KickMumViaLive is a potentially unwanted program (PUP) that typically arrives bundled with freeware installers and presents itself as a legitimate browser extension or system utility. Once installed, it functions primarily as adware, injecting advertisements into web pages, redirecting searches through affiliate networks, and tracking browsing activity to generate revenue for its operators. While not as destructive as ransomware or banking trojans, KickMumViaLive degrades system performance, compromises privacy, and creates persistent annoyance through aggressive advertising tactics that resist straightforward removal attempts.
Users frequently discover KickMumViaLive after noticing sudden changes to their browser homepage, unexpected pop-up advertisements appearing on sites that normally don't display them, or search queries being rerouted through unfamiliar search engines. The program establishes multiple persistence mechanisms across the Windows registry and browser configurations, making it challenging to eliminate completely without systematic intervention. Its presence often indicates other bundled PUPs may have installed simultaneously during the same software package.
Threat Profile
| Attribute | Details |
|---|---|
| Family | Adware / Potentially Unwanted Program (PUP) |
| Aliases | PUP.Optional.KickMumViaLive, Adware.KickMumViaLive, BrowserModifier:Win32/KickMumViaLive |
| Platform | Windows (7, 8, 8.1, 10, 11); affects Chrome, Firefox, Edge browsers |
| Discovered | Circa 2018-2019 (variants continue to circulate) |
| Distribution | Software bundling, fake update prompts, deceptive download buttons on freeware sites |
| Persistence Mechanisms | Registry Run keys, Scheduled Tasks, browser extension policies, hijacked shortcuts |
| Primary Capabilities | Ad injection, search redirection, browser homepage/search engine modification, tracking cookie installation |
| Typical Artifacts | Random-named folders in %LOCALAPPDATA%, %APPDATA%, and %PROGRAMFILES%; modified browser shortcuts; registry entries under HKCU\Software and HKLM\Software |
| Network Behavior | Connects to ad-serving domains, affiliate tracking networks; sends browsing data to remote servers |
| Data at Risk | Browsing history, search queries, clicked links, potentially form data depending on variant |
| Removal Difficulty | Moderate — requires manual registry cleanup and browser policy removal beyond standard uninstaller |
| Payload Risk | Low direct damage; moderate privacy concern; may download additional PUPs or expose user to malicious advertising |
How It Spreads
KickMumViaLive relies almost exclusively on software bundling as its primary distribution mechanism. Users encounter it when downloading seemingly legitimate freeware — video converters, PDF tools, download managers, or codec packs — from third-party hosting sites. The installer presents the PUP as an "optional component" or "recommended offer," often using confusing language and pre-checked boxes that default to installation unless the user explicitly opts out. Many users simply click through these screens without reading the fine print, inadvertently authorizing installation of multiple unwanted programs simultaneously.
Beyond bundling, KickMumViaLive variants have been observed using deceptive advertising tactics on low-reputation websites. Fake "Update Flash Player" or "Download Now" buttons that mimic legitimate interface elements trick users into executing the installer. Some distribution campaigns masquerade as browser extensions offering useful features like "faster internet" or "enhanced video quality," only revealing their true adware nature after installation when the aggressive advertising begins.
Common infection vectors include:
- Bundled freeware installers from download portals like Softonic, Download.com (when hosting third-party repackaged software), or torrent sites
- Fake software update notifications appearing on compromised or low-quality websites claiming Flash, Java, or media players need updating
- Malvertising campaigns where legitimate ad networks unknowingly serve malicious advertisements containing drive-by downloads
- Deceptive browser extension listings in unofficial extension marketplaces or promoted through social media spam
- Email attachments disguised as documents that actually contain executable files (less common for this family but documented)
- Pirated software packages where crackers bundle adware alongside illegitimate program activators
What It Does On Your Machine
Once executed, KickMumViaLive's installer deposits files across multiple Windows directories, deliberately scattering its components to complicate removal. The core executable typically lands in a randomly-named subfolder within %LOCALAPPDATA% or %APPDATA%, using GUID-like folder names (strings of letters and numbers such as "A4B8C2D1-E3F5-9876-1234-ABCDEF123456") that appear system-generated. Additional components install browser helper objects, extension files, and configuration databases that hook into Chrome, Firefox, and Edge to modify their behavior.
