PDA

View Full Version : How do I remove these annoying pop-ups?



EFFIGY
21-02-2014, 12:33 PM
Every time I click a link I am taken here:
http://fixbonus.com/lp7/

I have run Spy-bot and Security Essentials and nothing picks it up. I know it is associated with Wordpress, and I am fairly certain that is where I picked it up from. Does anyone have any idea what I can do to remove this? None of the online suggestions I have read seem to work.

I am using Chrome browser on Windows 7.

Webdevguy
21-02-2014, 12:44 PM
Clear your cache. The website will have deposited some malicious cookies in your browser.

Greg
21-02-2014, 12:58 PM
Block the address in your Hosts file.

EFFIGY
21-02-2014, 12:59 PM
Clear your cache. The website will have deposited some malicious cookies in your browser.

That didn't work.:(

EFFIGY
21-02-2014, 01:02 PM
Block the address in your Hosts file.

How do I do that?
Please.

wainuitech
21-02-2014, 01:07 PM
Try running adwcleaner download/adwcleaner/ (http://www.bleepingcomputer.com/download/adwcleaner/) While on that page scroll down to bottom and get /run Junkware Removal Tool.


Blocking it in the host file isn't fixing /removing the problem its only masking it.

Lurking
21-02-2014, 01:17 PM
A bit like Adaware thought I would try it and it changes everything to it's own liking. Got rid of it smartly and had to re-organise all browsers'.

Lost Stylish for PressF1, luckily Erayd's copy of his txt file had been saved and PressF1's ads have now disappeared.

What has happened to Erayd ?.

Lurking.

Ps. have you tried CCleaner that gets rid of a lot of crap.

lurks.

wainuitech
21-02-2014, 01:38 PM
A bit like Adaware thought I would try it and it changes everything to it's own liking. Got rid of it smartly and had to re-organise all browsers'.

. If you are referring to Adware remover and other such programs the legit ones put settings back to system defaults.

Only Rouge programs or ones where they have allowed other parties to add in "Their stuff" set their own settings. Many of those types of popups alter reg files and such. Blocking in the Host does naff all, as soon as the address changes popups back again.

EFFIGY
21-02-2014, 01:41 PM
Nothing works. Not;
Spybot
Adaware
Adwcleaner
Crap Cleaner
Cache removal
Delete Browsing Data
Microsoft Security Essentials
Malicious Software Removal Tool
Junkware Removal Tool


Going to try MALWAREBYTES now

wainuitech
21-02-2014, 01:46 PM
Try hitmanpro (http://www.surfright.nl/en/hitmanpro) Failing that you can also run TFC (http://www.bleepingcomputer.com/download/tfc/) Is a little like Ccleaner, but gets into the temp files a lot deeper than Ccleaner.

Also in Ccleaner if you have only just gotten this pop up ( today) open Ccleaner go to options /Advanced and UNTICK the box "Only Delete files in Windows Temp Folders older than 24 hours"

Don't know why they made that one a default, its leaves everything from the last 24 hours :illogical

You may have to reset your browsers as well, instructions at the bottom of the following page for various Browsers:remove-exclusive-bonuses-popups-ads/ (http://www.fixyourbrowser.com/removal-instructions/remove-exclusive-bonuses-popups-ads/)

EFFIGY
21-02-2014, 02:08 PM
OMFG! It survived my deleting the user data for Chrome! Now I am #$%*((*%$#@!! mad.

I am imagining some interesting things to do with pins, water and extreme heat - all performed really slowly - what kind of people make this crap? Give me a week with one chained to a chair.

System Restore?

Speedy Gonzales
21-02-2014, 02:16 PM
Look in programs and features / add / remove programs. See if there are any programs in there, that shouldnt be there

If there is uninstall them

wainuitech
21-02-2014, 02:16 PM
Wouldn't be at all surprised if its gotten into the reg files someplace.

System restore may work, then again it may just go along for the ride.

EFFIGY
21-02-2014, 02:18 PM
Look in programs and features / add / remove programs. See if there are any programs in there, that shouldnt be there

If there is uninstall them

That was the first thing I did.

