HELP, ADS EVERYWHERE!

[archmage94]

Since I don't know where to put this I decided to post it here, I need help, I am getting ads everywhere, and I know you will say adware but here's the thing, I never installed anything, this just started happening out of the blue, I updated some existing stuff but other than that I haven't installed anything new, and I did check my DNS settings (Yes some of the ads I get are pop-ups by DNS Unlocker) I have tested it on both Chrome and IE, I am running an ad blocker on Chrome, I do have Avast installed to, I have tried every possibility, the ads however seem selective on what sites they hit me on, I don't get it on any Google sites (Google.com, Youtube, etc), fanfiction.net, Amazon, Wikipedia, Facebook or here on VC however I do get it on the Minecraft Forums, the Elder Scrolls Nexus, and just about everywhere else

[Agelyk]

you have tried with another blocker as Ublock (https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?utm_source=chrome-app-launcher-info-dialog) ?

[archmage94]

Well it worked for my on the Elder Scrolls Nexus but I still seem to get ads on the Minecraft Forums

[Agelyk]

You've only tested with chrome and firefox not?

[archmage94]

I don't use Firefox, and every once in a while it automatically opens this page in a new tab: http://gamezonenews.net/, the tab heading says Assassin's Creed Syndicate followed by a bunch of russian

[Agelyk]

the page you say I get as "spam":sad:

[A Guy]

Try running AdwCleaner, see what it finds

http://www.bleepingcomputer.com/download/adwcleaner/

A Guy

[Mr GRiM]

Check to see what adons are installed in chrome and disable or delete any you are unsure of, I always run JRT (https://www.malwarebytes.org/junkwareremovaltool/) (Junkware Removal Tool by Malwarebytes) and TFC (http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/) (Temp File Cleaner by OldTimer) as well as Malwarebytes and that keeps everything running pretty good, also a good idea to check your "Programs and Features" and sort it by installed on and make sure there is nothing installed that wasn't meant to be.

[AlphaOmega]

I use adw cleaner to check for any infection as "AGUY" suggested.If by clicking on your page brings you to a different site instead,then your getting redirects.Usually a sign of adware/spyware/malware..etc,but not necassarily always true.As MR Grimm said,check your programs to be sure you haven't any rogue programs.Sometimes when just getting into a site,it will do a "drive by install",installing a program without your permission or knowledge.Running malwarebytes should find the problem.Be sure to have "scan for rootkits" checked off in the general settings.clear your history...etc.basically what everyone else said..lol

[AlphaOmega]

speaking of cleaning your history.I never knew this existed..lol.seems you have more then "one" history through google :(
this one keeps a log of "EVERYTHING"! web and app activity,voice and audio activity,device info,location history,youtube watch history,youtube search history..etc.you can delete it all right there though.don't know why i never noticed it.god only knows what else they are watching you do.seems to be the only drawback with chrome.They are so invasive.You literally have no privacy.









715987159971600

[AlphaOmega]

And here is the page to control google ads.Never seen this before either i guess..lol.
P.S...and i just turned them "ALL" off.they were all on.









7160171602

[Harvey Sewdin]

speaking of cleaning your history.I never knew this existed..lol.seems you have more then "one" history through google :(
this one keeps a log of "EVERYTHING"! web and app activity,voice and audio activity,device info,location history,youtube watch history,youtube search history..etc.you can delete it all right there though.don't know why i never noticed it.god only knows what else they are watching you do.seems to be the only drawback with chrome.They are so invasive.You literally have no privacy.


Yeah, allot of the major sites track nearly everything you do on their domain. Even simple auto-completed searches gets saved(since you typed it in).
There is allot going on behind the scenes..