The adware immediately modifies browser settings, often changing the default homepage to a search portal that generates revenue through affiliate partnerships. Search queries typed into the address bar get intercepted and routed through multiple redirection servers before ultimately reaching a search engine — each hop in this chain represents an opportunity for the operators to log your queries and insert sponsored results. Web pages you visit receive injected advertisements that weren't placed by the site's legitimate operators: banner ads appear in unexpected locations, text gets randomly hyperlinked to advertising landing pages, and pop-under windows open when you click anywhere on the page.
System performance degradation becomes noticeable as KickMumViaLive consumes CPU cycles maintaining its ad-serving infrastructure and communicating with command-and-control servers. Browser processes become sluggish, tabs take longer to load, and memory usage climbs as the adware's JavaScript components execute alongside legitimate page content. The tracking components log every website you visit, building a profile of your browsing habits that gets transmitted to remote servers — ostensibly for ad targeting purposes, but this data collection raises significant privacy concerns.
Perhaps most frustrating for users attempting self-removal, KickMumViaLive implements watchdog mechanisms that monitor its own components and restore them if deleted. A scheduled task runs periodically to verify the browser extension remains installed and registry keys haven't been removed. If the user uninstalls the extension manually through browser settings, the scheduled task reinstalls it within minutes. This cat-and-mouse game exhausts many users who give up after several failed removal attempts, allowing the adware to continue operating indefinitely.
Manual Removal — Step by Step
Disconnect from the Internet
Unplug your Ethernet cable or disable Wi-Fi to prevent KickMumViaLive from communicating with its command servers, downloading updates, or reinstalling removed components during the cleanup process. This also protects you from accidentally entering credentials on a hijacked browser during removal.
Boot Into Safe Mode with Networking
Restart your computer and press F8 (or Shift+F8 on newer systems) during boot to access Advanced Boot Options. Select "Safe Mode with Networking" — this loads Windows with minimal drivers and prevents most adware components from auto-starting, making them easier to remove. On Windows 10/11, you can also reach this through Settings > Update & Security > Recovery > Advanced startup > Restart now, then Troubleshoot > Advanced options > Startup Settings > Restart > press 5 or F5.
Terminate Running Processes
Open Task Manager (Ctrl+Shift+Esc), switch to the Details tab, and look for suspicious processes with random names or processes located in user folders rather than System32. Right-click any KickMumViaLive-related processes and select "End Task." Note the location shown under the "Command Line" column — you'll need to delete those folders later. Also terminate any browser processes to ensure no components are actively running.
Remove Persistence Mechanisms from Registry
Press Win+R, type regedit, and press Enter. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and look for entries pointing to executables in AppData or LocalAppData folders with random names — delete these entries. Also check HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and the Policies keys under both HKEY_CURRENT_USER\Software\Policies and HKEY_LOCAL_MACHINE\Software\Policies, removing any browser extension force-install policies. Search the registry for "KickMumViaLive" and delete any keys found.
Delete Scheduled Tasks
Open Task Scheduler by searching for it in the Start menu. Expand "Task Scheduler Library" and look for tasks with random names or descriptions that reference the folders you noted earlier. Common locations include tasks under Microsoft\Windows with names like "UpdateTask" followed by random characters. Right-click suspicious tasks, select Delete, and confirm. These tasks are how the adware resurrects itself after apparent removal.
Delete Program Folders and Files
Open File Explorer and navigate to the folder locations you identified in Task Manager. Common locations include %LOCALAPPDATA% (type this in the address bar), %APPDATA%, and sometimes %PROGRAMFILES% or %PROGRAMFILES(X86)%. Delete any folders with GUID-like names or names containing "KickMumViaLive" or similar variants. You may need to show hidden files (View > Show > Hidden items) to see all folders.
Clean All Browser Extensions and Settings
Open each browser you use and navigate to the extensions/add-ons page (chrome://extensions for Chrome, about:addons for Firefox, edge://extensions for Edge). Remove any unfamiliar extensions, especially those without recognizable publishers or with generic names. Then reset browser settings: in Chrome/Edge, go to Settings > Reset settings > Restore settings to their original defaults. In Firefox, type about:support in the address bar and click "Refresh Firefox." This removes hijacked homepages, search engines, and injected settings while preserving bookmarks.