EFFIGY
21-02-2014, 02:19 PM
Wouldn't be at all surprised if its gotten into the reg files someplace.

System restore may work, then again it may just go along for the ride.

If it is in the reg files....how do I find it?

Speedy Gonzales
21-02-2014, 02:25 PM
Run teamviewer, if it's installed. I'll have a look if you want

EFFIGY
21-02-2014, 02:41 PM
Run teamviewer, if it's installed. I'll have a look if you want
Ok....Team viewer is running.... what do I do?

Speedy Gonzales
21-02-2014, 02:42 PM
give me the ID and password it gives you in a PM

EFFIGY
21-02-2014, 02:46 PM
give me the ID and password it gives you in a PM
sent

Speedy Gonzales
21-02-2014, 02:56 PM
pw is wrong

Speedy Gonzales
21-02-2014, 04:46 PM
Looks like it had 3 PUP's, Opencandy and 1 Softonic.A pup. This may have been installed with some free program. Dont know IF it fixed the popup tho. Just rebooted it.

EFFIGY
21-02-2014, 04:54 PM
Its still here :|

Speedy Gonzales
21-02-2014, 04:57 PM
Give me another pw. I'll see if clearing the cache etc fixes it

EFFIGY
21-02-2014, 04:58 PM
use the same one

Greg
21-02-2014, 05:48 PM
How do I do that?
Please.It's a bit longwinded to explain, but this page (http://www.howtogeek.com/howto/27350/beginner-geek-how-to-edit-your-hosts-file/) shows it's relatively easy. The important thing to remember is that when you overwrite your old Hosts file, is to save it as "All files", ie NOT as a .txt file, ie save as hosts, not hosts.txt.

Get a new hosts file from here (http://someonewhocares.org/hosts/), copy it and save it to the Notepad you've opened. But of course before you save it, at the location as explained add the extra line 127.0.0.1 http://fixbonus.com/lp7 or 0.0.0.0 http://fixbonus.com/lp7.

The added benefit of putting in that pre-made file is that it'll wayyy improve your browsing speed by blocking 3rd party adverts from all the sites listed.

Let us know how you get on.

PS - you may have to Show Hidden files and System files in your Folder Options in Control Panel first.

Speedy Gonzales
21-02-2014, 06:07 PM
Hmm may have found the prob. Some HD video plugin somehow got added to Chrome's extensions. Effigy has no idea how it got there. But I disabled it the extra screen didnt appear. Enable it again it turns up. We'll just wait for maybe a day and see if it returns (altho I closed chrome 5-6 times) and it didnt reappear when I disabled this extension / I've now deleted it

Dont know if adding sites to the hosts file with Spybot is a good idea. I've heard the more sites you add the slower browsing can get.

EFFIGY
21-02-2014, 06:41 PM
A big thank you to Speedy. Many scans and trials later we (fingers crossed) have isolated it to a HD plugin that seems to have installed itself via a visit to Wordpress. I did some Googling and it seems Wordpress has a bit of a history of this sort of thing. Much as I have enjoyed the Blogs I follow there I'm not sure that I am prepared to loose another afternoon. I have notified the owner of the blog concerned via Facebook.

wainuitech
21-02-2014, 06:55 PM
Well done speedy :thumbs: Its always easier when you can actually see whats on a computer and can see settings. Did you actually remove it as well as disabling ?

Bit surprised JRT didn't pick up the add-on though, its usually damn good at picking those, unless its a new one that hasn't yet been added.

Speedy Gonzales
21-02-2014, 07:05 PM
Ta :) Yup, I've deleted it under extensions in chrome now. Couldnt see anything else (that maybe nasty) in programs and features to uninstall. Was going to update flash, but since it updates automatically on his system, I see it's up to date now.

One thing I did see I think I saw it in malwarebytes, or adwcleaner. It has quarantined freecodecs. Effigy, be careful WHAT codecs you install. There are dodgy codecs installs out there. And they WILL install malware