[2635599]

archmage94 (http://virtualcustoms.net/member.php/279377-archmage94) the above suggestions are pretty good. here's what i have. chrome latest always logged in. as for google i never login unless i want to cleanup my mailboxes(i use outlook for my mail). i suggest never going through your mail online(in your Browser). once a week i check my addons and get rid of anything that might have been added without permission. adblock plus is the adblocker i use. my main browser is cyberfox, but i have chrome for those few pages that firefox and it's forks like cyberfox can't handle. i have ccleaner and use it to clean the browser after i exit the browser. awdcleaner is great to run once a week along with malwarebytes. there is also zemana which you can get a 90 day key for or join their beta program(don't remember how long the key is on the beta program). i suggest you check the chrome store for a redirect blocker. and lastly fvd speed dial. it's nice cause you can backup both speed dials and your bookmarks. i recently had something in chrome that i could not get rid of, so i uninstalled chrome, created a new gmail/google account just for use with chrome, signed in, went to the chrome store and got fvd speed dial and my other addons back and was problem free once again. never been fond of chrome cause it eats too many resources, but for ease of getting rid of malware or a virus in it it is FAR easier to cleanup than firefox or it's fork projects.

[2635599]

Yeah, allot of the major sites track nearly everything you do on their domain. Even simple auto-completed searches gets saved(since you typed it in).
There is allot going on behind the scenes..

i have in ie, chrome, cyberfox autocomplete and save username and password turned off. personal opinion very bad idea to use them.

[AlphaOmega]

time to switch to another browser.

[archmage94]

I ran Adw CLeaner, I checked my installed programs, the only addons I have installed are Avast Online Security, Stylish, 2 ad blockers (Ad block and uBlock Origin and Hangouts, I even went through and deleted my add-ons then got them back. The only thing AdwCleaner picked up was some Cookies that these ads saved in Chrome, if it helps one of these cookies says Best Price Ninja which I have read is an adware program but I have no other sign of it on my PC

[AlphaOmega]

I ran Adw CLeaner, I checked my installed programs, the only addons I have installed are Avast Online Security, Stylish, 2 ad blockers (Ad block and uBlock Origin and Hangouts, I even went through and deleted my add-ons then got them back. The only thing AdwCleaner picked up was some Cookies that these ads saved in Chrome, if it helps one of these cookies says Best Price Ninja which I have read is an adware program but I have no other sign of it on my PC

if you are getting the same ads in internet explorer when you go to the same site,then it is NOT your browser.If it just happening in chrome then i could understand that it is a possibility of a browser issue.I would personally run malwarebytes if you have it (if not,download it).If it is doing it in both browser's,it sounds more like spyware/adware/malware somewhere on your computer.Just my opinion.

[AlphaOmega]

If you can not find the problem,try tech support here,it's free and they are very good at what they do>>> https://techguy.org/

P.S...you must first sign up before you can post a thread in their forum.Be patient,they will get back to you.If you need any help maneuvering the site or any other questions,feel free to ask.

[Agelyk]

if you are getting the same ads in internet explorer when you go to the same site,then it is NOT your browser.If it just happening in chrome then i could understand that it is a possibility of a browser issue.I would personally run malwarebytes if you have it (if not,download it).If it is doing it in both browser's,it sounds more like spyware/adware/malware somewhere on your computer.Just my opinion.

I would recommend that you changed avast by Wot (https://chrome.google.com/webstore/detail/wot-web-of-trust-website/bhmmomiinigofkjcapegjjndpbikblnp) (that is 100% better) and do not use 2 blockers for you will cause conflicts, and stay away from chrome ....
There are several very good or better than the chrome browser, which also support chrome extensions

[2635599]

I would recommend that you changed avast by Wot (https://chrome.google.com/webstore/detail/wot-web-of-trust-website/bhmmomiinigofkjcapegjjndpbikblnp) (that is 100% better) and do not use 2 blockers for you will cause conflicts, and stay away from chrome ....
There are several very good or better than the chrome browser, which also support chrome extensions

if the problem is just in chrome it will follow to a new browser based on chrome if he signs in with the same account in the new browser. i know this for a fact. i got something only in chrome and it ended up with it in torch, if he wants to continue to use chrome i'd suggest do the full c drive malwarebytes scan with check for rootkits checked, a full virus scan of c, run awdcleaner and ccleaner. if the first 3 say nothing found then it is in chrome and the best way to purge it is to either signout of the current account and create a new account and go get you addons back under that new account or completely uninstall chrome and reinstall it. i run ccleaner every time i exit a browser. as for ad blocking i agree no need for 2. i'd suggest adblock plus.

