Adware:Win32/Kremium.AD represents a persistent advertising platform that infiltrates Windows systems to inject unwanted advertisements, redirect browser searches, and monitor user activity for revenue generation. This adware variant belongs to the Kremium family, a cluster of ad-supported programs that modify browser settings and system configurations to maintain a foothold on infected machines. While not as destructive as ransomware or data-stealing trojans, Kremium.AD degrades system performance, compromises privacy, and creates security vulnerabilities that more dangerous malware can exploit.
Users typically discover this infection when advertisements begin appearing in unexpected places—pop-ups during regular browsing, in-text ads on websites that normally don't display them, or promotional content injected directly into search results. The adware generates revenue for its operators through pay-per-click schemes and affiliate marketing, making your computer a profit center for remote attackers while slowing it down and exposing your browsing habits to third parties.
Threat Profile
| Attribute | Details |
|---|---|
| Family | Kremium adware family (Win32/Kremium variants) |
| Aliases | PUA.Kremium, Adware.Kremium, Win32:Adware-gen [Adw], potentially unwanted application (PUA) |
| Platform | Windows 7, 8, 8.1, 10, 11 (32-bit and 64-bit) |
| Classification | Adware / Potentially Unwanted Program (PUP) |
| Distribution Method | Software bundling, fake updates, deceptive download buttons, freeware installers |
| Persistence Mechanisms | Registry Run keys, browser extensions, scheduled tasks, service installations |
| Primary Behaviors | Ad injection, search redirection, browser modification, tracking cookie installation, homepage/search engine hijacking |
| Typical File Locations | %LOCALAPPDATA%, %APPDATA%, %PROGRAMFILES%, browser extension folders |
| Network Activity | Frequent connections to ad-serving domains, tracking servers, and affiliate networks; HTTP/HTTPS traffic to deliver promotional content |
| Data Collection | Browsing history, search queries, clicked links, system information, IP address, geolocation data |
| Performance Impact | Moderate to high—browser slowdowns, increased CPU usage, network bandwidth consumption, startup delays |
| Removal Difficulty | Moderate—multiple components across browsers and system; may reinstall if not completely removed |
How It Spreads
Adware:Win32/Kremium.AD rarely arrives alone or through honest disclosure. The primary distribution mechanism exploits the software bundling ecosystem, where free applications—media players, PDF converters, download managers, system utilities—include additional "offers" during installation. These installers present the adware as optional software with pre-checked boxes or deliberately confusing language that makes declining difficult. Users clicking through installation screens rapidly or selecting "Express" installation options inadvertently authorize the adware installation alongside their intended program.
Deceptive advertising represents another major infection vector. Legitimate websites often host third-party advertisements that the site owners don't directly control. Malicious actors purchase ad space on these networks and create convincing fake update notifications—particularly for Flash Player, Java, or media codecs—that deliver the adware when clicked. Download portals compound this problem by surrounding actual download buttons with multiple fake "Download" buttons that lead to bundled installers rather than the clean software users intended to obtain.
Common infection pathways include:
- Freeware bundles — legitimate software packaged with unwanted add-ons during installation from download sites like Softonic, Download.com, or CNET Downloads
- Fake update prompts — browser pop-ups claiming your Flash Player, video codec, or Java installation is outdated and requires immediate updating
- Deceptive download buttons — file-sharing and software download sites displaying multiple "Download" buttons where only one is legitimate
- Compromised installers — repackaged versions of popular free software that include adware components not present in the official version
- Torrent files — pirated software packages and "cracks" that bundle adware with the desired program
- Malicious browser extensions — toolbars and add-ons advertised as productivity enhancers or security tools that actually serve advertisements
- Social engineering emails — messages with attachments or links claiming to be invoices, shipping notifications, or account alerts that lead to adware installers
What It Does On Your Machine
Once installed, Adware:Win32/Kremium.AD establishes multiple persistence mechanisms to ensure it survives reboots and basic removal attempts. The adware drops executable files in user-specific directories where Windows permissions allow writing without administrator elevation, then creates registry entries that launch these components at startup. Browser modifications occur simultaneously, with the adware installing extensions in Chrome, Firefox, and Edge that intercept web traffic and inject advertising content into pages you visit.
