Remove Wonderlandads Virus (Android and PC)

Keep in mind, SpyHunter’s malware & virus scanner is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.


How irritating is this virus?

This page aims to help you remove Wonderlandads Virus. These Wonderlandads Virus removal instructions work for Chrome, Firefox and Internet Explorer, as well as every version of Windows.

If your Chrome, Firefox or IE browser are experiencing a sudden increase in pop-up Ads, banners and other annoying forms of advertisement and you are reading this article – then you’ve correctly assumed that Wonderlandads Virus is behind all of it. This is a type of Ad-generating software commonly referred to as Adware. It exists to spam Ads on all infected computers and the only way to remove it is to uninstall all of its components from your machine. In order to do that you need some basic understanding of how Adware operates and this article attempts to give you just that.

Wonderlandads Virus – a general overview

A very important thing to remember is that the Ads created by Wonderlandads Virus can rarely serve you in any useful matter – they are a way for someone to make money off your back first and foremost. The reason your computer has been infected by this Adware is the possibility that you will, at some point, click on one of the Ads. The people responsible for Wonderlandads Virus get a small amount of revenue every time someone clicks on his ad – and with good spam coverage a great sum of money can be made without any effort. This, in itself, is not that different from how other types of advertising platforms operate. The problem with Wonderlandads Virus is that is incredibly invasive and it cannot be turned off. You cannot navigate away from a page full of Ads – it will immediately create new ones to replace them. In addition to that very often these Adware programs are used to advertise very low quality products – be it different types of software or physical goods.

There is a huge and very successful market for phony PC optimization software. These programs are also referred to as bloatware and scamware. This is because they share the tendency to create fake messages about non-existing or greatly exaggerated problems that supposedly plague your computer. Such programs are perfectly capable of reporting over a hundred problems on a freshly installed and fully patched computer that has only Windows on it. Most commonly the PC registry is used as a scarecrow. The PC registry is a local windows database that exists on all versions of windows. It stores a number of settings for different programs installed on the PC. Whenever a program is changed in any way some of its registry entries may become obsolete. In this capacity they are benign – but this type of software will lead you to believe they are a serious problem for which you need to spend money for the software.

How do programs like Wonderlandads Virus infect computers?

Few people will willingly install programs like Wonderlandads Virus themselves – usually people have no recollection of its installation. Adware is not usually malicious and it does not utilize security flaws in order to infect computer. A much simpler, yet very effective scheme is used – a practice called software bundling.

  • A software bundle is basically the installer for a certain program, which also has a number of other programs hidden inside of it. Any user that runs such an installer and selects the Default/Quick installation option will automatically agree to have all these extra programs installed – and usually find himself in possession of useless junk like Wonderlandads Virus.

In order to avoid catching Adware thanks to this software bundle strategy simply opt out of using the quick installation and always select the Advanced option instead. It will only take a couple of extra clicks to get the same result, but in the meantime you get to see a list of all the programs and features that are about to be installed. Remove any extra program that is not needed by the main program you are interested in installing.

SUMMARY:

Name Wonderlandads
Type Adware
Danger Level Medium (Ads are very likely to advertise fake and useless products)
Symptoms Pop-ups, redirects, Ad banners and other forms of annoyance.
Distribution Method Software bundles, fake Ads and blog/forum recommendations written by automated bot spamming software.
Detection Tool We generally recommend SpyHunter or a similar anti-malware program that is updated daily.

Remove Wonderlandads Virus (Android and PC)


 

WARNING! If you are an android user, please refer to this page for the removal.

Step1

Reboot in Safe Mode (use this guide if you don’t know how to do it).

This was the first preparation.

Step2

WARNING!
To remove parasite, you may have to meddle with system files and registries. Making a mistake and deleting the wrong thing may damage your system.
Avoid this by using SpyHunter - a professional Parasite removal tool.

Keep in mind, SpyHunter’s malware & virus scanner is free. To remove the infection, you'll need to purchase its full version. More information about SpyHunter and steps to uninstall.

The first thing you absolutely must do is Reveal All Hidden Files and Folders.

  • Do not skip this step. Wonderlandads Virus may have hidden some of its files and you need to see them.

Repeat Step 2 for ALL browsers you have installed.

ie9-10_512x512 Remove the Malware from Internet Explorer:

Open IE, click IE GEAR —–> Manage Add-ons.

pic 3

Find the malware. Remove it by pressing Disable. If your Home Page has been hijacked, go to IE GEAR —–> Internet Options> change the URL to whatever you use —> Apply. Reset Your IE Settings

firefox-512 Remove Wonderlandads Virus from Firefox:

Open Firefox, click mozilla menu (top right) ——-> Add-ons —-> Extensions.

pic 6

Find the adware/malware —> Remove. Refresh Your Firefox Settings.


chrome-logo-transparent-background Remove Wonderlandads Virus from Chrome:

Start Chrome, click chrome menu icon —–>More Tools —–> Extensions. Find the malware and select chrome-trash-icon

pic 8

Click chrome menu icon —> Settings —> Search —> Manage Search Engines. Delete everything but your normal search engines. Reset Your Chrome Settings.

 

Step3

Right click on the browser’s shortcut —> Properties.

NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge) as well.

browser-hijacker-taskbar-properties

Properties —–> Shortcut. In Target, remove everything after .exe.

Step4

Hold together the Start Key and R. Type appwiz.cpl –> OK.

appwiz

You are now in the Control Panel. Look for suspicious entries. Uninstall it/them. If you see a screen like this when you click Uninstall, choose NO:

virus-removal1

Hold the Start Key and R copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.

