Counterflix “Virus” Removal (May 2017 Update)

Keep in mind, SpyHunter’s malware & virus scanner is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.


How irritating is this virus?

This page aims to help you remove Counterflix. These Counterflix removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.

Having problems with pop-up ads appearing in your Chrome or Firefox browser and being generated by Counterflix? There is a specific category of online advertising tools, which are specially developed to display different types of promotional messages. They come in the forms of banners, pop-ups, links, boxes, blinking messages, notifications, and web pages and appear on the users’ screen every time they open their browser. This category is known as adware. If you are experiencing a flow of undesired and intrusive ads as the ones described above, then most probably you are having an adware application that is operating on your system. In this article, we are going to explain the specifics of one particular program of this type, which is the probable source of your disturbance. The program is called Counterflix and in this guide, you are going to learn how to effectively remove it, in case you wish to save yourself from the ads. A few more words about how exactly it operates would give you a better understanding, so we suggest you read the description before you proceed to the removal instructions.

Counterflix "Virus"

Uninstall Counterflix

Software + advertisement = Adware

The idea of creating a special piece of software that can display different advertisements originates from the online marketing industry. Recently, online advertising has turned so big, that it needs some special tools to display its numerous ads. That’s why the advertisers and the software developers have shaken their hands and have created adware. This is an application that is specially developed to display ads whenever users open their browser. Even though the end users may not be really happy by the rather aggressive than helpful nature of the ads-generating software, there is a deal for both the advertisers and the developers. The marketers get good exposure of their ads, while the developers earn from the clicks on the ads through a method called Pay-Per-Click. The goal is simple – to display as many ads as possible and get as many clicks as possible.

To do that, the developers often distribute adware with their software installation packages and bundle it with free applications. Sometimes, spam emails may contain invitations for testing new software or trying free apps, which are “sponsored” through adware that gets along with them. A torrent, open source platforms, direct downloads and download managers may also include such ads-generating applications inside their package. However, while there is nothing wrong with this practice of program bundles, users may not really be aware when they are installing adware. This happens when they run the installation package of the program they want and quickly proceed with the standard installation process instead of checking the advanced options in the bundle. Usually, this is where they can find the adware and manually deselect it from the installation in case they don’t want it to get installed on their system.

Counterflix “Virus”?

Many people would wrongly refer to Counterflix as a virus. When in fact Counterflix is not a virus, legally speaking. Apart from flooding you with annoying ads, Counterflix may perform a few additional activities, which users may find disturbing. While on your system, Counterflix may keep a record of the websites you visit, how often you visit them, what you search for on the web, when you log in to your social accounts, what content you like there, what you share, your browsing history and bookmarks, etc. This information, known as traffic data, is usually collected and transmitted to the developers, who may analyze it and build your personal profile based on that. This way, they may optimize the ads that you see according to your interests and latest searches to improve the chances of you clicking on them or sell this data to other marketers as valuable marketing information. This practice of tracking the user’s Internet surfing habits may be considered as an invasion of their privacy, especially if this data lands in the hands of unknown third parties.

Another activity that causes serious irritation is when banners, pop-ups, boxes and pages start to appear in dozens and closing them becomes an impossible task. Closing one ad may lead to opening a few others and these series may continue until the screen freezes or the computer bugs. In such a huge flow of ads, it is not excluded that you may click on a misleading link or a message that could expose you to some online risks like different types of viruses, Trojans or even Ransomware. Although these risks really exist, it doesn’t mean that Counterflix is a malicious application or a virus. In general, adware is not capable of harming your system and won’t be detected by any antivirus as a threat, because it does not contain malicious scripts. Unlike Ransomware or Trojans, Counterflix is considered a harmless application, which at its best could only bring you some browsing-related disturbance. If you don’t want to tolerate it, however, the removal guide will help you deal with this program in no time. Just make sure you follow the instructions closely and let us know in case you need any help.