[Agelyk]

Here are some alternatives to the browser chrome (https://www.google.com/chrome/browser/desktop/):

1 Uc Browser (http://pc.ucweb.com/) (I use it now) → 90% compatibility with Chrome Extensions
2 Baidu (http://en.browser.baidu.com/) → 100% compatibility with Chrome Extensions
3 Vivaldi (https://vivaldi.com/) → 95% compatibility with Chrome Extensions
4 Maxthon (http://es.maxthon.com/) → It has its own extensions
5 Firefox (https://www.mozilla.org/es-ES/firefox/new/) → will soon bear some chrome extensions

[dhjohns]

You need to go into every adblocker you have in the options, and disallow unobtrusive ads.

[2635599]

You need to go into every adblocker you have in the options, and disallow unobtrusive ads.

that is a matter of choice.

[dhjohns]

that is a matter of choice.Of course it is. Running adblockers themselves is a matter of choice, but if you want no ads, this is what you do. There is also

http://winaero.com/blog/block-ads-in-microsoft-edge-browser-project-spartan/

(http://winaero.com/blog/block-ads-in-microsoft-edge-browser-project-spartan/)which will remove ads everywhere including Windows Modern Apps.

[AlphaOmega]

Of course it is. Running adblockers themselves is a matter of choice, but if you want no ads, this is what you do. There is also
http://winaero.com/blog/block-ads-in-microsoft-edge-browser-project-spartan/which will remove ads everywhere including Windows Modern Apps.


dont know anything about microsoft edge,but after going to that website you posted,reading the tutorial and then all the user comments...im all set with windows edge..lol.anyone creating or modifying a host file or making changes to the registry may be asking for trouble especially if you have no idea what your doing.And all that just to block ads? There must be another way.By looking at the user comments,(some good,some bad) i would personally stay away from that option.But that is only my opinion.if it works for you,go for it. There are ah few things i would like to say to microsoft but i will keep it to myself..lol.
I just can not imagine why there is not an easier way that really works..hmmmm

[dhjohns]

dont know anything about microsoft edge,but after going to that website you posted,reading the tutorial and then all the user comments...im all set with windows edge..lol.anyone creating or modifying a host file or making changes to the registry may be asking for trouble especially if you have no idea what your doing.And all that just to block ads? There must be another way.By looking at the user comments,(some good,some bad) i would personally stay away from that option.But that is only my opinion.if it works for you,go for it. There are ah few things i would like to say to microsoft but i will keep it to myself..lol.
I just can not imagine why there is not an easier way that really works..hmmmmIt is simple, easy, and just works. What more could you ask for? Plus, if Microsoft didn't want you to modify it, why would they have a registry. Actually, you do not even need to modify the registry for this to work. That is optional.

[AlphaOmega]

It is simple, easy, and just works. What more could you ask for? Plus, if Microsoft didn't want you to modify it, why would they have a registry. Actually, you do not even need to modify the registry for this to work. That is optional.

I understand it is simple..( for you and i and some others),but not all are so tech savvy,or should i say even know what a host file is or the registry for that matter.And manipulating or changing anything in the registry can be hazardous if you don't know what you are doing.By reading the comments,it seems as though you would almost HAVE to modify the registry.Creating the host file seems to slow things down.Atleast that's what i gather from what i read aniyway.im not saying this does not work,im just saying you would think there would be an easier way.Like just a damn block button..lol good grief.

[dhjohns]

I understand it is simple..( for you and i and some others),but not all are so tech savvy,or should i say even know what a host file is or the registry for that matter.And manipulating or changing anything in the registry can be hazardous if you don't know what you are doing.By reading the comments,it seems as though you would almost HAVE to modify the registry.Creating the host file seems to slow things down.Atleast that's what i gather from what i read aniyway.im not saying this does not work,im just saying you would think there would be an easier way.Like just a damn block button..lol good grief.Extensions will be forthcoming in rs1.