Run Malwarebytes or Similar Scanner
Download Malwarebytes Free (from malwarebytes.com — use a clean computer or smartphone if your main machine's browser is still compromised) and run a full system scan. This catches remnants you might have missed and identifies any additional PUPs that were bundled with KickMumViaLive. Quarantine and remove everything it finds. Supplement with a secondary scanner like AdwCleaner or HitmanPro for thoroughness.
Change Important Passwords
If KickMumViaLive was present for more than a few days and you entered passwords during that time, assume your credentials may have been logged through form-grabbing or keylogging components. Change passwords for email, banking, social media, and other critical accounts — do this from a confirmed clean device if possible, or after completing removal and rebooting.
Reboot and Verify Complete Removal
Restart your computer normally (not in Safe Mode) and reconnect to the internet. Open your browser and verify that your homepage and search engine are back to your preferences, no unexpected extensions appear, and normal websites display without injected advertisements. Run one more quick scan with Malwarebytes to confirm nothing auto-reinstalled during the reboot. Monitor system behavior for the next few days — if advertisements or redirects return, additional components remain hidden.
Prevention
- Download software only from official sources. Get programs directly from the developer's website or verified app stores like the Microsoft Store. Avoid third-party download portals that repackage software with bundled offers — even formerly reputable sites like Download.com have included adware in their installers.
- Always choose "Custom" or "Advanced" installation. Never click through installers using "Express" or "Recommended" settings. The Custom path reveals bundled offers and pre-checked boxes that authorize installation of additional programs. Uncheck anything you don't recognize or didn't explicitly intend to install.
- Keep a reputable anti-malware program running. Free versions of Malwarebytes, Windows Defender (built into Windows 10/11), or similar tools catch most PUPs before they install. Keep definitions updated and enable real-time protection when available.
- Maintain current software versions. Legitimate updates come through the program's own update mechanism or official websites — never through pop-up notifications on random websites. Configure Windows Update, browser auto-updates, and program updaters to run automatically so you're protected against exploits that deliver malware.
- Use an ad blocker and script blocker. Browser extensions like uBlock Origin prevent malicious advertisements from loading and block many drive-by download attempts. Script blockers like NoScript (Firefox) or ScriptSafe (Chrome) add another layer by preventing untrusted JavaScript execution.
- Be skeptical of browser extension requests. Only install extensions from official browser stores (Chrome Web Store, Firefox Add-ons) with many verified reviews. Investigate the publisher before authorizing any extension that requests broad permissions like "read and change all data on websites."
- Create a standard user account for daily use. Don't operate Windows with administrator privileges for routine tasks. A standard user account prevents many installers from making system-wide changes without explicit authorization through UAC prompts, giving you an extra opportunity to block unwanted installations.
- Review installed programs monthly. Open Settings > Apps > Apps & features (Windows 10/11) or Control Panel > Programs and Features (Windows 7/8) and scan the list for unfamiliar entries. Uninstall anything you don't recognize or didn't intentionally install — PUPs often accumulate over time through multiple bundled installers.
Bring It In
Manual removal of KickMumViaLive and its bundled companions can take several hours even for experienced users, and missing a single scheduled task or registry key means the infection simply reinstalls itself overnight. At Computer Repair Roswell, we've cleaned hundreds of adware infections and know exactly where these programs hide their components. We use professional-grade removal tools alongside manual cleaning techniques to ensure complete eradication, then verify your system is truly clean before handing it back. Most adware removals complete the same day you bring the machine in, often while you wait if you arrive early in our business hours.
Our shop is located at 1650 Market Boulevard, Suite 110 in Roswell, Georgia — easy to find right off the main road with plenty of parking. We're open Monday through Friday and can usually accommodate same-day appointments for malware removal. Call us at (770) 667-9487 to describe what you're experiencing, and we'll give you an honest assessment of whether this is something you can tackle yourself or whether professional cleaning makes more sense for your situation. Whether you're dealing with browser hijackers, ransomware, or mystery slowdowns that might indicate infection, we're here to get your computer back to normal without the frustration of trial-and-error troubleshooting.