How to Remove url.cpvfeed.com popups and core.sys Rootkit
Remove url.cpvfeed.com
Url.cpvfeed.com is part of the Adware zedo and is a browser hijacker. Url.cpvfeed.com pop ups are extremely difficult to remove manually and can cause computers to freeze.
Are you seeing this scenario where whenever you start Firefox or Internet Explorer page, you start to see pop ups beginning with url.cpvfeed.com or Powered by Zedo pop ups. Usualy IE7 would show a “page cannot be displayed” but occasionally you are directed to an unknown site. Would they take your search term if you try to do a Google search and display a popup ad showing Ebay or some other site? You are infected by the core.sys Rootkit
I usually consider myself pretty good at removing these nasty spyware and rootkits but this one definitely stumped for a while. The javascript that was producing these popups was part of several ad networks including zero dot com, aavalue dot com and the biggest url.cpvfeed.com
With regard to internet explorer, I started off by trying to add url.cpvfeed.com to my list of blocked sites. Google Toolbar and Firefox were not blocking these popups.
I started off with
a. Downloaded Lavasoft AdAware SE personal. It did its usual scan but did not detect anything that would stop the url.cpvfeed.com popups or remove the core.sys rootkit.
b. I then got Spybot and ran it in safe mode. Again, no detection and the result was a clean system.
c. I tried to run Avenger, but it would not run of Windows Vista 
I used other tools including CWShredder, VundoFix and other tools in my spyware disc but nothing could remove this infection. I then moved to online scanners such as Panda ActiveScan and also Kaspersky Online Scanner… nothing. Any removals through these tools, the spyware keeps coming back
Finally, I go get PC Tools Spyware Doctor which is part of Google Pack. You can also including the PC Tools Spyware Doctor. You might want to go ahead and download this as we will be using this for the rest of our disinfection process.