Click here to visit Original posting
Remove Curvelayer Background Audio Ads
- Wed, 23 Nov 2016 18:19:27 EST
- Read 3167 times
Curvelayer is a potentially unwanted program, or PUP, that installs software on a computer that constantly opens up video advertisements through your computer. It does this in a way so that the videos are not displayed on the computer, but you still hear the audio coming from them. The only way to spot this PUP is to notice strange process names running in Task Manager or to use a network sniffer as shown below.
How did the Curvelayer Background Audio Ads get on my computer?
It is important to note that this adware is bundled with and installed by free programs that did not adequately disclose that other software would be installed along with it. Therefore, it is important that you pay close attention to license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed. Furthermore, If the license agreement or installation screens state that they are going to install a toolbar or other unwanted adware, it is advised that you immediately cancel the install and not use the free software.
In my opinion, when a program hides the fact that it is making repeated connections to remote sites, then it is not a program that you want on a computer. If you wish to learn how to remove it for free, you can use the removal guide below.
ArrayC:\Program Files (x86)\Coronas\ C:\Program Files (x86)\Coronas\Microsoft.Win32.TaskScheduler.dll C:\Program Files (x86)\Coronas\settings.dll C:\Program Files (x86)\Coronas\strictest.exe C:\Program Files (x86)\Harbinger\ C:\Program Files (x86)\Harbinger\strictest.exe C:\Program Files (x86)\acetic\ C:\Program Files (x86)\acetic\schippers.exe %UserProfile%\AppData\Local\105013.exe %UserProfile%\AppData\Local\20249.exe %UserProfile%\AppData\Local\47249.exe %UserProfile%\AppData\Local\67233.exe %UserProfile%\AppData\Local\76645.exe %UserProfile%\AppData\Local\a3.exe %UserProfile%\AppData\Local\aatxtname.txt %UserProfile%\AppData\Local\ddnow.exe %UserProfile%\AppData\Local\ok223.txt %UserProfile%\AppData\Local\run1.txt %UserProfile%\AppData\Local\setupok.exe %UserProfile%\AppData\Local\tr5b.txt %UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\megalithic.lnk C:\Windows\System32\Tasks\12265500 C:\Windows\System32\Tasks\Adobe Flash Player Updater C:\Windows\System32\Tasks\Da1226550012265500 C:\Windows\Tasks\Adobe Flash Player Updater.job C:\Windows\iggy.exe
File Location Notes:
%UserProfile% refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> for Windows 2000/XP, C:\Users\<Current User> for Windows Vista/7/8, and c:\winnt\profiles\<Current User> for Windows NT.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\mcclinton "C:\Program Files (x86)\Harbinger\strictest.exe" HKCU\Software\Microsoft\Windows\CurrentVersion\Run\mcclintonmcclinton "C:\Program Files (x86)\Coronas\strictest.exe" HKCU\Software\Microsoft\Windows\CurrentVersion\Run\criminalization "C:\Program Files (x86)\Harbinger\strictest.exe" HKCU\Software\Microsoft\Windows\CurrentVersion\Run\criminalizationcriminalization "C:\Program Files (x86)\Coronas\strictest.exe" HKCU\Software\Microsoft\Windows\CurrentVersion\Run\schippers "C:\Program Files (x86)\acetic\schippers.exe" HKCU\Software\Microsoft\Windows\CurrentVersion\Run\californians "C:\Program Files (x86)\Harbinger\strictest.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pesetas "C:\Program Files (x86)\Harbinger\strictest.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pesetaspesetas "C:\Program Files (x86)\Coronas\strictest.exe" HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\chiropractic "C:\Program Files (x86)\Harbinger\strictest.exe" HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\chiropracticchiropractic "C:\Program Files (x86)\Coronas\strictest.exe" HKLM\SOFTWARE\Wow6432Node\idot HKLM\SOFTWARE\idot