[archmage94]

Well I tried testing in Internet Explorer and yes I do get these ads there to, but like I said these ads seem to avoid any Google sites (Youtube, Google.com, etc) and uBlock seems to block them on the Elder Scrolls Nexus

Edit: I ran MalwareBytes and of course it picked up those cookies I mentioned as Potentially Unwanted, but it also picked up the cracked Steam_api.dll file in my Rayman Legends folder as Malware, as well as my Cheat Engine table for Sonic Lost World, and I trust Cheat Engine and I did an Avast scan of Rayman Legends and it didn't pick up anything, it also picked up a couple stuff as unwanted that i've been running for a while and they have not given me any issues, but to make sure I will run CCleaner for any sign of this DNS Unlocker

[AlphaOmega]

[QUOTE= but to make sure I will run CCleaner for any sign of this DNS Unlocker[/QUOTE]

so i searched "DNS Unlocker" and it brought me to this site>> https://malwaretips.com/blogs/ads-by-dns-unlocker-removal/
ads out the bungholio!!!..lol.maybe you should uninstall it and see what happens.Then run Ccleaner again to get any left overs.clear your google history and internet explorer history.remove any add ons..etc in both chrome and explorer.Then see what happens.If it still happens,you could always just reinstall it.Not that i would recommend it though..lol.by reading what was on that website,i would steer clear of it.your choice though.

[archmage94]

so i searched "DNS Unlocker" and it brought me to this site>> https://malwaretips.com/blogs/ads-by-dns-unlocker-removal/
ads out the bungholio!!!..lol.maybe you should uninstall it and see what happens.Then run Ccleaner again to get any left overs.clear your google history and internet explorer history.remove any add ons..etc in both chrome and explorer.Then see what happens.If it still happens,you could always just reinstall it.Not that i would recommend it though..lol.by reading what was on that website,i would steer clear of it.your choice though.

I don't have any sign of DNS Unlocker on my computer, I checked in both the control panel and CCLeaner, and you see, I never use Internet Explorer, all I used it for was downloading Chrome, I don't have any bad add ons installed to Chrome but somehow I still get ads by this DNS Unlocker and this Best Price Ninja is one of the adware programs generating the cookies that Malwarebytes and AdwCLeaner pick up in my Chrome files, no matter how many times I delete them they come back to

[AlphaOmega]

with that said,i am almost positive your infected.Sounds like it may be in your registry and thats why it may reactivate itself upon reboot.Malwarebytes is only deleting the cookie.However,i would do a rescan with malwarebytes.when it finds the cookie,follow the path manually and see where the cookie is located.Delete it manually.If the cookie has a specific name,do a search for that name within your computer.If you find nothing,try searching for it in your registry if you feel brazen.If you find it in the registry and your not sure how to delete it,please ask and im sure someone here can help you.you should also do a search for "dns unlocker" even though you didnt install it,it could be hiding in your computer without your knowledge.

[archmage94]

Every time I try to delete the files whatever virus is causing this keeps adding them back, right now I am searching the registry, hard to search "ninja" (Which is among the names on the cookies) when I have a crapload of Fruit Ninja Registry files

[dhjohns]

I would run malwarebytes in safe mode, then restart, and run it again in safe mode.

[Mr GRiM]

I would also check your C:\ProgramData folder, I have found malware to infect this folder in the past that would keep reinfecting the system, maybe also check your startup folder and Task Scheduler.

[dhjohns]

Or you could just format, and reinstall.

[archmage94]

I would also check your C:\ProgramData folder, I have found malware to infect this folder in the past that would keep reinfecting the system, maybe also check your startup folder and Task Scheduler.