SUMMARY:

Name Counterflix
Type  Adware
Danger Level Medium (nowhere near threats like Ransomware, but still a security risk)
Symptoms  A huge number of pop-ups, links, boxes, blinking messages, notifications, and web pages appear on the users’ screen every time they open their browser.
Distribution Method Usually found in software bundles, torrents, open source download websites, email spam messages and links.
Detection Tool We generally recommend SpyHunter or a similar anti-malware program that is updated daily.

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version.
More information about SpyHunter and steps to uninstall.

Counterflix “Virus” Removal

If you are a Windows user, continue with the guide below.

If you are a Mac user, please use our How to remove Ads on Mac guide.

If you are an Android user, please use our Android Malware Removal guide.


Step1

Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).

Step2

WARNING! READ CAREFULLY BEFORE PROCEEDING!

We get asked this a lot, so we are putting it here: Removing parasite manually may take hours and damage your system in the process. If you want a fast safe solution, we recommend SpyHunter. 

>> Click to Download Spyhunter. If you don't want this software, continue with the guide below.

Keep in mind, SpyHunter’s malware & virus scanner is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab (the “Details” Tab on Win 8 and 10). Try to determine which processes are dangerous. 

malware-start-taskbar

Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Drag and Drop Files Here to Scan
Maximum file size: 128MB.

This scanner is free and will always remain free for our website's users. You can find its full-page version at: https://howtoremove.guide/online-virus-scanner/




Scan Results


Virus Scanner Result
ClamAV
AVG AV
Maldet

After you open their folder, end the processes that are infected, then delete their folders. 

Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 

Step3

Hold together the Start Key and R. Type appwiz.cpl –> OK.

appwiz

You are now in the Control Panel. Look for suspicious entries. Uninstall it/them.

Type msconfig in the search field and hit enter. A window will pop-up:

msconfig_opt

Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.

Step4

Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.

Open the start menu and search for Network Connections (On Windows 10 you just write it after clicking the Windows button), press enter.

  1. Right-click on the Network Adapter you are using —> Properties —> Internet Protocol Version 4 (ICP/IP), click  Properties.
  2. The DNS line should be set to Obtain DNS server automatically. If it is not, set it yourself.
  3. Click on Advanced —> the DNS tab. Remove everything here (if there is something) —> OK.

DNS

Step5

  • After you complete this step, the threat will be gone from your browsers. Finish the next step as well or it may reappear on a system reboot.

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).

browser-hijacker-taskbar-properties

Properties —–> Shortcut. In Target, remove everything after .exe.

ie9-10_512x512  Remove Counterflix “Virus” from Internet Explorer:

Open IE, click  IE GEAR —–> Manage Add-ons.

pic 3

Find the threat —> Disable. Go to IE GEAR —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

firefox-512 Remove Counterflix “Virus” from Firefox:

Open Firefoxclick  mozilla menu  ——-> Add-ons —-> Extensions.

pic 6

Find the adware/malware —> Remove.
chrome-logo-transparent-backgroundRemove Counterflix “Virus” from Chrome:

Close Chrome. Navigate to:

 C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

Rename the Folder to Backup Default

Rename it to Backup Default. Restart Chrome.

Step6

WARNING!
To remove parasite, you may have to meddle with system files and registries. Making a mistake and deleting the wrong thing may damage your system.
Avoid this by using SpyHunter - a professional Parasite removal tool.

Keep in mind, SpyHunter’s malware & virus scanner is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

Type Regedit in the windows search field and press Enter.

Inside, press CTRL and F together and type the threat’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

If the guide doesn’t help, download the anti-virus program we recommended or try our free online virus scanner. Also, you can always ask us in the comments for help!


  • Hector

    Quick question on this; if you changed your Chrome default in the user section, will importing your bookmarks cause Counterflix to come back? I seem to have been able to remove it but I havent imported my old bookmarks (yet).

    Thanks again for your description. it was really informative and worked.

