Remove Powered by Zedo & Popups

Spyware is computer software that is installed on your computer without your consent and intercepts or takes partial control over your interaction with your computer. Spyware such as Zedo “powered by Zedo” and redirects your browser or opens popups displaying advertising. Zedo and spyware also installs the core.sys rootkit resulting in slow internet speeds, different home pages and also loss of internet. In this article on Spyware and Adware removal, I will show you how to remove the Zedo(powered by Zedo) and popups and also remove the core.sys rootkit.

How to Remove “Powered by Zedo” and spyware

Step 1: Download PC Tools Spyware Doctor.

We will be using this free Anti Spyware tool provided by Google. Google is giving out this amazing Spyware product for free as part of its Google Pack. While the Google Pack has other good software, you can download just the PC Tools Spyware Doctor. Click here download Spyware Doctor from PC Tools website to remove the Zero and URL.cpvfeed spyware software.

Step 2: Disable System restore on your computer.

On the Desktop, right click My Computer. Click Properties. Click the System Restore Tab. Check Turn off System Restore. Click Apply and OK. When prompted to restart your computer, Restart and Boot into Safe mode.

disable system restore

Step 3: Boot into Safe Mode instead of booting normally into Windows.

Step 4: Search for core.sys.

Click on Start and then Search and type core.sys. If the search results return any core.sys results, delete them. Again, in Search, type core.cache.dsk. If you find core.cache.dsk instances, remove them too.

Step 5: Clean the Registry.

Press <Windows Key> + R which will open the run command. Now type in regedit. Under HKEY_LOCAL_MACHINE, click the plus sign(+) . Here you will see CurrentControlSet and in some cases, CurrentControlSet1 and also CurrentControlSet2.

Under each one of the CurrentControlSets, click the plus sign(+) next to Service. Scroll down and there will be a folder called CORE. Right click on the folder and Delete it. Do the same for any remaining CurrentControlSets.

remove core.sys rootkit

Step 6: Run Spyware Scan to remove the Zero and popups

First reboot your computer and log into Windows in the Normal mode. Now, open your PC Tools Spyware Doctor. If you did not download the free AntiSpyware software provided by Google, click here to

Under the PC Tools Spyware Doctor, run a complete system scan for spyware and adware removal. You have successfully removed Zero and popups and core.sys rootkit. removal

Similar Posts:

  1. Pingback: Agustin
  2. Nice article, but prevention is better than cure. Don’t visit sites where you will get infected but thats no so easy because these days you can’t tell which sites have spyware/malware embedded.

    I would suggest getting a good antivirus Norton or Kaspersky, a good spyware remover such as pc tools or Adaware from Lavasoft and lastly a good firewall 😉

  3. First of all congratulation for such a great site. I learned a lot reading article here today. I will make sure i visit this site once a day so i can laern more.

  4. Did not find any core files anywhere so I hope I don’t still have that dreaded powered by zedo….

    Dont know what URI is….see above

  5. i keep getting these pop ups with IE and firefox.. ad-aware nor AVG will install on my PC, likely this software blocking the installation, and the core files are not located in my hard drive, (even checked hidden/system files) and there is no core entry in my registry that i can locate, verified that it was not in the place mentioned..

    perhaps someone can tell me what service seems suspicious..
    nyphonejacks(AT)yah00.c0m <-zeros in place of oh’s to try to cut down on spam…

    i dont know why svchost.exe is running 5 diffrent times, system, local service and (user account)…

    alg.exe local service
    csrss.exe system
    ctfmon.exe (user account)
    explorer.exe (user account)
    firefox.exe (user account)
    getmodule23.exe (user account)
    hkcmd.exe (user account)
    igfxsrvc.exe (user account)
    lsass.exe system
    mrofinu72.exe (user account)
    services.exe system
    smss.exe system
    spoolsv.exe system
    svchost.exe system
    svchost.exe network service
    svchost.exe system
    svchost.exe network service
    svchost.exe local service
    system system
    system idle process system
    taskmgr.exe (user account)
    trayicon.exe (user account)
    wdfmgr.exe local service
    winable.exe (user account)
    winlogon.exe system
    wuauclt.exe (user account)
    chkntfs.exe (user account)

  6. I’m still learning from you, while I’m making my way to the top as well. I definitely enjoy reading everything that is posted on your website.Keep the posts coming. I enjoyed it!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.