Are Malware folders usually identified by random numbers cause I checked and I found 2 folders that are just a bunch of random letters and numbers in place of the name, same with the files inside the folders, and each one contains 1 file, and the file names for each one seems to much up almost exactly except for a couple numbers and letters, and both of these files were last modified on the 3rd, which if i'm right happens to be when this problem started

[Mr GRiM]

Are Malware folders usually identified by random numbers cause I checked and I found 2 folders that are just a bunch of random letters and numbers in place of the name, same with the files inside the folders, and each one contains 1 file, and the file names for each one seems to much up almost exactly except for a couple numbers and letters, and both of these files were last modified on the 3rd, which if i'm right happens to be when this problem started

Move the folders to the desktop if you are unsure if they should be deleted, then see if that solves your problem with them coming back.

[A Guy]

You can always upload any suspicious file to Virus Total for analysis by 55 antivirus/antimalware programs. I use the VT Uploader, easy as right click> Send to> VT

https://www.virustotal.com/en/documentation/desktop-applications/

There can be legit programs that make random character names as well. If the major programs do not find your issue, try posting at one of the major certified malware removal forums. DO follow their instructions, DO NOT run programs such as Combofix on your own

http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/

A Guy

[archmage94]

Also I should mention AdwCleaner picks this up under the Files tab: C:\WINDOWS\SysNative\drivers\swdumon.sys

Now I did do some research and I know what that file is supposed to do but what's up with that file path? There is no SysNative folder in my Windows Folder, unless it's how AdwCleaner refers to my System32 folder

Update: I'm not really sure how but I am happy to report that the ads seem to have just stopped, just randomly stopped, I don't know how and i'm not complaining, whatever is happening is still generating these Chrome cookies, I was using the Minecraft forums as my testing ground cause I was still getting ads there but they aren't doing anything now, just stopped out of the blue, I don't think it was any adware at all, cause I just tested with and without my ad blocker and without it I still get the aformentioned ads but with my ad blocker on it's fine, I don't think it was on my computer, my ad blocker just needed to update

[AlphaOmega]

[QUOTE=There can be legit programs that make random character names as well. [/QUOTE]

I agree.moving the file to another location or deleting it when you have no idea what it is could corrupt the software that made the file.I have ah few of these on my computer.Some are just empty files/folders with random characters.But they belong to some software i downloaded.I have made the mistake ah few years back of deleting ah folder that i thought was suspicious only to find out that it was part of a legit program.needless to say i had to uninstall/reinstall the program.Now i just scan the file with virus total before taking any drastic action.

[AlphaOmega]

Also I should mention AdwCleaner picks this up under the Files tab: C:\WINDOWS\SysNative\drivers\swdumon.sys

Now I did do some research and I know what that file is supposed to do but what's up with that file path? There is no SysNative folder in my Windows Folder, unless it's how AdwCleaner refers to my System32 folder


swdumon.sys should be in this directory>>> C/Windows/System32/Drivers Folder.If it is not then i would scan that particular file (swdumon) with virus total just in case it is not legit.

[Agelyk]

Also I should mention AdwCleaner picks this up under the Files tab: C:\WINDOWS\SysNative\drivers\swdumon.sys

Now I did do some research and I know what that file is supposed to do but what's up with that file path? There is no SysNative folder in my Windows Folder, unless it's how AdwCleaner refers to my System32 folder

Update: I'm not really sure how but I am happy to report that the ads seem to have just stopped, just randomly stopped, I don't know how and i'm not complaining, whatever is happening is still generating these Chrome cookies, I was using the Minecraft forums as my testing ground cause I was still getting ads there but they aren't doing anything now, just stopped out of the blue, I don't think it was any adware at all, cause I just tested with and without my ad blocker and without it I still get the aformentioned ads but with my ad blocker on it's fine, I don't think it was on my computer, my ad blocker just needed to update

I think you said you had 2 blockers hang time,i recommend you to stay one.
Having 2 blockers at once is like having two antivirus, you will cause more conflict between them :sad:

[archmage94]

Uhm no i'm not having any conflicts and both of them running at the same time is blocking these ads