I would like to start talking about advertising with a modified phrase from the classic Belinsky: “Don’t you love advertising, just as I DO NOT love it, with all the strength of your soul?” Indeed, it is difficult to imagine a person who would be happy or neutral about the dominance of "tempting offers" on the screen of his computer. However, no one asks our opinion on this issue: if you managed to pick up an advertising "virus", if you please, "enjoy".
No, we will not enjoy ugliness. Today I will tell you how to remove ads in browsers when no antivirus helps, and how to prevent their reappearance.
Where do the "ears" of the problem grow from?
If you remember, a couple of years ago, infections with advertising "viruses" were not as frequent as they are today. And the reason is this:
- Promotion of goods and services through the media no longer gives the return that advertisers need. People have adapted to skip advertising "past the eyes and ears." Or turn off.
- Rapid growth of Internet audience. Former viewers today prefer to learn the news, watch movies and programs not on TV, but through the network.
- Tightening the requirements of the law for advertising materials that are distributed through the media and other controlled sources. And on the Internet, as you know, there is no censorship.
- The widespread use of ad blockers - the so-called "advertising cutters" such as AdBlock.
All this, and especially the last one, contributes to the fact that advertising in browsers is becoming larger, more intrusive and more aggressive. Entire companies of developers are working on its creation. Their task is not only to make the viewer see the banner (video, ad, etc.), but also to make it as difficult as possible to stop the display. Ideally, it's impossible.
Why Antiviruses Don't Help
The task of antiviruses is to protect the computer from programs that can cause obvious harm to the system or the user - to steal, damage information, etc. Adware ("advar") - adware, in fact, does nothing of the kind - it only collects information about the user's interests and shows him banners. And this is not prohibited by law. In addition, there are many free apps and websites sponsored by advertisers. If antiviruses started to “hack” them, they would simply be gone.
However, advari developers sometimes go beyond what is permitted - they endow their products with the ability to disguise themselves and prevent removal. And sometimes - to collect obviously unnecessary information about the user. Such software is no longer pure adware, antivirus vendors classify it as spyware (spyware) or trojans. And they add it to the virus databases.
And how to deal with it?
What does the user do when he sees an ad in the browser that obviously does not belong to a particular site, but appears on its own? Starts the antivirus. But he doesn't find anything. Downloads another - and history repeats itself. Why this happens, I hope, is clear.
Since advar and other potentially unwanted software use different methods of installation into the system, it is best to follow the instructions that I will give below.
Remove unnecessary browser extensions and change the start page
Installation in the form of extensions and applications of web browsers is a favorite way of settling "advari" in the system. But also the easiest to remove.
Let's go through the menu of the infected web browser to the extensions section.
And we will delete everything that appeared there without our knowledge.
and check if some “left” site has been set as the start page. If yes, delete the entry.
Next, restart it and check if the issue is resolved. If not, let's move on.
Removing malware through Programs and Features
Adware created by honest developers is installed into the system like normal applications. And just like them, it is removed through " Programs and Features". Let's open it and see if something appeared there without our participation. If it appears, delete it.
After that, restart the computer and check again if the problem is solved.
Clean up web browser shortcuts
The third favorite location for adware programs is the desktop shortcut that the user uses to launch the web browser. To clear it of unnecessary entries, do the following:
- Open the context menu of the problem shortcut and select properties.
- In the properties window, go to the " Label" and see what is indicated in the field " An object". Normally, the path to the browser executable file should be written there and nothing else. For example, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe. Postscript in the form " http://site' or replacing the executable with something else like ' chrome.lnk», « chrome.bat», « googlechrome.exe", etc. - and there is a source of the problem. If you see something similar, correct the post.
If changing the settings of the shortcut is blocked (this is done to protect the malware from being removed), try the following:
- Delete desktop shortcut to trash and create a new one. To do this, open the folder with the application, right-click on the executable file and select " Create Shortcut". Put it on your desktop instead of the old one.
- If the shortcut is not deleted (you do not have permission to do so), open the " Security and make yourself the owner. To do this, click the " Additionally" and in the next window next to the owner's name, click " Change».
Enter in the field " Selectable object names» yourself, click « Check names and OK.
