Feven usually comes with a free software package, or fake updates that appears to be real ones (their installation file looks very similar to the one from a trusted manufacturer). It is based on Crossrider framework (designed to create cross browser extensions), so Feven additionally installs this framework components by taking over space on your PC.

Companies distributing such PUPs can use the following monetization scheme: the company finds a popular application, negotiates with its developers, and adds additional options to the installation file of the main program. In return, they are distributing the main software through third-party companies, for example. These additional programs are usually of dubious value for the user, at the same time such method helps to generate revenue out of users’ installs/clicks on the pop-ups with advertisements. That is why we always highly recommend choosing a Custom software installation instead of a Full/Complete one to ensure that all the checkboxes with additional unnecessary options are unchecked.

This may cause annoying in-text ads, pop-ups displayed in different sections of a web page, or even full page advertisements while you are using internet. From one side, it’s a good deal for people who like buying online from home, and are happy to receive promo codes and coupons from time to time. But even these users should be very watchful and be aware of potential malware risk while taking advantage of such offers, or when opening new unfamiliar websites, and especially while putting their personal or credit card details. Also, it is always recommended to protect yourself with anti-phishing option integrated to your browsers and your antivirus program (for example, Ad-Aware from Lavasoft has such a feature in its paid versions).

Feven adware silently installs its extensions to all your browsers if any (Mozilla, Chrome, IExplorer), even if it was downloaded using only one of them. Once installed, it “eats” away your paid internet speed, tracks your web search history, slows down your browser’s functionality and your overall system performance (by assigning its tasks into the ‘Scheduled Tasks’ and starts every time your system boots):

Here are some removal steps for Feven 2.2. The procedure for other Feven’s versions is almost the same.

1.    From your desktop, click on Windows Start button and choose Control Panel option (Windows 8 users: right-click on Windows Start button and choose Control Panel from the drop-down menu).
2.    Double-click Programs and Features (Windows Vista, 7 and 8), or Add or Remove Programs (Windows XP).
3.    Find Feven in the list, right-click on it and choose Uninstall. Wait a few moments for this process to be completed.
4.    Reboot PC.

5.    Once rebooted, you shouldn’t see Feven’s extension in any of your browsers. And if you follow the steps below, you will get more protection from your browsers in future:

Google Chrome
If you are using this browser, make sure that ‘Phishing and malware protection’ is enabled:
•    Open Chrome, and type in the address bar: chrome://settings and press ‘Enter’;
•    Scroll down the page and click on ‘Show advanced settings…’ link;
•    In the opened menu, find ‘Privacy’ section and make sure that ‘Enable phishing and malware protection’ option is checked

Internet Explorer
Starting version 8, IE has added an option ‘SmartScreen Filter’ that can be turned on by going to Tools -> Safety -> Turn on SmartScreen Filter:

Mozilla Firefox
In Firefox, go to the orange ‘Firefox’ logo -> Options -> Options

In a new window, choose ‘Security’ tab and make sure that all the 3 options ‘Warn me when sites try to install add-ons’, ‘Block reported attack sites’ and ‘Block reported web forgeries’ are checked:

6.    Now please open C:/Program Files(x86) (or C:/Program Files on 32bit OS) and make sure a folder called ‘Feven 2.2’ is deleted:

7.    Before you follow next steps, please make sure that hidden files in your Windows Explorer are open: Start –> Control Panel (Appearance and Personalization) –> Folder Options –> ‘View’ tab –> find ‘Hidden files and folders’ and choose an option ‘Show hidden files, folders, and drives’.
Now please follow the paths below and make sure that Feven’s folders/files are deleted:

•    In your Temp folder, please check whether all the files with the name ‘feven’ are deleted (if not, delete these manually):
-    Win Vista, 7, 8 OS: C:\Users\[YOUR_USER_NAME]\AppData\Local\Temp
-    Win XP OS: C:\Documents and Settings\[YOUR_USER_NAME]\Local Settings\Temp

•    In your browsers folders, you may also find traces of Feven:
-    Win Vista, 7, 8 OS:

C:\Users\[YOUR_USER_NAME]\AppData\Local\Google\Chrome\User Data\Default\Extensions – make sure there is no folders called “bdhbagplpkkoeifmpmpdaieomnggppmo” and “jhnbkenepdnmckmkdfeaoabboadnodnc”
-    Win XP OS: C:\Documents and Settings\test\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions – these folders shouldn’t be here: “bdhbagplpkkoeifmpmpdaieomnggppmo” and “jhnbkenepdnmckmkdfeaoabboadnodnc”

-    For Win Vista, 7, 8 users only:

C:\Users\[YOUR_USER_NAME]\AppData\Roaming\Mozilla\Firefox\Profiles\XXXX.default\extensions –make sure there is no folder called “15d84a30-fc9d-4fca-80a7-e5797da621a2@b2cb2d04-e262-4863-aee7-9d0e4333b550.com” and “b5a8adb2-854a-46d3-bf7d-b12f49185917@e6bdf66d-4584-4d26-80a8-081e925b80a5.com”

8.    Last step is the most difficult one, because you will work with Windows Registry – the most vital part of your PC, so you have to take precaution and responsibility. Deleting wrong keys/folders may have some programs (or even the whole system) stop working. Before deleting anything in Registry, its crucial to make sure that you clean a key in question only, and not the whole registry branch. Again, never delete any key in registry, unless you are 100% sure that it’s a correct one and you don’t need anymore.
•    To open the Registry – press ‘Win+R’ keys on your keyboard -> in the opened command prompt window type regedit and press ‘Enter’.
•    Please check whether the values (in bold) in the below paths are deleted:
Windows Vista, 7 and 8:
HKEY_USERS\S-1-5-21-732923889-1296844034-12085810011000\Software\AppDataLow\ Software\Crossrider
HKEY_USERS\S-1-5-21-732923889-1296844034-12085810011000\Software\AppDataLow\ Software\Feven 2.2
HKEY_CURRENT_USER\Software\Classes\LocalSettings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\Feven 2.2
HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\Feven

Windows XP:
HKEY_USERS\S-1-5-21-606747145-1060284298-839522115-1003\Software\Crossrider
HKEY_USERS\S-1-5-21-606747145-1060284298-839522115-1003\Software\Feven 2.2
HKEY_CURRENT_USER\Software\Crossrider

Any OS:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0049012.BHO HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0049012.BHO.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0049012.Sandbox
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0049012.Sandbox.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411901112} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Feven 2.2 (on 32bit OS only)
HKEY_LOCAL_MACHINE\SOFTWARE\Feven 2.2 (for 32bit OS) or HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Feven 2.2 (for 64bit OS)
HKEY_CLASSES_ROOT\CrossriderApp0049012.BHO
HKEY_CLASSES_ROOT\CrossriderApp0049012.BHO.1
HKEY_CLASSES_ROOT\CrossriderApp0049012.Sandbox
HKEY_CLASSES_ROOT\CrossriderApp0049012.Sandbox.1

Like we’ve mentioned at the beginning of this article, Feven is usually downloaded in a bundle with programs that may have other harmful adware in their installation wizard. So even if you remove 1 adware, you can still have other malware on your machine. Therefore, it is strongly recommended to scan PC with your antivirus software once all the steps above are done (make sure the definitions database of your AV is the latest one, preferably – downloaded within the last hour). Another important advice – always scan any new downloaded file with your antivirus before you proceed with its installation to ensure it is safe for your PC.