Site Overlay

Remove Powered by Zedo & URL.cpvfeed.com Popups

Spyware is computer software that is installed on your computer without your consent and intercepts or takes partial control over your interaction with your computer. Spyware such as Zedo “powered by Zedo” and URL.cpvfeed.com redirects your browser or opens popups displaying advertising. Zedo and URL.cpvfeed.com spyware also installs the core.sys rootkit resulting in slow internet speeds, different home pages and also loss of internet. In this article on Spyware and Adware removal, I will show you how to remove the Zedo(powered by Zedo) and URL.cpvfeed.com popups and also remove the core.sys rootkit.

How to Remove “Powered by Zedo” and URL.cpvfeed.com spyware

Step 1: Download PC Tools Spyware Doctor.

We will be using this free Anti Spyware tool provided by Google. Google is giving out this amazing Spyware product for free as part of its Google Pack. While the Google Pack has other good software, you can download just the PC Tools Spyware Doctor. Click here download Spyware Doctor from PC Tools website to remove the Zero and URL.cpvfeed spyware software.

http://www.pctools.com/spyware-doctor/

Step 2: Disable System restore on your computer.

On the Desktop, right click My Computer. Click Properties. Click the System Restore Tab. Check Turn off System Restore. Click Apply and OK. When prompted to restart your computer, Restart and Boot into Safe mode.

disable system restore

Step 3: Boot into Safe Mode instead of booting normally into Windows.

Step 4: Search for core.sys.

Click on Start and then Search and type core.sys. If the search results return any core.sys results, delete them. Again, in Search, type core.cache.dsk. If you find core.cache.dsk instances, remove them too.

Step 5: Clean the Registry.

Press <Windows Key> + R which will open the run command. Now type in regedit. Under HKEY_LOCAL_MACHINE, click the plus sign(+) . Here you will see CurrentControlSet and in some cases, CurrentControlSet1 and also CurrentControlSet2.

Under each one of the CurrentControlSets, click the plus sign(+) next to Service. Scroll down and there will be a folder called CORE. Right click on the folder and Delete it. Do the same for any remaining CurrentControlSets.

remove core.sys rootkit

Step 6: Run Spyware Scan to remove the Zero and URL.cpvfeed.com popups

First reboot your computer and log into Windows in the Normal mode. Now, open your PC Tools Spyware Doctor. If you did not download the free AntiSpyware software provided by Google, click here to

Under the PC Tools Spyware Doctor, run a complete system scan for spyware and adware removal. You have successfully removed Zero and URL.cpvfeed.com popups and core.sys rootkit.

url.cpvfeed.com removal

Similar Posts:

Published By:

Author: Ajit Gaddam

Ajit Gaddam is an accomplished technology executive and is currently the Head of Security Engineering at Visa, where he is responsible for building large scale AI driven cybersecurity products, leading engineering programs, and providing expert guidance on cybersecurity matters. He has presented at conferences worldwide, including USENIX Enigma, RSA, Black Hat, Strata Data Hadoop, COSO Dublin, and GCS Ukraine. Ajit has been quoted by major media organizations and his work has been showcased in academic journals, security publications, and in two published books. He is an active participant in various open source and standards bodies, is a prolific inventor of disruptive technologies (over 100+ global patents), and moonlights as an instructor (SANS, community colleges).

15 thoughts on “Remove Powered by Zedo & URL.cpvfeed.com Popups

  1. Pingback: Agustin
  2. Nice article, but prevention is better than cure. Don’t visit sites where you will get infected but thats no so easy because these days you can’t tell which sites have spyware/malware embedded.

    I would suggest getting a good antivirus Norton or Kaspersky, a good spyware remover such as pc tools or Adaware from Lavasoft and lastly a good firewall 😉

  3. First of all congratulation for such a great site. I learned a lot reading article here today. I will make sure i visit this site once a day so i can laern more.

  4. Did not find any core files anywhere so I hope I don’t still have that dreaded powered by zedo….

    Dont know what URI is….see above

  5. i keep getting these pop ups with IE and firefox.. ad-aware nor AVG will install on my PC, likely this software blocking the installation, and the core files are not located in my hard drive, (even checked hidden/system files) and there is no core entry in my registry that i can locate, verified that it was not in the place mentioned..

    perhaps someone can tell me what service seems suspicious..
    nyphonejacks(AT)yah00.c0m <-zeros in place of oh’s to try to cut down on spam…

    i dont know why svchost.exe is running 5 diffrent times, system, local service and (user account)…

    alg.exe local service
    csrss.exe system
    ctfmon.exe (user account)
    explorer.exe (user account)
    firefox.exe (user account)
    getmodule23.exe (user account)
    hkcmd.exe (user account)
    igfxsrvc.exe (user account)
    lsass.exe system
    mrofinu72.exe (user account)
    services.exe system
    smss.exe system
    spoolsv.exe system
    svchost.exe system
    svchost.exe network service
    svchost.exe system
    svchost.exe network service
    svchost.exe local service
    system system
    system idle process system
    taskmgr.exe (user account)
    trayicon.exe (user account)
    wdfmgr.exe local service
    winable.exe (user account)
    winlogon.exe system
    wuauclt.exe (user account)
    chkntfs.exe (user account)

  6. I’m still learning from you, while I’m making my way to the top as well. I definitely enjoy reading everything that is posted on your website.Keep the posts coming. I enjoyed it!

  7. certainly like your web site however you have to check the
    spelling on quite a few of your posts. Several of them are rife with spelling iswsues annd I find it
    very bothersome too inform the truth nevertheless I’ll
    definitely coome back again.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Scroll Up