{"id":4505,"date":"2015-01-26T10:00:22","date_gmt":"2015-01-26T15:00:22","guid":{"rendered":"http:\/\/me-en.kaspersky.com\/blog\/?p=4505"},"modified":"2020-02-26T18:59:32","modified_gmt":"2020-02-26T14:59:32","slug":"my-big-fat-adware-cleaning","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/my-big-fat-adware-cleaning\/4505\/","title":{"rendered":"My Big Fat Adware Cleaning"},"content":{"rendered":"<p>As a student, I had a part-time job servicing and administrating computers for SM\u0412 customers. Years have passed, but there are occasions when I have to remember those good old days\u00a0\u2014 mostly when I visit relatives who use their PCs daily, but still cannot service them properly.<\/p>\n<p style=\"text-align: center\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2015\/01\/05102841\/My-Big-Fat-Adware-Cleaning-1-1024x768.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-7263\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2015\/01\/05102841\/My-Big-Fat-Adware-Cleaning-1-1024x768.png\" alt=\"My-Big-Fat-Adware-Cleaning\" width=\"1067\" height=\"800\"><\/a><\/p>\n<p>A couple of weeks ago, I got a plea for help from one such relative: their laptop, quite powerful and by no means obsolete, had become very laggy. Upon a close examination, I found that \u00be of its computing resources were wasted on five different \u2018home page helpers\u2019 and \u2018search panels\u2019.<\/p>\n<p>They were accompanied by malicious adware which demonstrated huge and irritating banners on each web page opened. All of these little enhancements were gone in two hours, and my venture was a success \u2013 of course, they got an installation of <a href=\"https:\/\/www.kaspersky.ru\/advert\/free-trials\/multi-device-security?campaign=kl_blog&amp;redef=1&amp;THRU&amp;referer1=kl_blog&amp;referer2=kl_blog\" target=\"_blank\" rel=\"noopener\">Kaspersky Internet Security<\/a>\u00a0as well.<\/p>\n<h4>Bring in the ads!<\/h4>\n<p>What makes me call this adware malicious? Two reasons: First, it excessively consumes PC resources. Second, and more importantly, it\u2019s a way to show advertisements. Any adware is, in fact, a type of malware, if banners are demonstrated on each web page you launch and it imitates the native content and characteristics of the web page.<\/p>\n<p>Only after visiting websites I am very familiar with did I comprehend the magnitude\u00a0of the disaster. A half dozen marginal ads were injected into every web page at the bottom or next to the main text. This makes the user think it\u2019s the website\u2019s owner who is greedy and packing every inch of every page with ads.<\/p>\n<p>https:\/\/twitter.com\/TopSportingTip\/status\/554575686724489216<\/p>\n<p>This \u2018super-useful\u2019 functionality requires up to 300 MB of memory per \u00a0browser and consumes up to 2\/3 of the CPU\u2019s load. Also of note: There is no universal way to get rid of it.<\/p>\n<h4>Going away voluntarily<\/h4>\n<p>An attempt to stop the resource-demanding bastards by means of Task Manager was successful\u2026 for 10 seconds or so, and then many of them were back and continued devouring the PC\u2019s processing power. Uninstallating through the dashboard had a limited impact as well. Only \u2018classy\u2019 programs, like Yandex and Yahoo\u2019s search bars, went voluntarily with their heads held high.<\/p>\n<p>Those two, in fact, appeared to have been consuming a very small part of the system\u2019s resources. <em><strong>Disclaimer:<\/strong> E<\/em>ach of them was not very demanding in terms of processing power, but there were five of them. So, five programs were performing the same tasks and battling for the honor to become the home page.<\/p>\n<p style=\"text-align: center\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2015\/01\/05102839\/tons-of-adware.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-7264\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2015\/01\/05102839\/tons-of-adware.png\" alt=\"tons-of-adware\" width=\"650\" height=\"382\"><\/a><\/p>\n<p style=\"text-align: center\"><em>This is what happens to a PC with download.com\u2019s top 10 most popular programs installed simultaneously.<\/em> Image courtesy of <a href=\"http:\/\/www.howtogeek.com\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">How To Geek.<\/a><\/p>\n<p>However, no-name \u2018search helpers\u2019 were real badass, die-hard pieces of software: They either appeared to be absent from the list of installed programs or were un-deletable, causing an error message to appear\u00a0every time I tried to press the delete button.<\/p>\n<h4>Rude farewell to stubborn programs<\/h4>\n<p>Proficient users who are fast and furious can do \u2018the finger dance\u2019 (I don\u2019t mean <a href=\"http:\/\/awoiaf.westeros.org\/index.php\/Finger_dance\" target=\"_blank\" rel=\"noopener nofollow\">this<\/a>, GoT nerds), in which one has to manually delete all of an app\u2019s files in three seconds after stopping the task in the PC\u2019s memory. A more efficient method is based on using KVRT, or <a href=\"https:\/\/www.kaspersky.ru\/antivirus-removal-tool?form=0\" target=\"_blank\" rel=\"noopener\">Kaspersky Virus Removal Tool<\/a>. This is a free antivirus with basic functionality, which scans a computer infected with a die-hard malware and then cures it.<\/p>\n<div class=\"pullquote\">An efficient deletion method is based on using KVRT, or Kaspersky Virus Removal Tool. This is a free antivirus with basic functionality.<\/div>\n<p>In my case, KVRT deleted two infected adware components and after a reboot, the PC was able to breath some fresh air. I had to get rid of two toolbars and helpers, which luckily offered an uninstall option and were not detected as malware.<\/p>\n<p>One more reboot, and the PC was clean. Once the computer is clean, all you need to do is run simple servicing operations like deleting files from the Temp folders and defragmenting the hard drive.