 Hello, everybody! This video is about taking away viral advertising in such browsers as Google Chrome, Mozilla Firefox, Opera, Yandex browser, Microsoft Edge, and Internet Explorer. If your browser suddenly opens tabs containing advertising, for example, Vulkan Casino, if tabs with popular websites Yandex, VK, YouTube, Autonoclast and K-App to be filled with extra advertising banners, or AdWords not flashing as soon as you start the browser, it means your computer is infected with a virus. All that advertising slows down the computer as so much that it's impossible to work with a browser. For example, I installed several programs from a doubtful source. As a result, here is what I get without receiving any notice. Amiga browser and other services by Mailu were installed. Autonoclast Nikif, Kontakte, Automatic Software Update Service and Unity Web Player. My default browser was changed to Amiga. The startup page of other browsers was changed to Mailu. Old browsers are showing advertising banners all the time. Here are just several examples. However, this is just the beginning. Things could be much worse in your case. Before you start deleting viral advertising, you can roll back to the last restore point or restore your system from an image if such function has been enabled in your computer. You can watch my previous videos to see how to do it. Otherwise, you will have to delete the virus manually. It is a long and painstaking process of several stages. Cleaning windows scheduler, deleting malware, viruses, cleaning system startup list and cleaning the browsers. In the description of this video, you can go down to the stage which you need. First of all, disconnect the computer from the network and check task scheduler. Viruses and unwanted programs often create automatic tasks to run various malware processes, downloading, installing and updating themselves and other viruses, forced opening of advertising tabs in browsers and so on. With the use of task scheduler, a virus can install itself again while you are trying to delete it. In order to delete such tasks, go to Control Panel, Administrative Tools, Task Scheduler. Click once on the scheduler library and search the list for the tasks related to malware processes. You can find some of them in the description of this video below. In my case, MailRooUpdata. Delete these tasks. To do it, right-click on the task, select Delete and confirm it by clicking OK. After deleting all malware tasks in the task scheduler, go to Control Panel, Programs and Features and sort and install the programs by date of the last installation. You can see what programs and features were installed without your knowing it. In my case, here are the programs they were installed by themselves. Amiga Browser, Automatic Software Update Service, Unity Web Player. Delete all of them. To do it, right-click once on the program and select Delete. Some malware cannot be deleted in this way because they are not shown in Programs and Features menu. To see them, start Task Manager by pressing the key combination Ctrl plus Shift plus Escape. Then click on More Details and open the tab Details. In Windows 7, it is the tab Processes. Look for all suspicious processes running on your computer. In my case, there are MailRooUpdata.exe and so on. See the extended list in the description. Then right-click on one of the processes, for example, MailRooUpdata.exe, click File Location and write down the path to this folder. In my case, this is UndererfChukUpdata.localMailRoo. Repeat these actions for all suspicious processes and then restart the computer in Safe Mode. To see how, watch my previous video. When in Safe Mode, go to Control Panel, File Explorer Options, then click on the tab View and choose the option Show Hidden Files, Folders and Drives. Uncheck the box next to Hide Protected Operating System Files Recommended and then apply the changes to all folders. After that, go to the folders, the path to which you have written down, and delete all files and folders created by these MailWear processes. In my case, I find the folder MailRoo in the path C, Users, UndererfChukUpdata.local and delete it. After viruses have been deleted, open the Task Manager, click Startup and see if there is anything wrong. Disable and delete all unwanted processes. To do it, right-click on the line, choose to open a file location and delete it. Repeat this operation for all suspicious processes in the Startup tab. After that, press Windows plus R, type in raggedit and press Enter. Viruses and unwanted programs create entries in the registry to download or update their files when Windows starts. These entries can be found in the registry keys HKEY local machine and HKEY current user in the path Software, Microsoft, Windows, Current version in the folders Run and Run once. If these registry lines Run and Run once contain registry entries related to MailWear processes, delete them. To do it, right-click on the necessary file, for example, Amiga and click Delete. After that, search the registry for names of MailWear processes. In the registry editor, select Computer and click Find in the tab Edit. Enter the names of those MailWear processes which you remembered, for example, MailRoo and click on Find Next. Delete all registry lines where these processes are found. To do it, right-click on the necessary file and click Delete. After each deleting, press F3 key. That is, restart the search for MailWear registry entries with such name. This action should be repeated until the registry editor finds no MailWear entries for your search. Be very careful. If you delete a system line in the registry editor, your computer will stop working. After deleting all entries, close the registry editor. After that, press Windows plus R, type in msconfig and press Enter. Open the tab Services and select Hide all Microsoft services. Then look at the list. If you see any services related to viruses or MailWear processes, uncheck the boxes next to such services and click OK. In my case, they are MailRoo Update Service, Update MailRoo. After disabling them, log out of the Save mode and restart the computer in Normal mode. Your next step is to check browser shortcuts on the desktop, in the Taskbar and the Start menu. Sometimes viruses or unwanted programs change the value in target line of the shortcut. After that, your browser startup page changes into a website you don't know, and your browser starts with several new windows showing you advertising. To fix the problem, right-click on the shortcut, for example of Chrome browser, and select Properties. Look attentively at the value in target line of your browser shortcut. For Google Chrome, the end of line should contain the value Chrome.exe, and the password corresponds to the folder containing this program. If the shortcut shows the path to a file other than the application's .exe file, for example some url or bat file, or the path contains a url address of a website, for example http column double slash virus site dot com, you should change this path into for 32-bit windows. See Program Files, Google Chrome, Application, Chrome.exe. For 64-bit windows, see Program Files, x86, Google Chrome, Application, Chrome.exe. After you made any changes, click on Apply, and you will find examples of correct target values for shortcuts of such browsers as Chrome, Mozilla Firefox, Opera Internet Explorer, Microsoft Edge, and Yardix browser in the description of this video. Instead of changing the shortcut, you can delete it and create a new one. Then you should reset browser settings. This function will reset startup page settings, reset quick access on such system pages, unpin all tabs, make the system disable all browser themes and extensions, make the system delete all temporary files, including cookies. Your bookmarks, history, and passwords will be preserved. To do it in Google Chrome or Yardix browser, go to Settings. Go to Advanced Settings, then click on Reset Settings, and then Reset. In Mozilla Firefox, go to the menu Help, Troubleshooting Information, then Clean Firefox, and confirm your decision. After resetting Firefox, a folder containing old browser settings will appear on the desktop. That is, Firefox creates a backup on the desktop with the name old Firefox data, and you can restore deleted data using the folder on the desktop in case you lost something important. Of course, if you don't need this folder, you can just delete it. In Opera browser, there is no option for automatic resetting, so you have to do it manually. Go to the menu, select About Opera, an open path to use a profile and browser cache in File Explorer. Make sure you close Opera, and then just delete all contents of the profile and cache folders. This procedure will reset all Opera settings. In Microsoft Edge, go to Settings, and in the section Clear Browsing Data, click on Choose What to Clear, choose Cookies and Saved Website Data, and Cached Data and Files, then click Clear. In Internet Explorer, go to Service, browse the properties, then open the tab Advanced Settings, and click on Reset. In doing so, you can also delete personal data by selecting this option. You should restart the computer for the changes to take effect. In the end, the file hosts must be checked. To do it, start Notepad as administrator, choose Open in the File menu, enable Showing All Files, then go to See, Windows, System32, Drivers, etc., and open the file hosts. If there are any lines which begin without a hash mark, delete them and save the file. If you liked this video, click the Like button below and subscribe to our channel to see more. Thank you for watching and good luck.