The most visible symptom involves advertisement injection across your browsing experience. Text on legitimate websites suddenly becomes hyperlinked, with hover-over actions triggering pop-up ads. New browser tabs open spontaneously to promotional landing pages. Search results get redirected through intermediate tracking servers before reaching your intended destination, with sponsored links inserted at the top of results pages. Video advertisements may play in corners of your screen even when no browser is open, and comparison shopping pop-ups appear whenever you view product pages on retail sites.
Behind these visible annoyances, the adware actively monitors your behavior. Every search query, visited URL, and clicked link gets transmitted to remote servers where the data builds an advertising profile. The system records which ads you view, how long you linger on pages, and what products you research. This information has value to advertisers and data brokers who purchase browsing profiles to target future marketing campaigns. While Kremium.AD isn't classified as a trojan specifically designed for credential theft, the privacy implications remain significant—particularly if you browse banking sites, medical portals, or other sensitive destinations while infected.
System performance degrades noticeably under the constant advertising activity. The adware's background processes consume CPU cycles maintaining connections to ad servers, loading promotional content into browser memory, and updating its configuration files. Browser startup times increase as extensions load and initialize. Network bandwidth gets consumed by continuous communication with remote servers, slowing legitimate web browsing. On older machines or systems with limited RAM, these additional processes can cause noticeable lag during routine tasks and make resource-intensive applications like video editing or gaming nearly unusable.
Manual Removal — Step by Step
Disconnect from the Network
Unplug your Ethernet cable or disable Wi-Fi to prevent the adware from downloading additional components, communicating with command servers, or updating its configuration. This isolation stops further data transmission while you clean the system. Work offline throughout the removal process.
Boot into Safe Mode with Networking
Restart your computer and enter Safe Mode, which loads Windows with minimal drivers and prevents most adware components from launching automatically. On Windows 10/11, hold Shift while clicking Restart, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart, and select option 5 (Safe Mode with Networking). This gives you access to download removal tools if needed while keeping the adware dormant.
Uninstall Suspicious Programs
Open Control Panel > Programs and Features (or Settings > Apps on Windows 10/11) and review the installed applications list, sorting by installation date. Remove any programs you don't recognize, particularly those installed around the time symptoms began. Kremium-related entries might appear as "Update Manager," "System Optimizer," random letter combinations, or legitimate-sounding utilities you didn't intentionally install. Uninstall each suspicious entry completely.
Remove Browser Extensions
Check every installed browser for unauthorized extensions. In Chrome, navigate to chrome://extensions/; in Firefox, go to about:addons; in Edge, visit edge://extensions/. Remove any extensions you didn't install yourself, along with toolbars, "helper" add-ons, or productivity extensions that appeared without your knowledge. Restart each browser after removing extensions to ensure changes take effect.
Clean Registry Persistence
Press Windows+R, type "regedit," and press Enter to open the Registry Editor. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries with suspicious names (random characters, kremium-related names, or paths pointing to %LOCALAPPDATA% or %APPDATA% folders with GUID-like names). Right-click and delete these entries. Repeat for the RunOnce keys in the same locations.
Check Scheduled Tasks
Open Task Scheduler (search for it in the Start menu) and examine the Task Scheduler Library for suspicious entries. Look for tasks with names like "Update," "System Check," or random character strings that run frequently or at startup. Check the "Actions" tab of each suspicious task to see what program it launches—if it points to executables in temporary folders or random GUID directories, delete the entire task.
Delete Adware Files and Folders
Navigate to %LOCALAPPDATA% and %APPDATA% (type these into File Explorer's address bar) and look for folders with random names, GUID-style identifiers, or kremium-related names. Delete these entire folders. Check %PROGRAMFILES% and %PROGRAMFILES(X86)% under Common Files for similar suspicious directories. Empty your Recycle Bin afterward to permanently remove these files.
