[ze-slade]

Over the past three or four day I've been having issues with adware, but the thing being it was ONLY on hackforums, I decided to make a thread in the whitehat section to geet help. Nobody was able to fix it until today when CJOS100 said this in my thread:

Hey I was having the exact same problem a few minutes ago, started disabling things and I narrowed it down to the tapermonkey script "HF Enhancement suite", after disabling it I haven't had any more popups.

Edit:
After looking at the script, the download URL is weird: https://i.imgur.com/ckJg6Oo.jpg

It leads to this:

PHP Code


<?php 
if (typeof _popwnd == 'undefined') {
    var _popwnd = -1;
    function _popwnd_open(){
        if (_popwnd!=-1) return;
        _popwnd = window.open('http://findbetterresults.com/?dn=sublyme.net&pid=9PO755G95', '_blank', '');
        _popwnd.blur();
        window.focus();
    }
};
window.addEventListener('click', _popwnd_open); 


As soon as I disabled it, I stopped having my adware issue. Now I went on discord and luckily TheChiеf was in there and figured out that the domain was expired and somebody bought it. here's proof of expiring: https://who.is/whois/sublyme.net

This is on the older one, I'm not too sure about the current one, though.

[Jаson]

I suggest using the new URL
https://raw.githubusercontent.com/hashla...ES.user.js

[TheChiеf]

I suggest using the new URL
https://raw.githubusercontent.com/hashla...ES.user.js

It still uses the same domain.

[Riyu]

I suggest using the new URL
https://raw.githubusercontent.com/hashla...ES.user.js

Pretty sure thats the same one?

[Jаson]

It still uses the same domain.

No the one he was using was from sublyme.net

This is on Github

[Kaspah]

This is totally irrelevant but did everything work out with the keys?

[ze-slade]

This is totally irrelevant but did everything work out with the keys?

You should have just pm'd me about this, no I haven't got them yet because I currently have no use for them.

[Jаson]

Pretty sure thats the same one?

No.

[⁠Cammy]

It still uses the same domain.

The Namespace class doesnt even connect to the domain afaik, you can even put words in it. iirc it serves as an identifier so scripts wont conflict if they have the same name or whatever

[Jаson]

The Namespace class doesnt even connect to the domain afaik, you can even put words in it. iirc it serves as an identifier so scripts wont conflict if they have the same name or whatever

Ye. Still using HFES and having no problems with it.

[TheChiеf]

Ye. Still using HFES and having no problems with it.

I had no problems with it as well, but you can just Ctrl + F through the userscript, and you can clearly see more than 50 mentions of the domain.

[ze-slade]

Ye. Still using HFES and having no problems with it.

The newer one has no issues AFAIK, but the older one has the adware like issue.

[Jаson]

The newer one has no issues AFAIK, but the older one has the adware like issue.

Yea when you first alerted us of this, I had to take a closer look of the script

Newer script is perfectly fine (From Github)

[bzrΚ]

Surely whoever has purchased the domain was / is on HF. Kinda scummy thing to do...

[⁠Cammy]

I dont even think its sublyme.net but rather http://findbetterresults.com/