Your computer is infected with malicious software? Do you have pop-ups on your PC?
If so, search this blog for removal instructions or browse computer threats by category.

Tuesday, January 28, 2014

Awesomehp Browser Hijacker Removal Guide

Awesomehp browser hijacker, otherwise known as simply the Awesomehp virus, is actually yet another adware/PUP infection that takes over all web browses as homepage and default search engine provider. Once installed, it will set your homepage and search engine to http://www.awesomehp.com. It will also modify Windows registry and web browser shortcuts so that even resetting your web browser won't help. The goal of this infection is to display ads and spy on your web browser. I am sure you know just how much of a pain it is when you're happily tapping away in Google Chrome searching for something on the internet, or you're perfectly happy with your home page of choice. And then boom - you log on to your computer and suddenly, apparently out of nowhere you have a brand new homepage called Awesomehp, a strange browser or a number of new tool bars cluttering up your screen. If not you're one of the lucky ones. If you do know the feeling, then just like millions of other users you've fallen victim to a PUP/adware infection. Besides, if your browser has been hijacked then there's a good chance that you've installed spyware on your computer as well. In order to permanently remove Awesomehp and related malware from your computer, please follow the steps in the removal guide below.


It's pretty much the same infection as the Nation Zoom browser hijacker. Except that this time, the malicious web browser extension called Extended Protection has even more permissions than the previous variant. Not only it can access your data on all websites and read browsing history but it can also modify your bookmarks detect your physical location and even manage other extensions. In other words, it's a perfect spyware that can download install additional malware on your computer.


Most browser hijackers find their way onto your system when you're downloading another piece of software. More often than not the publishers of the program you DO want are not even aware that their product has been packaged with another program. That's the sneaky publishers of the PUP and adware for you – they know you probably wouldn't download their software under your own volition so they take matters into their own hands by foisting it upon you via other methods.

Browser hijackers are not necessarily dangerous and they're not viruses but the point is, you already have your favorite, home page, search engine, toolbar etc – and you're happy with them, so why would you want to use another – particularly when it's probably an inferior product? You probably don't want Awesomehp, so how do you prevent it happening in the future? It's very important that you pay attention to the license agreements and installation screens when installing anything. Trust me, reading the the license agreements carefully will save you time and headache in the long run. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed and allow you to opt out of them. If you have any questions, please leave a comment below. Good luck and be safe online!

Written by Michael Kaur, http://deletemalware.blogspot.com


Awesomehp removal instructions:

1. First of all, download recommended anti-malware software and run a full system scan. It will detect and remove this infection from your computer. You may then follow the manual removal instructions below to remove the leftover traces of this infection. Hopefully you won't have to do that.







Also, please feel free to call us (toll free) and we'll be happy to help you on the phone.


2. Remove Awesomehp related programs from your computer using the Add/Remove Programs control panel (Windows XP) or Uninstall a program control panel (Windows 7 and Windows 8).

Go to the Start Menu. Select Control PanelAdd/Remove Programs.
If you are using Windows Vista or Windows 7, select Control PanelUninstall a Program.



If you are using Windows 8, simply drag your mouse pointer to the right edge of the screen, select Search from the list and search for "control panel".



Or you can right-click on a bottom left hot corner (formerly known as the Start button) and select Control panel from there.



3. When the Add/Remove Programs or the Uninstall a Program screen is displayed, scroll through the list of currently installed programs and remove the following:
  • WPM17.8.0.3159
  • awesomehp Browser new tab extension
  • IePluginService
  • SupTab


If you are using Windows Vista, Windows 7 or Windows 8, click Uninstall up near the top of that window. When you're done, please close the Control Panel screen.


Remove Awesomehp from Google Chrome:

1. Click on Chrome menu button. Go to ToolsExtensions.



2. Ensure that the Developer mode checkbox in the top right-hand corner is checked. Go to Chrome extensions directory and delete the folder Extended Protection extension is loaded from.



3. Then select Settings. Scroll down the page and click Show advanced settings.


4. Find the Reset browser settings section and click Reset browser settings button.


5. In the dialog that appears, click Reset. Close Chrome.

6. Right-click Google Chrome shortcut you are using to open your web browser and select Properties.

7. Select Shortcut tab and remove "http://www.awesomehp.com...." from the Target field and click OK to save changes. Basically, there should be only the path to Chrome executable file.




