Last week, for the first time ever, I installed Chromium Secure because Firefox had become too slow due to all the extensions I had installed. CS was obviously much faster however, after installing only a few basic extensions I began getting non-stop adware pages opening with an accompanying “Pop, Pop, Pop” sound. Some are for dating sites, some are for porn, while others are for gaming sites.
Desperate to stop this, I ran a full virus scan with CIS and a malware/threat scan with MalwareBytes Pro. Neither found anything. I am guessing the issue comes from one of the extensions I have installed. If I list them here, would anyone be able to tell if there are known adware issues with any of them?
For the time being I have returned to Firefox as that has never caused problems thanks to the NoScript extension.
Best option is to remove them one by one until it stops and you find the culprit.
Totally remove or just disable?
Disable should be enough to find the culprit extension, if an extension is the culprit.
Well I am sorry to say this but at the moment it appears to be PrivDog because the pop-ups seem to have stopped since disabling that. Should I remove it totally?
PrivDog shouldn’t be causing the described problems, not sure why disabling it fixed it, try going into the PrivDog settings and change to block all ads instead replace and see if it still happens, if it does then you can either keep it disabled, it won’t be able to do anything, or remove it altogether.
It’s not PrivDog. I had it disabled and Chromium closed but it just opened all by itself and instantly displayed 3 malware pages. I even have Firefox set as my default browser so lord knows how it managed to open Chromium!
This is a brand new PC with very few programs installed: CIS, MalwareBytes, Firefox, Chromium Secure, Office 2007, Xplorer 2, Rollback Rx, Xara 3D, Your Uninstaller, AnyDVD, and Zoner Photo Studio.
Try scanning with the following scanners to get rid off the malware:
adwcleaner
Hitman Pro
Super Antispyware
let us know if that did the trick for you.
I tried ADWcleaner and it identified AdGuard as being malware but that is in the PrivDog folder. I will try the others tomorrow and post my results.
I haven’t had a chance to try Hitman Pro or Super Anti-spyware yet but I thought ADWcleaner’s log may be of interest:
AdwCleaner v4.111 - Logfile created 02/03/2015 at 18:49:03
Updated 18/02/2015 by Xplode
Database : 2015-03-02.1 [Server]
Operating system : Windows 7 Ultimate Service Pack 1 (x64)
Username : PBC - PBC-PC
Running from : C:\Users\PBC\Downloads\Security\AdwCleaner.v4.1.1.1.exe
Option : Cleaning
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\AdTrustMedia
Folder Deleted : C:\Program Files (x86)\AdTrustMedia
Folder Deleted : C:\Program Files\AdTrustMedia
Folder Deleted : C:\Users\PBC\AppData\Local\AdTrustMedia
Folder Deleted : C:\Users\PBC\AppData\Roaming\AdTrustMedia
File Deleted : C:\Users\PBC\AppData\Roaming\Mozilla\Firefox\Profiles\c8qltuv3.PBC\Extensions\PrivDog@AdTrustMedia.com.xpi
File Deleted : C:\Users\PBC\AppData\Roaming\Mozilla\Firefox\Profiles\kju2kdk1.default\Extensions\PrivDog@AdTrustMedia.com.xpi
***** [ Scheduled tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [PrivDog@AdTrustMedia.com]
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings{FB16E5C3-A9E2-47A2-8EFC-319E775E62CC}
***** [ Web browsers ] *****
-\ Internet Explorer v11.0.9600.17631
-\ Mozilla Firefox v36.0 (x86 en-GB)
[kju2kdk1.default\prefs.js] - Line Deleted : user_pref(“extensions.aniweather.timeShifted”, 666892);
[kju2kdk1.default\prefs.js] - Line Deleted : user_pref(“extensions.trusted-ads.ExLst”, "{"u":{"v":"1.70","d":"032414"},"h":{"pogo.com":{"p":[{"e":"/.*/","r":["/connect\\.facebook\\.net\\/en_US\\/all\\.js$/i"]}]}[…]
[kju2kdk1.default\prefs.js] - Line Deleted : user_pref(“extensions.trusted-ads.list_api”, "{"r":["hxxp://24x7homesecurity.com/","hxxp://8tracks.com/","hxxp://a1supplements.com/","hxxp://aactionair.net/","hxxp://abcnews.go.com/","htt[…]
-\ Comodo Dragon v
AdwCleaner[R0].txt - [9964 bytes] - [20/10/2014 16:06:16]
AdwCleaner[R1].txt - [2177 bytes] - [02/03/2015 18:31:44]
AdwCleaner[S0].txt - [8860 bytes] - [20/10/2014 16:15:16]
AdwCleaner[S1].txt - [2155 bytes] - [02/03/2015 18:49:03]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2214 bytes] ##########