Open the Start Menu, type “Control Panel” in the search box —> Enter. Network and Internet —> Network and Sharing Center —> Change Adapter Settings. Right-click your Internet connection —> Properties.

In Networking, left click Internet Protocol Version 4 —> Properties. If everything is normal, your window will look like this:

DNS Settings

If it’s not, click on the two “automatic” choices. NOTE: If you are in a domain network, contact your Domain Administrator so he can make these settings, or this may break your Internet Connection.

Step5

Press CTRL + SHIFT + ESC simultaneously. Go to the Processes Tab. Try to determine which ones are a virus. Google them or ask us in the comments.

A BIG WARNING! READ THIS BEFORE PROCEEDING!

This is the most important and difficult part, so be extremely careful. If you make a big mistake, it can damage your system significantly. Accounts connected to your credit cards or important information may be exposed to Wonderlandads Virus. If you do not feel you can do this, download a professional remover.

malware-start-taskbar

Right click on each of the virus processes and select Open File Location, then End the process. Copy the folders somewhere (as a backup if you make a mistake) and delete the directories you were sent to.

Step6

Type msconfig in the search field and hit enter. A window will pop-up:

msconfig_opt

Go in Startup —> Uncheck entries that have “Unknown” as Manufacturer.

Type Regedit in the windows search field and press Enter.

Once inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. If they don’t show this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

  • HowToRemove.Guide Team

    Delete them from the file and save it. They are all suspicious and likely part of the problem.
    Did that help you?

     
  • HowToRemove.Guide Team

    Hi Amr,

    You need to first open Notepad as an administrator and then navigate to the Hosts file from the Open menu inside the program.

     
  • HowToRemove.Guide Team

    Did they appear again?
    I hope we helped you! 🙂

     
  • HowToRemove.Guide Team

    Which of our methods did you try? Were there shady IP’s in your Hosts file? Did you check your program installs in your Control Panel for any sketchy entries?

     
    • Hristo

      Yes,i do everything,if you have skype or facebook to communicate there will be better for me.

       
      • HowToRemove.Guide Team

        Unfortunately, it’s the company’s policy not to give away information about personal contacts. Nonetheless, we are willing to give you as much aid as possible here, in the comments, but you must provide us with as much details about your situation as you can so that we can better determine what your problem exactly is.

         
        • Hristo

          It keeps opening some sites оccasionally and this is very annoying,
          get pages opened to mail .ru and b2.ijquery11. com.

           
          • HowToRemove.Guide Team

            Which of the steps from the guide did you complete? Did you check the Hosts file for any shady IP’s?

             
          • Mr.Malware

            I have the same problem, I did all of these steps and I can’t seem to find any sort of threat all over my pc, I also used Malwarebytes, bitdefender and ccleaner, I cleaned what was to clean and thats it. There was a russian app which contained the virus that installed nowhere in my computer, I found it using these apps, it’s gone but the ads still pop. (This happend before I did this guide)…I also ran into some antivirus apps that give a free trial (of course I can’t remove the detected threats) and it found a bunch of other threats out of nowhere all over my pc, even some in the registry with RegCure and Adwcleaner. I removed some of these files manualy and the threats where gone from adwcleaner, I couldn’t do the same for regcure though…and now I am stuck here.

             
          • HowToRemove.Guide Team

            Were there any shady IP’s in the Hosts file? Also, you can send us a screenshot of your program installs from the Control panel as well as of the Processes tab of the Task Manager.

             
          • chr0med

            I’m having the same problem. I did everything on here, but my Google Chrome randomly pops up and goes to a wonderlandad…

             
          • HowToRemove.Guide Team

            Did you check your Registry for any suspicious keys as instructed above?

             
  • HowToRemove.Guide Team

    Did you check the Registry Editor for any shady keys? If you could send us a screenshot from that, this might enable us to help you.

     
  • GhostMan SK

    127.0.0.1 systweak. com
    127.0.0.1 updateservice1.systweak. com
    127.0.0.1 http://www.systweak. com
    127.0.0.1 systemspeedup. systweak. com
    127.0.0.1 systweak. com/STCheckGenuineness

    what should I do with that

     
    • HowToRemove.Guide Team

      The IP’s listed above must be removed since they are probably coming from the undesirable software.

       
  • Hi, some random porn ads pop in new tabs. The source seems to be Wonderlandads. I’ve done all the steps and found no shady ip in the host file. Also, I dont know what process to delete since everyone of them seems legit.
    Send help pls

     
    • HowToRemove.Guide Team

      Hello, we advise you to send us a screenshot of the processes you have in your Task Manager as well as the list of programs installed on your PC from the Control Panel. Also, did you seek the unwanted software’s name in the Registry Editor?

       
  • HowToRemove.Guide Team

    Open the Registry Editor and search for the name of the unwanted program as instructed in the guide. Tell us if you find anything there. Also, do you have any newly acquired browser extensions? You should check that too. There’s quite a lot of stuff on your PC yet so far we haven’t been able to pinpoint the potential cause for this issue.

     
    • Ok, I’m going on a journey right now so I’ll see that in a week, thanks !

       
      • HowToRemove.Guide Team

        You are most welcome! Tells us once you’ve checked the Registry and we will tell you what to do next.

         
  • HowToRemove.Guide Team

    Yes, we have received your comment.

     
  • Eliran Gonen

    This is my hosts file
    127.0.0.1 down.baidu2016. com
    127.0.0.1 123.sogou. com
    127.0.0.1 http://www.czzsyzgm. com
    127.0.0.1 http://www.czzsyzxl. com
    127.0.0.1 union.baidu2019. com

     
    • HowToRemove.Guide Team

      The IP’s you’ve send use are not supposed to be there so we advise you to delete them and save the changes afterwards.