Remove Awesomehp from Mozilla Firefox:

1. Open Mozilla Firefox. In the URL address bar, type about:config and hit Enter.



Click I'll be careful, I promise! to continue.



In the search filter at the top, type: awesomehp



Now, you should see all the preferences that were changed by Awesomehp. Right-click on the preference and select Reset to restore default value. Reset all found preferences!



4. Right-click the Mozilla Firefox shortcut you are using to open your web browser and select Properties.

5. Select Shortcut tab and remove "http://www.awesomehp.com...." from the Target field and click OK to save changes. Basically, there should be only the path to Firefox executable file.




Remove Awesomehp from Internet Explorer:

1. Open Internet Explorer. Go to ToolsManage Add-ons.



2. Select Search Providers. First of all, choose Live Search search engine and make it your default web search provider (Set as default).

3. Select Awesomehp and click Remove to remove it. Close the window.



4. Right-click the Internet Explorer shortcut you are using to open your web browser and select Properties.

5. Select Shortcut tab and remove "http://www.awesomehp.com...." from the Target field and click OK to save changes. Basically, there should be only the path to Internet Explorer executable file.



6. Finally, go to ToolsInternet Options and restore your home page to default. That's it!
Read more

Monday, January 27, 2014

Remove myAppStash (Uninstall Guide)

myAppStash is a browser hijacker/PUP that changes your default search engine, homepage, installs toolbar and web browser extensions that can access your data on all websites. It sets your homepage and default search engine to http://myappstash.com which basically returns results from Yahoo search engine. myAppStash toolbar is installed on Firefox and Internet Explorer. The toolbar doesn't work on Chrome. However, myAppStash install a web browser extension that can read and modify your web browser history, access your tabs and even managed other extensions and tabs. In other words, it's spyware. Besides, this browser hijacker or PUP modifies Windows registry so that it can be difficult to restore all the values manually, specially if you are not very tech-savvy person. To remove myAppStash and related malware from your computer, please follow the steps in the removal guide below. Hopefully, it will help you get your computer back on track.

Firefox hijacked by myAppStash browser hijacker:


Potentially unwanted browser extension called New Tab Search. It modifies Chrome homepage and changes default search engine when search from omnibox. Search results are returned via http://search.myappstash.com instead of Google.


If you know anything about browser hijackers or potentially unwanted programs, you'll probably know that they're normally installed as a bundle when they're surreptitiously packaged with a program that you do want to download. myAppStash browser hijacker is distributed in exactly the same way. It doesn't matter how reputable your download is, it can still fall prey to the curse of the PUP. For example both Adobe and Oracle have been known to come bundled with PUPs – something the publishers were no doubt completely unaware of. Even Cnet does that, learn more here.

Chrome hijacked by myAppStash browser hijacker. As you can see, New Tab Search ads another search engine called Search the Web powered by Yahoo.


myAppStash is a browser hijacker but the main part of it is installed as a regular program called MyAppStash Appbar. You'll normally be able to take care of this though your Windows 'change or uninstall' capability – unwanted programs are generally speaking not difficult to get rid of. However, there's more than that. This browser hijacker comes bundled with other potentially unwanted programs. What is more, it makes lots of changes to your web browser and system. A third party program can also take care of the issue. Downloading recommend anti-malware program is also a very good idea. Stick it on your desktop then run a quick scan. Anti-malware program is efficient when it comes to picking up and removing PUPs and browser hijackers that regular antivirus software has missed. If the PUP has created a shortcut on your desktop some antiviruses will consider it a legitimate/wanted program. This is because serious malware doesn't usually announce its presence by installing desktop icons!

Potentially Unwanted Programs are generally not malicious but they can be a pain and let's face it, if you wanted to download something you already would have. Check EULAs and stay vigilant when downloading and beat the PUPs at their own game. Without a doubt, myAppStash should be uninstall from the system as soon as possible. Start with the removal guide below and if you have questions or need help, please leave a comment. Good luck and be safe online!

Written by Michael Kaur, http://deletemalware.blogspot.com


myAppStash removal instructions:

1. First of all, download recommended anti-malware software and run a full system scan. It will detect and remove this infection from your computer. You may then follow the manual removal instructions below to remove the leftover traces of this infection. Hopefully you won't have to do that.