     
    • HowToRemove.Guide Team

      Well, restoring your bookmakrs should not be a problem. If the unwanted software is gone, then it should be okay to import the bookmarks. Still, if you run into a problem, you can always tell us in the comments and we will help you solve it.

       
      • Hector

        Thanks; I’ll let you know if I have any issues.

         
        • HowToRemove.Guide Team

          We are here to help you if you run into any problem

           
  • Jency Viator

    HELP! I have the Counterflix pop ups making it impossible to use my browsers. I don’t even know how it happened. But when I go to ‘uninstall’ it, it’s nowhere on the list and nothing else looks suspicious. There aren’t even add ons that are wrong. What do I do?

     
    • HowToRemove.Guide Team

      Did you try checking your Hosts file for any suspicious IP addresses as described in the guide above?

       
      • unkown

        I do have suspicious IP addresses as described in the guide. What should I do?

         
        • HowToRemove.Guide Team

          Delete all of them, that are below “localhost” and then save the changes.

           
  • Lee van Rossen

    I have some unwanted ip’s from step 4

    127.0.0.1 down.baidu2016. com

    127.0.0.1 123.sogou.vcom

    127.0.0.1 http://www.czzsyzgm.vcom

    127.0.0.1 http://www.czzsyzxl.vcom

     
    • HowToRemove.Guide Team

      Indeed, those IP’s seem to be unwanted. Do remove them and save the changes to the Hosts file.

       
  • Margarida Andrade

    I have the Counterflix pop ups in every website and I don’t understand how I got this… when I go to ‘uninstall’ it, it’s nowhere on the list and nothing else looks suspicious, I’ve looked on the task manager and I still don’t know where it is… please help me!

     
    • HowToRemove.Guide Team

      What about the Hosts file? Did you check it for any shady IP’s?

       
  • HowToRemove.Guide Team

    Can you send us a screenshot of your processes from the Task Manager during the time you are having issue with the unwanted program?

     
  • CattyCat

    I did everything showed here, even if it wasn’t my browser (as is not listed here) but the counterflix thingy is still showing up.
    No, i don’t have weird IPs showing up, there is one process in the Task Manager wich it name is between {} <– those, and is just a bunch of random numbers and capital letters as if it was a game code (like de XXXXXX-XXXXXX-XXXXXX-XXXXXX thing) and it seems to change from time to time, it does not pop up however, there are actually about 5-6 of those process, and even if it doesn't affect me that much on performance (sorry if bad english) it actually makes that some of my pages stop working, some videos pause themselves and it makes flash animations really REALLY laggy.
    The folder in wich the process came from has the same characteristics, the name is random, is enclose in {} and has the code-like estructure, and also, the folders are located in the ProgramData hidden folder on C:

     
    • HowToRemove.Guide Team

      Did you try deleting this folder while in Safe Mode?

       
      • CattyCat

        Yes I did, it just auto-creates another one with the same characteristics on start-up and deleting it does not fix the problem.
        Nothing I’ve tried fixes the problem (as for now I have tried, all of your suggestions and many more that I don’t really remember exactly what they where)
        The real problem is, the only thing I downloaded BEFORE the Counterflix problem started, was a file that I did download before in the same way I did now, with the same link and all and before, the file didn’t gave me any problems, AT ALL.
        I dunno, I can actually kinda live with this if it isn’t a virus, but damn it is annoying.

         
        • HowToRemove.Guide Team

          Can you send us a screenshot of your program installs from your Control panel and also a screenshot of all processes in your Task Manager?

           
          • CattyCat

            Also, I’m starting to think that what I got isn’t counterflix, but something related to it.
            Weird.

             
          • HowToRemove.Guide Team

            Even if it is some other unwanted software, as long as it is a Browser Hijacker or something similar, the steps provided above should enable you to get rid of it. However, so far you aren’t really giving us much information to work with. If there are some shady processes in the Task Manager, right-click on them and open the file location to see where this leads you.