Run Malwarebytes and AdwCleaner
Download and install Malwarebytes (free version works) and AdwCleaner from their official websites. Run a full system scan with Malwarebytes first, quarantining everything it finds. Then run AdwCleaner, which specializes in detecting adware and PUPs that general antivirus might miss. Follow the prompts to remove detected threats and allow the system to reboot if requested.
Reset Browser Settings
Even after removing extensions, adware can leave modified settings behind. In Chrome, go to Settings > Reset Settings > Restore settings to their original defaults. In Firefox, type about:support in the address bar and click "Refresh Firefox." In Edge, visit Settings > Reset Settings > Restore settings to their default values. This clears altered homepages, search engines, and startup pages while preserving bookmarks and passwords.
Verify and Monitor
Restart your computer normally (not in Safe Mode) and reconnect to the network. Monitor system behavior for 24-48 hours. Check Task Manager (Ctrl+Shift+Esc) for unusual processes consuming CPU or network bandwidth. Browse normally and watch for returning symptoms—pop-ups, redirects, or unwanted ads. If symptoms reappear, the infection wasn't completely removed and professional assistance is recommended to locate remaining components.
Prevention
- Download software only from official sources. Avoid third-party download sites like Softonic, Download.com, or FileHippo that repackage installers with bundled adware. Go directly to the developer's website or use the Microsoft Store for Windows applications.
- Always choose Custom installation. Never click "Express" or "Recommended" installation options when installing free software. Select "Custom" or "Advanced" installation and carefully read each screen, declining all additional offers, toolbars, homepage changes, or bonus applications.
- Keep your system and software updated. Enable automatic updates for Windows and all installed applications. Legitimate updates deliver through built-in update mechanisms (Windows Update, application auto-updaters), never through browser pop-ups requesting immediate action.
- Use a reputable ad blocker. Browser extensions like uBlock Origin prevent many malicious advertisements from displaying, eliminating a common infection vector. These tools block deceptive download buttons and fake update prompts before you can accidentally click them.
- Maintain real-time antivirus protection. Windows Defender provides adequate baseline protection if kept updated. Supplement it with periodic scans using Malwarebytes (free version) to catch PUPs and adware that signature-based antivirus might allow.
- Scrutinize browser extension permissions. Before installing any extension, review what permissions it requests. Legitimate productivity tools don't need to "read and change all your data on all websites." Extensions requesting excessive permissions likely have ulterior motives.
- Create a standard user account for daily use. Don't operate as an administrator for routine tasks. A standard user account can't modify system-wide settings or install software without elevation, preventing many adware infections from establishing deep persistence.
- Educate everyone who uses the computer. Make sure family members or employees understand that not all "Download" buttons are legitimate, that urgent update warnings in browsers are usually scams, and that free software often comes with hidden costs in the form of bundled junk.
Bring It In
Manual removal works when you catch the infection early and feel confident working with system utilities, registry settings, and safe mode procedures. But Adware:Win32/Kremium.AD variants often install alongside other unwanted programs, creating a tangled mess of interdependent components that reinstall each other when incompletely removed. If you've followed these steps and symptoms persist, if you're uncomfortable editing the registry, or if you simply want the certainty that comes from professional removal with verification, we're here to help.
Computer Repair Roswell handles adware and PUP infections daily at our Roswell shop. We'll thoroughly scan your system with multiple specialized tools, manually verify that every persistence mechanism is eliminated, reset browser configurations, and test the machine under normal use conditions before returning it to you. Bring your computer to 1520 Housworth Dr, Roswell, GA 30076, or call ahead at (770) 856-1511 to describe your symptoms and get an estimated turnaround time. Most adware removals complete within 24 hours, and we'll explain exactly what we found and how to prevent reinfection. Don't let advertising parasites turn your computer into someone else's revenue stream—let's get it cleaned properly.