2. Remove myAppStash related programs from your computer using the Add/Remove Programs control panel (Windows XP) or Uninstall a program control panel (Windows 7 and Windows 8).

Go to the Start Menu. Select Control PanelAdd/Remove Programs.
If you are using Windows Vista or Windows 7, select Control PanelUninstall a Program.



If you are using Windows 8, simply drag your mouse pointer to the right edge of the screen, select Search from the list and search for "control panel".



Or you can right-click on a bottom left hot corner (formerly known as the Start button) and select Control panel from there.



3. When the Add/Remove Programs or the Uninstall a Program screen is displayed, scroll through the list of currently installed programs and remove the MyAppStash Appbar program.



If you are using Windows Vista, Windows 7 or Windows 8, click Uninstall up near the top of that window. When you're done, please close the Control Panel screen.


Remove myAppStash from Google Chrome:

1. Click on Chrome menu button. Go to ToolsExtensions.



2. Remove New Tab Search browser extension.

3. Then select Settings. Scroll down the page and click Show advanced settings.


4. Find the Reset browser settings section and click Reset browser settings button.


5. In the dialog that appears, click Reset. Close Chrome.


Remove myAppStash from Mozilla Firefox:

1. Open Mozilla Firefox. In the URL address bar, type about:config and hit Enter.



Click I'll be careful, I promise! to continue.



In the search filter at the top, type: myappstash



Now, you should see all the preferences that were changed by myAppStash. Right-click on the preference and select Reset to restore default value. Reset all found preferences!



That's it!


Remove myAppStash from Internet Explorer:

1. Open Internet Explorer. Go to ToolsManage Add-ons.



2. Select Search Providers. First of all, choose Live Search search engine and make it your default web search provider (Set as default).

3. Select Search the Web and click Remove to remove it. Close the window.



6. Finally, go to ToolsInternet Options and restore your home page to default. That's it!
Read more

Sunday, January 26, 2014

What is PUP.Optional.Babylon.A and how to remove it?

PUP.Optional.Babylon.A is a detection for malware that installs Babylon search and toolbar on infected computers. This browser hijacker is otherwise know and PUP. If you've recently spotted programs on your PC that you have no recollection of installing then you may have been bitten by a PUP. And no, we're not talking about the cute and furry kind; we're talking about PUPs – Potentially Unwanted Programs.

But how does a PUP you have never seen before suddenly appear on your computer – especially if you're the only one using it? PUP.Optional.Babylon.A install itself in a number of ways; sometimes via 'drive-by' installations (when a website you've visited has been infected and passed a PUP on to you) but most commonly when you've downloaded some software that you do want and it has a Babylon PUP bundled in with it.


This PUP might have been sitting on your PC for weeks and you haven't noticed it until now, or it may be glaringly obvious. For example some PUPs even install their own desktop shortcut icons. Now that’s just rude!

The good news is it's pretty easy to check for a PUP. If you're using Windows 7 go to the Control Panel, choose 'Programs' and then 'Uninstall or Change a Program'. Programs that you've installed should be registered with the Windows Add/Remove Programs function and you will see those listed here along with the name of their publisher and the installation date. If you see something you don't recognize you should be able to uninstall it here.

You may have actually been asked if you wanted to install PUP.Optional.Babylon.A but it the question was posed in such a way that you didn't even notice. For example, you're downloading something you do want, a genuine product such as Adobe or Firefox for example, and unknown to these companies a third party may have hidden their own program in the installation as part of a bundle. Simply not checking, or not un-checking, a box in the End User License Agreement may be the cause for your Potentially Unwanted Program. Remember, it's very important to download programs from either official websites or trusted download sites. I'm sure you are aware of fake Flash Player update scams and similar unethical practices that are used to trick users into installing PUPs, adware and spyware. By the way, this is the reason why you should not only uninstall potentially dangerous programs from your computer but also run a full system scan with recommend anti-malware software.

In the other method, the PUP.Optional.Babylon.A may be actually hidden. So, you click on the installation that you do want but unknown to you, you also get a 'bonus' program, such as the annoying Babylon toolbar. The trick here is to make sure you click on the 'Custom' or 'Advanced' installation buttons as these will normally let you then un-check any programs that are being foisted onto you along with your desired software or program download.

