[ｋａ＄ｈ]

Nothing suspicious in my task manger, can you provide a safe download to fabar? I don't feel like getting more adware. The thing that REALLY irks me about this adware is it doesn't target anything else besides hackforums, any other website I've visited had no issues what so ever.

That's what confused me too, im just trying to think where else the issue could lie:

I believe Farbar is portable so it doesn't install anything on your PC, majority of links should be fine: Link

Did you re-run any of the scans?

Because if it continues to find more PUPs, it is either; something is causing them to recreate or you just had a shit tonne of it.

[ze-slade]

That's what confused me too, im just trying to think where else the issue could lie:

I believe Farbar is portable so it doesn't install anything on your PC, majority of links should be fine: Link

Did you re-run any of the scans?

Because if it continues to find more PUPs, it is either; something is causing them to recreate or you just had a shit tonne of it.

haven't gotten the chance, I'll do it tomorrow because I'm about to head to bed.

FRST: http://pastebin.com/8KKfv4WL

Addition: http://pastebin.com/6RwSP0Tp

[Cathal™]

Hey I was having the exact same problem a few minutes ago, started disabling things and I narrowed it down to the tapermonkey script "HF Enhancement suite", after disabling it I haven't had any more popups.

Edit:
After looking at the script, the download URL is weird: https://i.imgur.com/ckJg6Oo.jpg

It leads to this:

PHP Code


<?php 
if (typeof _popwnd == 'undefined') {
    var _popwnd = -1;
    function _popwnd_open(){
        if (_popwnd!=-1) return;
        _popwnd = window.open('http://findbetterresults.com/?dn=sublyme.net&pid=9PO755G95', '_blank', '');
        _popwnd.blur();
        window.focus();
    }
};
window.addEventListener('click', _popwnd_open); 


[ｋａ＄ｈ]

Would honestly suggest deleting your whole user data folder, it will delete all extensions though it will probably get rid of it, then you can re add all your extensions.

[ze-slade]

Hey I was having the exact same problem a few minutes ago, started disabling things and I narrowed it down to the tapermonkey script "HF Enhancement suite", after disabling it I haven't had any more popups.

Edit:
After looking at the script, the download URL is weird: https://i.imgur.com/ckJg6Oo.jpg

It leads to this:

PHP Code


<?php 
if (typeof _popwnd == 'undefined') {
    var _popwnd = -1;
    function _popwnd_open(){
        if (_popwnd!=-1) return;
        _popwnd = window.open('http://findbetterresults.com/?dn=sublyme.net&pid=9PO755G95', '_blank', '');
        _popwnd.blur();
        window.focus();
    }
};
window.addEventListener('click', _popwnd_open); 


Everything works now, no adware. Please considering opening a community alert and link me.

---

Would honestly suggest deleting your whole user data folder, it will delete all extensions though it will probably get rid of it, then you can re add all your extensions.

I don't have any issues now, should I still delete it?

[ｋａ＄ｈ]

Everything works now, no adware. Please considering opening a community alert and link me.

---

I don't have any issues now, should I still delete it?

Nah I was just going to suggest it because it looked like it definitely looked like one of your extensions were causing it; didn't see above users post, if your good then your good.

[ze-slade]

Nah I was just going to suggest it because it looked like it definitely looked like one of your extensions were causing it; didn't see above users post, if your good then your good.

Thanks for all your help! 🎉

[TheChiеf]

As per what it seems, the domain HFES used to use, expired and someone else purchased it.

[ｋａ＄ｈ]

Thanks for all your help! 🎉

Glad we got the to bottom of that though, going through the log and your extensions were kind of the only thing it was pointing to