Ajit Gaddam: TechNews and Security

If you are plagued with the annoying pop-up windows which say “Powered by Zedo”, I wrote an article on root777.com, describing in detail how to remove these Powered by Zedo popups.

These powered by zedo ad popups would usually launch in Internet Explorer or your default browser which might be Firefox  and open up advertisements linking to auctions on Ebay or open up other advertising sites. This spyware also tracks your browser history. So say, you have just been to nfl.com, the spyware would launch a site relating to football.

Click here to go to the article on how to remove powered by zedo popups

Remove url.cpvfeed.com

Url.cpvfeed.com is part of the Adware zedo and is a browser hijacker. Url.cpvfeed.com pop ups are extremely difficult to remove manually and can cause computers to freeze.

Are you seeing this scenario where whenever you start Firefox or Internet Explorer page, you start to see pop ups beginning with url.cpvfeed.com or Powered by Zedo pop ups. Usualy IE7 would show a “page cannot be displayed” but occasionally you are directed to an unknown site. Would they take your search term if you try to do a Google search and display a popup ad showing Ebay or some other site? You are infected by the core.sys Rootkit

I usually consider myself pretty good at removing these nasty spyware and rootkits but this one definitely stumped for a while. The javascript that was producing these popups was part of several ad networks including zero dot com, aavalue dot com and the biggest url.cpvfeed.com

With regard to internet explorer, I started off by trying to add url.cpvfeed.com to my list of blocked sites. Google Toolbar and Firefox were not blocking these popups.

I started off with

a. Downloaded Lavasoft AdAware SE personal. It did its usual scan but did not detect anything that would stop the url.cpvfeed.com popups or remove the core.sys rootkit.

b. I then got Spybot and ran it in safe mode. Again, no detection and the result was a clean system.

c. I tried to run Avenger, but it would not run of Windows Vista

I used other tools including CWShredder, VundoFix and other tools in my spyware disc but nothing could remove this infection. I then moved to online scanners such as Panda ActiveScan and also Kaspersky Online Scanner… nothing. Any removals through these tools, the spyware keeps coming back

Finally, I go get PC Tools Spyware Doctor which is part of Google Pack. You can also including the PC Tools Spyware Doctor. You might want to go ahead and download this as we will be using this for the rest of our disinfection process.

Read the rest of this entry »