Your best bet if you want to avoid the annoyance of Potentially Unwanted Programs is to be careful when downloading software, no matter how reputable. Read End User License Agreements carefully and uncheck any boxes that you're not sure about. When it comes to the battle against the PUPs vigilance is key if you want to avoid the hassle.

Written by Michael Kaur, http://deletemalware.blogspot.com


PUP.Optional.Babylon.A removal instructions:

1. First of all, download anti-malware software and run a full system scan. It will detect and remove this infection from your computer. You may then follow the manual removal instructions below to remove the leftover traces of this malware. Hopefully you won't have to do that.





2. Remove potentially unwanted extensions from your web browser.

Google Chrome:
1. Click on Chrome menu button. Go to ToolsExtensions.
2. Click on the trashcan icon and remove the extensions that might be causing Chitka pop ups. Basically, remove all extensions that you didn't install. It's perfectly OK to remove all extensions since by default Google Chrome comes without any extensions.

Mozilla Firefox:
1. Go to ToolsAdd-ons.
2. Select Extensions. Remove all extensions that you didn't install. Please note, by default Firefox comes without any extensions.

Internet Explorer:
1. Go to ToolsManage Add-ons. If you have the latest version, simply click on the Settings button.
2. Select Toolbars and Extensions. Remove all add-ons that you didn't install or you believe may cause those annoying pop-ups to show up.

3. Download CCleaner and tidy up your computer, remove temp files, etc.

Read more

What is PUP.Optional.CrossRider.A and how to remove it?

If you've ever found PUP.Optional.CrossRider.A on your PC and you're pretty certain you weren't responsible for installing this PUP you will probably be wondering just how on earth it got there and more to the point, how can you remove it?

It can seem like a real mystery: you do something as innocent as updating your browser and suddenly you have programs that you did not consciously download and as far as you were aware you didn't give permission to be installed. So how were these mysterious programs downloaded and how did they install themselves without your say-so? And how do you make sure this doesn't happen in the future?


PUPs usually come bundled in with a download that you did actually want – sneaky! However some PUPs can be installed by 'drive by'downloads – when you've visited an infected website and it's then infected YOU with PUP.Optional.CrossRider.A. For the most part these drive bys are enabled thanks to a weakness in your PCs security. Currently Oracle Java is the most vulnerable, followed by Flash player.

So what do you do if you want to see if you have a Potentially Unwanted Program on your computer? This is a simple process which you can check in the Windows Control Panel. Simply choose 'Programs' and then hit 'Uninstall or Change a Program'. Any program you installed yourself should be registered with the Windows Add/Remove Programs function so here you'll see the names of the programs, their publishers and the date you installed them. If you see something you don't recognize you should be able to uninstall it here. Then, scan your computer with anti-malware software because very often PUPs come bundled with adware and spyware.

You might also want to take it one step further by clicking on the 'Installed On' header in the uninstaller as this allows you to sort the list of programs by date. If one of the programs that you did install intentionally has the same date and time stamp as your unwanted program this is a good indication that it installed your PUP too.

Even if you think you're downloading a reputable program, it is possible that it has been repackaged by another website to include PUP.Optional.CrossRider.A that the original publisher knows nothing about. Bear this in mind and make sure you only download programs from their original websites or from a site that you know to be a trustworthy and reputable one. Also exercise judgment when clicking on search engine links and adverts in Google - there no shortage of unscrupulous people out there that are more than willing to take your money for programs that are supposed to be free and/or abuse them by packaging them with programs that you didn't ask for and probably don't want.

So, in short, the message is clear – be vigilant when you're online and only download programs if you trust them and you trust the site that you are downloading from. PUPs may sound cute but cluttering up your computer with Potentially Unwanted Programs is not!

Written by Michael Kaur, http://deletemalware.blogspot.com


PUP.Optional.CrossRider.A removal instructions:

1. First of all, download anti-malware software and run a full system scan. It will detect and remove this infection from your computer. You may then follow the manual removal instructions below to remove the leftover traces of this malware. Hopefully you won't have to do that.





