HELP!. Random pop-ups?

Discussion in 'Computer Games and General Discussion' started by Splych, Jan 29, 2010.

  1. Splych
    OP

    Splych GBAtemp's Lurker

    Member
    2,953
    5
    May 19, 2008
    Canada, Ontario.
    I start firefox, just browsing your average sites.

    Then it automatically makes a new tab and then some random site comes in?

    Is this malware, virus, spyware?

    I have Malware Bytes and avast! installed on my computer. I am gonna scan my whole computer, but am not sure what else could be causing this...
     


  2. XWolf

    XWolf GBAtemp Advanced Fan

    Member
    745
    1
    Oct 9, 2009
    What web browser? Or are they system windows?
     
  3. Snorlax

    Snorlax POSTMODERNISM

    Member
    588
    2
    Apr 26, 2008
    Australia
    If you're getting popups from websites which don't usually cause them, I'd recommend doing a full system scan, deleting your cookies, clearing temporary internets, and maybe reinstalling Firefox.
     
  4. ProtoKun7

    ProtoKun7 GBAtemp Time Lord Regenerations: 3

    Global Moderator
    7,506
    1,547
    Jan 3, 2009
    Gallifrey
    I've never heard of it, but maybe [​IMG]
     
  5. CannonFoddr

    CannonFoddr Regular GBATemp Lurker

    Member
    4,109
    65
    Sep 23, 2006
    Sitting by computer
    Does the tabs open when you visit the same websites ?? or is it any website
    Are the 'random sites' shown in the popup of a particular 'type' (eg Adult/Gambling etc)

    Some websites once loaded can cause new 'windows' to pop up to advertise other sites (occasionally one site I visit causes a 'pop-under' when I download files from it)

    Also check your 'popups' option in firefox (Tools > Option > Content) make sure it's ticked & that there's nothing in the 'exceptions'

    Another option is to download & install 'Adblock Plus' plugin for Firefox - this helps block quite a few sites as well. You can also add to the plugin any 'popup' that slip through to prevent them from coming up again
     
  6. Davess

    Davess On the list :D (Thanks Haflore)

    Member
    693
    4
    Mar 15, 2009
    Canada
    __________________ Posts: 9326
    [​IMG]

    I get this too, When downloading From Megaupload, If not

    Maybe a new Virus?
    [​IMG]
     
  7. prowler

    prowler Sony

    Member
    9,473
    2,816
    Jul 14, 2009
    Ragol
    Can you tell normal adverts apart?
    When you click download on MU it pops up an advert (which is normal, even adblocker plus cant block it)
     
  8. Hatsu

    Hatsu Someone's been killing, eh?

    Banned
    2,143
    0
    Oct 19, 2009
    __________________ Warn: 50%
    Same here. [​IMG]
     
  9. CannonFoddr

    CannonFoddr Regular GBATemp Lurker

    Member
    4,109
    65
    Sep 23, 2006
    Sitting by computer
    Come to think of it - that's one of the site I frequent & get a popup - but it doesn't usually open another tag - it actually open a new Firefox/window
     
  10. Splych
    OP

    Splych GBAtemp's Lurker

    Member
    2,953
    5
    May 19, 2008
    Canada, Ontario.
    It's not a new window. It's more like it creates a new tab in my web browser while i am surfing the web.

    After that, it just directs me to some random sites.

    For example:
    - New Tab is created [automatically. I don't choose to open a new tab]
    - in URL Bar, this link is shown: http://doomkorea.com/search.php
    - URL changes and becomes: http://r.looksmart.com/og/pr=Psr;ro=1;rc=1....com%20virus%2F.

    It clearly says VIRUS at the end of that link, but I don't know how to get rid of it. I have just installed Spy-Bot S&D. I used Malware Bytes to do a scan, nothing was found. avast! is scanning right now and detected a few things in my System Volume Information [I think that's the name of the area. When it comes up again, i will tell you guys where it is].

    Spy-Bot S&D detected a few malwares and so I deleted those. Now I am waiting for avast! to finish it's scan.

    One more thing, I am running Windows 7 Ultimate [I got it another way. Not the average way where you go to a store and buy it xD. Think of it as Arrrr]
     
  11. Skyline969

    Skyline969 MENUdo Afficionado

    Member
    2,206
    8
    Nov 18, 2008
    Canada
    Saskatchewan
    Pirate Windows 7 shouldn't matter, provided you used a good activator.
    Now then, make sure you're NOT on the internet (in fact, disable your wireless and remove your ethernet cable) when scanning. After each scan (and removal), reboot your computer. That way, you'll get the viruses and they'll stay off.
     
