Spyware is computer software that is installed on your computer without your consent and intercepts or takes partial control over your interaction with your computer. Spyware such as Zedo “powered by Zedo” and URL.cpvfeed.com redirects your browser or opens popups displaying advertising. Zedo and URL.cpvfeed.com spyware also installs the core.sys rootkit resulting in slow internet speeds, different home pages and also loss of internet. In this article on Spyware and Adware removal, I will show you how to remove the Zedo(powered by Zedo) and URL.cpvfeed.com popups and also remove the core.sys rootkit.
How to Remove “Powered by Zedo” and URL.cpvfeed.com spyware
Step 1: Download PC Tools Spyware Doctor.
We will be using this free Anti Spyware tool provided by Google. Google is giving out this amazing Spyware product for free as part of its Google Pack. While the Google Pack has other good software, you can download just the PC Tools Spyware Doctor. Click here download Spyware Doctor from PC Tools website to remove the Zero and URL.cpvfeed spyware software.
http://www.pctools.com/spyware-doctor/
Step 2: Disable System restore on your computer.
On the Desktop, right click My Computer. Click Properties. Click the System Restore Tab. Check Turn off System Restore. Click Apply and OK. When prompted to restart your computer, Restart and Boot into Safe mode.
Step 3: Boot into Safe Mode instead of booting normally into Windows.
Step 4: Search for core.sys.
Click on Start and then Search and type core.sys. If the search results return any core.sys results, delete them. Again, in Search, type core.cache.dsk. If you find core.cache.dsk instances, remove them too.
Step 5: Clean the Registry.
Press <Windows Key> + R which will open the run command. Now type in regedit. Under HKEY_LOCAL_MACHINE, click the plus sign(+) . Here you will see CurrentControlSet and in some cases, CurrentControlSet1 and also CurrentControlSet2.
Under each one of the CurrentControlSets, click the plus sign(+) next to Service. Scroll down and there will be a folder called CORE. Right click on the folder and Delete it. Do the same for any remaining CurrentControlSets.
Step 6: Run Spyware Scan to remove the Zero and URL.cpvfeed.com popups
First reboot your computer and log into Windows in the Normal mode. Now, open your PC Tools Spyware Doctor. If you did not download the free AntiSpyware software provided by Google, click here to
Under the PC Tools Spyware Doctor, run a complete system scan for spyware and adware removal. You have successfully removed Zero and URL.cpvfeed.com popups and core.sys rootkit.
I just read this government info on spyware http://hubpages.com/hub/Spyware_tips
is it very accurate?
Nice article, but prevention is better than cure. Don’t visit sites where you will get infected but thats no so easy because these days you can’t tell which sites have spyware/malware embedded.
I would suggest getting a good antivirus Norton or Kaspersky, a good spyware remover such as pc tools or Adaware from Lavasoft and lastly a good firewall 😉
First of all congratulation for such a great site. I learned a lot reading article here today. I will make sure i visit this site once a day so i can laern more.
Did not find any core files anywhere so I hope I don’t still have that dreaded powered by zedo….
Dont know what URI is….see above
Thanks, I found this post to be actually quite helpful.
i keep getting these pop ups with IE and firefox.. ad-aware nor AVG will install on my PC, likely this software blocking the installation, and the core files are not located in my hard drive, (even checked hidden/system files) and there is no core entry in my registry that i can locate, verified that it was not in the place mentioned..
perhaps someone can tell me what service seems suspicious..
nyphonejacks(AT)yah00.c0m <-zeros in place of oh’s to try to cut down on spam…
i dont know why svchost.exe is running 5 diffrent times, system, local service and (user account)…
alg.exe local service
csrss.exe system
ctfmon.exe (user account)
explorer.exe (user account)
firefox.exe (user account)
getmodule23.exe (user account)
hkcmd.exe (user account)
igfxsrvc.exe (user account)
lsass.exe system
mrofinu72.exe (user account)
services.exe system
smss.exe system
spoolsv.exe system
svchost.exe system
svchost.exe network service
svchost.exe system
svchost.exe network service
svchost.exe local service
system system
system idle process system
taskmgr.exe (user account)
trayicon.exe (user account)
wdfmgr.exe local service
winable.exe (user account)
winlogon.exe system
wuauclt.exe (user account)
chkntfs.exe (user account)
Great post. Thanks for sharing!
I also have an registry cleaner software to recommend. Check out at my website.52
This comment is automaticlly submitted by WpSender2.1 Soft.
$20 per copy. My email is [email protected]。
Hi! I was surfing and found your blog post… nice! I love your blog. 🙂 Cheers! Sandra. R.
I’m still learning from you, while I’m making my way to the top as well. I definitely enjoy reading everything that is posted on your website.Keep the posts coming. I enjoyed it!