2. Remove potentially unwanted extensions from your web browser.

Google Chrome:
1. Click on Chrome menu button. Go to ToolsExtensions.
2. Click on the trashcan icon and remove the extensions that might be causing Chitka pop ups. Basically, remove all extensions that you didn't install. It's perfectly OK to remove all extensions since by default Google Chrome comes without any extensions.

Mozilla Firefox:
1. Go to ToolsAdd-ons.
2. Select Extensions. Remove all extensions that you didn't install. Please note, by default Firefox comes without any extensions.

Internet Explorer:
1. Go to ToolsManage Add-ons. If you have the latest version, simply click on the Settings button.
2. Select Toolbars and Extensions. Remove all add-ons that you didn't install or you believe may cause those annoying pop-ups to show up.

3. Download CCleaner and tidy up your computer, remove temp files, etc.

Read more

Friday, January 24, 2014

How to remove Ads by Keep Now (Uninstall Guide)

Ads by Keep Now usually come up on computers infected with adware or PUP. If you are getting ads labeled "Ads by Keep Now" with Ad Options as well then I'm afraid your computer is infected. Just like any other adware or PUP out there, it's commonly bundled with bloatware and free programs that you download off of the Internet (including reputable download websites like Cnet). This adware is rarely distributed using drive-by downloads or hacked websites. Keep in mind that some free downloads do not adequately disclose that other programs will also be installed and you may find that you have installed Keep Now adware without your knowledge. The good news is that, it shouldn't be very difficult to uninstall this adware from your computer. Usually, this can be done without any specialized tools or security programs. On the other hand, there's a good chance that other potentially unwanted programs or even malware came along with it, so scanning your computer with anti-malware program wouldn't hurt. This guide will walk you through removing Ads by Keep Now from your computer and web browsers. If you have any questions, please leave a comment below.


This adware may also turn random words into active links. When you hover over those words, Ads by Keep Now show up. As you can see, this adware is very intrusive and displays misleading ads whether you want them to or not on pretty much every website you visit.

What is more, it can display pop-ups ads on your computer, mostly fake Flash Player updates or Java update notifications.

It's very important that you pay attention to the license agreements and installation screens when installing anything. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed and allow you to opt out of them. Good luck and be safe online!

Written by Michael Kaur, http://deletemalware.blogspot.com


Ads by Keep Now removal instructions:

1. First of all, download anti-malware software and run a full system scan. It will detect and remove this infection from your computer. You may then follow the manual removal instructions below to remove the leftover traces of this malware. Hopefully you won't have to do that.





2. Remove Ads by Keep Now related programs from your computer using the Add/Remove Programs control panel (Windows XP) or Uninstall a program control panel (Windows 7 and Windows 8).

Go to the Start Menu. Select Control PanelAdd/Remove Programs.
If you are using Windows Vista or Windows 7, select Control PanelUninstall a Program.



If you are using Windows 8, simply drag your mouse pointer to the right edge of the screen, select Search from the list and search for "control panel".



Or you can right-click on a bottom left hot corner (formerly known as the Start button) and select Control panel from there.



3. When the Add/Remove Programs or the Uninstall a Program screen is displayed, scroll through the list of currently installed programs and remove the following:
  • Keep Now
  • LyricsSay-1
  • Websteroids
  • ScorpionSaver
  • HD-Plus 3.5
  • and any other recently installed application


Simply select each application and click Remove. If you are using Windows Vista, Windows 7 or Windows 8, click Uninstall up near the top of that window. When you're done, please close the Control Panel screen.


Remove Ads by Keep Now from Google Chrome:

1. Click on Chrome menu button. Go to ToolsExtensions.



2. Click on the trashcan icon to remove Keep Now, LyricsSay-1, Websteroids, HD-Plus 3.5 and other extensions that you do not recognize.




Remove Ads by Keep Now from Mozilla Firefox:

1. Open Mozilla Firefox. Go to ToolsAdd-ons.



2. Select Extensions. Click Remove button to remove Keep Now, LyricsSay-1, Websteroids, HD-Plus 3.5 and other extensions that you do not recognize.




Remove Ads by Keep Now from Internet Explorer:

1. Open Internet Explorer. Go to ToolsManage Add-ons. If you have the latest version, simply click on the Settings button.



2. Select Toolbars and Extensions. Click Remove/Disable button to remove the browser add-ons listed above.

Read more