<\/p>\n<h4>The root of all evil<\/h4>\n<p>Where did all these undeletable malvertising banners come from? It took me mere seconds to figure it out: One quick look at the desktop was enough to get the answer. The desktop contained a couple dozen games, which are mostly given away for free by developers.<\/p>\n<p style=\"text-align: center\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2015\/01\/05102838\/infested-games-desktop-1024x598.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-7265\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2015\/01\/05102838\/infested-games-desktop-1024x598.jpg\" alt=\"infested-games-desktop\" width=\"1355\" height=\"791\"><\/a><\/p>\n<p>Altruism is not a feature of the gamedev community. It is costly to develop a modern game, even a simple one, and they need to raise money somehow. If they do not charge users directly, they are earning their buck somewhere else. It could be through, for instance, a partnership with advertising networks and search engines.<\/p>\n<p>Basically, this is how various \u2018search helpers\u2019 and \u2018home page protectors\u2019 get onto your computer: through games and freeware. This business model is basically acceptable, but as we\u2019ve seen, the way it works is not ideal.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">\"Do NOT Try This at Home\": what happens when you install the top 10 apps from download[.]com <a href=\"http:\/\/t.co\/14j5l8CRl7\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/14j5l8CRl7<\/a><\/p>\n<p>\u2014 Virus Bulletin (@virusbtn) <a href=\"https:\/\/twitter.com\/virusbtn\/status\/554573778379108352?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">January 12, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Generally, PC users don\u2019t care about installing five different toolbars, so this is where healthy competition could be of use: upon spotting a competing toolbar on the PC, an Installation Wizard might notify the user about it in the course of the installation process.<\/p>\n<p>It works fine with antiviruses: Often, when installed on the same machine, <a href=\"https:\/\/www.kaspersky.com\/blog\/two-av-same-pc\/4380\/\" target=\"_blank\" rel=\"noopener nofollow\">two antiviruses would not live peacefully<\/a>. Unless the advertising toolbar developer employs the same approach, regular \u2018adware cleaning\u2019 like the one I handled recently will be a service that\u2019s high in demand.<\/p>\n<h4>How can you avoid installing adware add-ons?<\/h4>\n<p>It is much simpler to prevent adware slipping into your system rather than deleting it. The tips below should help:<\/p>\n<ol>\n<li>Always download apps from the developer\u2019s official web page, and not from software aggregators.<\/li>\n<li>Pay attention to each Installation Wizard window when installing software and un-check all boxes which suggest you installed additional programs.<\/li>\n<\/ol>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">How to get rid of rid of <a href=\"https:\/\/twitter.com\/hashtag\/adware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#adware<\/a> and toolbars? Enter advanced mode when installing s\/w or follow this advice: <a href=\"https:\/\/t.co\/M0BZIZvSES\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/M0BZIZvSES<\/a><\/p>\n<p>\u2014 Eugene Kaspersky (@e_kaspersky) <a href=\"https:\/\/twitter.com\/e_kaspersky\/status\/492358324344471552?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">July 24, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<ol start=\"3\">\n<li>Hit \u2018Advanced Installation\u2019 or \u2018Installation Options\u2019 buttons, which usually contain useful options like disabling add-on installation.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>As a student, I had a part-time job offering PC support services. Now, when visiting relatives who aren&#8217;t good at servicing their computers, I often have to apply my expertise once again.<\/p>\n","protected":false},"author":32,"featured_media":4506,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[9],"tags":[542,900,617,180,903,407,902,786],"class_list":{"0":"post-4505","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-tips","8":"tag-adware","9":"tag-freeware","10":"tag-gamers","11":"tag-kaspersky-internet-security","12":"tag-kaspersky-virus-removal-tool","13":"tag-kis","14":"tag-kvrt","15":"tag-malvertising"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/my-big-fat-adware-cleaning\/4505\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/my-big-fat-adware-cleaning\/4561\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/my-big-fat-adware-cleaning\/5058\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/my-big-fat-adware-cleaning\/5356\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/my-big-fat-adware-cleaning\/6713\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/my-big-fat-adware-cleaning\/7262\/"},{"hreflang":"zh","url":"https:\/\/www.kaspersky.com.cn\/blog\/my-big-fat-adware-cleaning\/2502\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/my-big-fat-adware-cleaning\/6717\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/my-big-fat-adware-cleaning\/6713\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/my-big-fat-adware-cleaning\/7262\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/my-big-fat-adware-cleaning\/7262\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/adware\/","name":"Adware"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/32"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=4505"}],"version-history":[{"count":2,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4505\/revisions"}],"predecessor-version":[{"id":15974,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4505\/revisions\/15974"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/4506"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=4505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=4505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=4505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}