  12. CannonFoddr

    CannonFoddr Regular GBATemp Lurker

    Member
    4,109
    65
    Sep 23, 2006
    Sitting by computer
    I took a gamble & clicked on those 2 links Splych gave-
    • The first didn''t do any popups redirect etc
    • The second gave a warning from the WOT (Web Of Trust) firefox plugin I have
    Found out that it goes to a website called 'comparedby.us' which is 'untrustworthy'

    Did a google search for Browser redirects to this site & found this article, although he says he get redirects but not popups
    And guess what - there's a fix as well - see right at the end of the post - so if all else fails, perhaps this could cure it (I've even read that a complete uninstall/reinstall of Firfox can also cure this)

    Out of curiousity - does it happen in IE ?? If not - it does sound like a Firefox only infection
    EDITED: I've downloaded the fix & got it scanned by http://www.virscan.org/ (which check individual files againt 36 antivirus programs) and it's got a clean bill of health [Results]
     
  13. playallday

    playallday Group: GBAtemp Ghost

    Member
    3,773
    9
    May 23, 2008
    Canada
    [@N@[)@
    It's a virus/ad-ware. I'm 100% sure.
     
  14. XWolf

    XWolf GBAtemp Advanced Fan

    Member
    745
    1
    Oct 9, 2009
    Sorry, missed the Firefox bit.

    Have you tried - the noscript add-on for Firefox?
     
  15. Splych
    OP

    Splych GBAtemp's Lurker

    Member
    2,953
    5
    May 19, 2008
    Canada, Ontario.
    Redirects could probably be what I am trying to say. It just opens a new tab and then inserts a link.
    And no, I never use IE. I could try leaving it idle and see if the link comes in, but after I do a scan. I downloaded that fix, so imma try it now.

    EDIT: I tried Goored. Nothing.
     
  16. fgghjjkll

    fgghjjkll GBATemp MegaMan

    Member
    GBAtemp Patron
    fgghjjkll is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    2,041
    42
    Jul 7, 2008
  17. CannonFoddr

    CannonFoddr Regular GBATemp Lurker

    Member
    4,109
    65
    Sep 23, 2006
    Sitting by computer
    What do you mean 'Nothing' - it didn't run / didn't scan / didn't find anything / didn't clean anything - What ??

    When you double-click it you should've got message of 'Gooredfix will automatically check and remove infection....blah blah blah' & you click either [Yes] or [No]
    A DOS box should've popped up & when programs finished you then should've got Notepad open up with a log file (You also should've got a folder & a TXT file on your desktop)

    If all that happened & nothing was cleaned - then you haven't got that type of problem with firefox
    (It was worth a try anyway)
     
  18. Davess

    Davess On the list :D (Thanks Haflore)

    Member
    693
    4
    Mar 15, 2009
    Canada
    __________________ Posts: 9326
    well, Either a new tab, Or when the Computer sloaw, A whole new window

    Btw. Google Chrome

    Davess
     
  19. FAST6191

    FAST6191 Techromancer

    pip Reporter
    22,918
    8,598
    Nov 21, 2005
    I am still not entirely sure why people like scanners- they have not been good as anything other than a first line of defence for many years now.

    Grab something like a-squared HiJackFree (although the advanced mode of spybot is also not bad) from:
    http://www.emsisoft.com/en/software/download/ (scroll down). This will enable you to see exactly what is going on or indeed summon a basic list for one of us to scan through.
    If you want to get really advanced http://technet.microsoft.com/en-us/sysinte...s/bb896645.aspx
    http://www.nirsoft.net/utils/opened_files_view.html (indeed http://www.nirsoft.net/utils/index.html has loads of nice apps).
    Be warned that the last couple of times I had to deal with something like this not even a trip to basic safe mode would fix it- I needed to go manual removal from another OS or a manual bootup (takes ages). I seem to remember the spybot people made a nice blocker/shield that would stop changes ("delete" on early boot and before most AV/malware heuristics and scanners become active is a reasonably popular tactic).

    Browser should not matter if the thing causing your troubles uses an API common to windows rather than trying to force IE (it is usually a mark of bad coding/not knowing apis that IE gets opened like this).
     
  20. Hakoda

    Hakoda GBAtemp Addict

    Member
    2,133
    2
    Feb 2, 2008
    United States
    San Jose, CA
    Sounds similar to Google Search Engine virus I had. Kept redirecting me every time I clicked a search in Google.

    Check your hosts file. There may have been strings added by a virus which your AV removed but the strings still exist. Follow these steps:

    1) Open Notepad as an Admin
    2) Click Open & browse to C:/Windows/System32/drivers/ect
    3) Select to see "All Files" in the drop down menu from the "Open File" dialog box
    4) Click Hosts
    5) Should look like this.

    If there's anything else delete it but you MUST have the 127.0.0.1 localhost line. Unles there are lines that you know are suppose to be there... (like when you pirate Photoshop CS4, there are blacklist URLs there or you'll get caught...)

    Good Luck.

    ~ Jon