             
  • HowToRemove.Guide Team

    Could you please, finish your comment? Also, did you remember to save the changes to the hosts file after deleting the shady addresses.

     
  • HowToRemove.Guide Team

    Hi, there. We advise you to check your Registry for shady keys just like it is described in the guide above. If you find anything suspicious there, send it to us in the comments.

     
    • peyton t

      In my registry, I found a program called ClkApp, googled it, found it was a pop-up ad virus and deleted it. I have also found something called EasySpeedCheck and Probit Software in my registry, and i’m not sure what they are so I haven’t deleted. I also found programs called WTools, and TutoTag, and QualityChecker. All of these may not be viruses, but they sound suspicious to me.

       
      • HowToRemove.Guide Team

        Can you send us a screenshot of your Registry? Also, were there any shady IP’s in the Hosts file?

         
  • HowToRemove.Guide Team

    For now, our advise for you is to delete the Easy Speed Check key because it looks shady and see if this fixes anything. Tell us in the comments what happened.

     
  • Zakariyya Al-Quran

    These IPs all show up
    0.0.0.1 mssplus.mcafee. com
    162.222.193.86 aoaomo.tremorhub. com
    188.95.50.62 bobomo.tremorhub. com
    162.222.193.86 http://www.howcast. com
    162.222.193.86 howcast. com
    162.222.193.86 http://www.ustream. tv
    162.222.193.86 ustream. tv
    162.222.193.86 http://www.livestream. com
    162.222.193.86 livestream. com
    162.222.193.86 http://www.dailymotion. com
    162.222.193.86 dailymotion. com
    192.192.3.8 virustotal. com
    looks really suspicious what do I do?

     
    • HowToRemove.Guide Team

      You should delete those IP’s from the text file and save the changes to it.

       
  • HowToRemove.Guide Team

    We advise you to first send them to us here so we can tell you if they need to be removed. Nevertheless, if there’re many of them, they are most likely unwanted and must be deleted. After the deletion, the file must be saved so that the changes are applied.

     
    • Miss_nitab

      Well actually after completing all the steps, instead of 4 IPs, only two appear, and they seem quite inoffensive:

      127.0.0.1 clients2 .google. com
      127.0.0.1 v1.ff.avast. com

      Thoughts? and thank you so much, you are awesome, I think I actually removed the virus after completing your guide and reboot, you made my day and my week!

       
      • HowToRemove.Guide Team

        The addresses indeed do not look all that shady. However, removing them is still probably the better option which is what we would advise you to do. If you decide to indeed delete them, make sure that you save the changes to the Hosts file. Anyway, you are most welcome, we are happy that you have found our guide helpful! If you happen to come across any other similar issue in future, do not hesitate to contact us again.

         
  • HowToRemove.Guide Team

    Hi, here’s what you should do: Copy-paste the following line: notepad %windir%/system32/Drivers/etc/hosts in the Start Menu search bar and right-click on the first result selecting Run as Administrator from the menu. Now you should be able to save the file since it has been ran under Administrator privileges.

     
  • HowToRemove.Guide Team

    The listed IP addresses should be removed fro your Hosts file. Delete them and then save the changes and see if this fixes the issue with the unwanted software.

     
  • MoostacheOwner21

    Hello, I really don’t wanna ruin my PC. SpyHunter isn’t free. So… What should I do?

     
    • HowToRemove.Guide Team

      There is a free version of SpyHunter but it does not have the virus removal feature, only the scanner which can still show you any potentially risky files that you might have on your PC. If you do not want to get the paid version, you can always use the guide at the bottom of the article and follow its in an attempt to get rid of the unpleasant program. Did you try completing any of the steps from the guide?

       
  • HowToRemove.Guide Team

    You should delete those and save the changes to the Hosts file. The addresses you’ve send us are not supposed to be in your Hosts file.