In the window " Extra options» also press OK. After that, the cleaning and deleting functions will become available to you.
After manipulating the shortcut, eliminate all malicious files that were registered in it.
Reinstalling the browser
Reinstallation will be a radical solution when banners are displayed only in one of the web browsers. The reason may be a malicious script that has wormed its way into the bowels of the program, or file patching (adding virus code to the "body" of the file, for example, one of the browser's dynamic libraries).
In order not to lose bookmarks, settings and history, sync them across browsers on different devices.
Or import from an infected web browser to a clean one.
If ads are displayed on all devices connected to the same network
In this case, another infection mechanism is implemented - reconfiguring the network settings of a PC or router. More precisely, changing the provider's DNS server - the host that maps the domain names of sites to their IP addresses. After the DNS change, instead of the requested site, another or the same one opens, but with an advertising appendage.
The DNS change operation is performed by a Trojan program of the DNSChanger class. After doing a dark deed, it is removed from the computer. Here is another reason why antiviruses do not help - the setting remains, but the culprit is gone.
To check if this is your case, go to the network connections folder. In Windows 8-10, it is convenient to do this through the Start context menu, in Windows 7 - through the Network and Sharing Center. Open the properties of the network you are connected to. On the tab " Network» in the list of components, click « IP version 4' and the button ' Properties».
DNS addresses are listed in the bottom half of the next window. If they do not belong to your provider and are not public (like mine), you need to fix them. As you guessed, on provider or public.
If you use a router, the same procedure must be done on it. Where is the desired parameter, find out from the instructions.
Adware removal programs
The search for adware modules and their traces is based on "virus" databases and heuristic analysis, with the help of which the program determines the harmfulness of the scanned objects. Heuristic check allows you to find unknown threats (unlike databases that detect only known ones), but it gives a significantly high percentage of errors, so you cannot fully rely on it. Otherwise, completely harmless and even necessary files of the operating system and programs can go under the knife.
Attention! Before running any of the described applications, . It will help restore the system to working capacity if any important object is deleted by mistake.
AdwCleaner
cleans adware and spyware files, their services, folders, browser add-ons (panels and extensions), shortcuts, registry entries and scheduled tasks from the computer. It works based on bases, which makes it relatively safe in terms of false positives. But it never hurts to double-check what you're about to delete.
With AdwCleaner running as an administrator, click " Scan". The check will take a few minutes, after which the result will be displayed on the tabs of the main window.
All found objects will be marked with flags. If you want to keep something, uncheck it. To start the cleaning process, click the button of the same name. When finished, restart your computer.
Malwarebytes Anti-Malware
- a powerful program to combat viruses, trojans, rootkits, spyware and potentially unwanted software, as well as their traces in the system. It has a paranoid heuristic, so the percentage of false positives is quite high. Deleting everything found is not safe! Be sure to check through the search engines what each suspicious file and each registry entry is.
For a one-time treatment, Malwarebytes Anti-Malware can be used for free. For permanent protection - only for a fee.
The free version has 2 verification modes - selective and full. To remove adware, it is enough to scan startup objects and memory.
After scanning, a list of potential threats will be displayed in the window. Uncheck the boxes next to the ones you want to keep, and eliminate the rest.
Junkware Removal Tool
Junkware Removal Tool is another Malwarebytes product tailored for the most common unwanted software. Before removing threats, it does not display any prompts to the user, it works automatically. Creates a backup copy of the registry before cleaning starts.
In terms of false detections, the Junkware Removal Tool is relatively safe because it only uses databases.
How to reduce the risk of infection with advertising "viruses"
- Always carefully watch what you install along with applications. By doing this without looking, you agree to the installation of add-ons, which, among other things, will “delight” you with “tempting offers”.
- Do not refuse to use antiviruses - they cope with a particularly malicious "adware" with a bang.
- Install software only from trusted sources. Optimal - from official sites. Any application, even the most innocuous one, can have a “gift” attached to it.
- Do not use the default username and password to log in to the router's web panel. Because they are used by trojans of the DNSChanger class.
- Create backup copies of web browser bookmarks. Ideally, sync them across multiple devices. There is malware that deletes a user's bookmarks and saves ad pages instead.
And take care of yourself and your information!
