v1.1 0.95.11 firefox add-on

BrowsersApp_Pro_v1.1 ads inserted into web page ad by BrowsersApp_Pro_v1.1 pop-up

BrowsersApp_Pro_v1.1 is bundled with other software. Bundled means that it is included in another software’s installer.

Generally, you can avoid bundled software such as BrowsersApp_Pro_v1.1 by being careful when installing software and declining the bundled offers in the installer.

When I play around with some new bundled software I always upload it to VirusTotal to check if the anti-malware scanners there find anything suspicious. 6 of the 54 scanners detected the file. The BrowsersApp_Pro_v1.1 files are detected as PUP/Win32.CrossRider by AhnLab-V3, PUP.Optional.BrowserApp.A by Malwarebytes and Crossrider (fs) by VIPRE.

BrowsersApp_Pro_v1.1-bho.dll virustotal. File signed by Numlock Apps

Since you probably want to remove BrowsersApp_Pro_v1.1, these are the files you should check for removal if you want to remove it with FreeFixer. A restart of your computer might be required to complete the removal.

BrowsersApp_Pro_v1.1 tasks removal in FreeFixer BrowsersApp_Pro_v1.1 firefox extension removal BrowsersApp_Pro_v1.1 bhos removal

Hope this helped you remove the BrowsersApp_Pro_v1.1 adware.

Did you also find BrowsersApp_Pro_v1.1 on your computer? Any idea how it was installed? Please let me and the readers know by posting a comments. Thank you!

Thanks for reading. Welcome back!

Update 2014-11-05: The BrowsersApp_Pro_v1.1 adware is still distributed through bundling. The files are now signed by Railroad Party Apps as you can see in the screenshot below. The Railroad Party Apps company appears to be located in Nicosia, Cyprus.Railroad Party Apps

 

“Ads by Sense” – Sense Adware Removal Instructions

Hello readers. Another day, another blog post. As usual I was looking around on the Internet to see what is being bundled with some software downloads. This time I found something called Sense. This appears to be a variant of CrossRider that I’ve previously written about.

If the Sense adware is installed on your computer, you will find banners labeled “Ads by Sense“, “Ad by Sense1“, green links added to web pages, saying “Click to Continue -> by Sense“, new add-ons added into Internet Explorer and Firefox and new processes running in the Task Manager. You’ll also see some files on your hard-drive that are digitally signed by Krance Development. I’ll show how to remove Sense in this blog post with the FreeFixer removal tool.

Ad by Sense1

ads by sense on google search results Ads by Sense on Google's main page Click to Continue by Sense

Sense is bundled with other software. Bundled means that it is included in another software’s installer. When I first found Sense, it was bundled with a piece of software called Free Download Manager.

As usual when I find some new bundled software I uploaded it to VirusTotal to test if the anti-viruses there find anything suspicious. CrossRider seems to be the common detection name.

sense virustotal report

The file is digitally signed by a company called Krance Development.

Removing Sense is straightforward with FreeFixer. Just select the Sense files for removal and then click the Fix button and the problem will be solved.

sense firefox extension freefixer sense adware tasks sense add-on in internet explorer

Hope that helped you with the removal.

Any idea how Sense was installed on your system? Please let me and the readers know by posting a comments. Thanks!

Thank you for reading.

Update 5 November 2014: The Sense adware is still being distributed. Now the files are signed by Porter Studio Plus as you can see in the screenshot from the Digital Signatures tab for the Sense-bg.exe file. According to the information in the certificate, Porter Studio Plus is located in Nicosia, Cyprus.

Porter Studio Plus digital signature

Update 7 Nov 2014: Now the files are signed by Sara Kodama Project. They seem to change the certificate quite often.

Sara Kodama Project

 

Update 2014-11-19: Now the files are signed by Tita-­nium Great Minds. They are located in Nicosia, Cyprus.

 

Tita-­nium Great Minds

How To Remove JollyWallet

Hello there and welcome to the FreeFixer blog. Today I wanted to talk about an adware named JollyWallet and thought I should give you some removal instructions. JollyWallet appears to be a variant of CrossRider that I’ve written about before. If the JollyWallet adware is installed and running on your machine, you will see JollyWallet ads added in the top area of your web browsers and a new add-on installed into Mozilla FireFox and Internet Explorer. I’ll show how to remove JollyWallet in this blog post with the FreeFixer removal tool.

JollyWallet Internet Explorer Add-on signed by Radyoos Media Ltd. jollywallet firefox add-on - known to cause security or stability issues

The JollyWallet adware has been around for some time. I think I first spotted it in the spring of 2014, then it disappeared from the radar for some time, but now it appears to be distributed again.

So, how did JollyWallet install on your machine? It was probably bundled with some download that you installed recently. Bundling means that software is included in other software’s installers. When I found JollyWallet, it was bundled with a download claiming to be an episode of the Game of Thrones TV-series. The screenshot below shows how the download informed the user that JollyWallet was bundled.

JollyWallet disclosure in the bundling installer

When I run into some new bundled software I usually upload it to VirusTotal to check if the anti-viruses there detect anything. The JollyWallet file was detected by 10 of the anti-virus scanners.

JollyWallet Virus Total report - CrossRider

Removing JollyWallet is pretty with FreeFixer. Just check the JollyWallet files as the screenshots below shows. A restart of your machine may be required to complete the removal. Problem taken care of 😉

jollywallet scheduled tasks jollywallet firefox freefixer jollywallet bho ie

Hope this helped you remove the JollyWallet adware.

Any idea how JollyWallet was installed on your machine? Please share in the comments below. Thank you!

Thanks for reading!