ar.voicefive pop-up issue

Hello all. I had a problem in the past with a pop up that would open up in a new tab in my browser and take over whatever I was doing at the time, which was playing a game called Neverwinter. The pop is from a site called ar.voicefive. I stopped playing the game for a few months, and never had that happen again. Now I’ve started playing the game again, for about about a month now, and the pop up has started again. And this time it has also affected my friend who was also playing Neverwinter as it happened as well. I use Chrome, and he uses Firefox.

The only things I usually have open at the times this happens are Chrome, Neverwinter and Skype. I’m not sure if this issue has a link to Neverwinter or not, and I don’t see how that could even be, but EVERY time it opens is when that game is running. Could be coincidence, but it makes me suspicious enough to note it. I have searched many times and tried various solutions and scans (I have scanned with Malwarebytes, Avast!, and SuperAntiSpyware), but just haven’t seemed to find a fix it seems. I know I could uninstall Neverwinter and re-install it and change my password and such, but I don’t know if such a step is necessary, and considering how sporadically this pop-up occurs it would be hard to tell for quite a while if that fixed the issue or not. I also wonder if something like this can spread over my local network, and if other computers might be infected as well.

While searching for answers I found this thread here on these forums, but there was never a solution found, but hopefully it will give a bit more insight: http://forum.avast.com/index.php?topic=130130.msg964947#msg964947

I really appreciate any help that can be offered, and will do my best to follow the instructions you may provide for me. I am worried, as I do make online purchases and don’t want anything to be stolen. My searches have given me varied results as to what this could actually be, so I’m not sure if I should be worried about my information being stolen or not. I’m sure you’ve noticed by now, but I’m not the most tech savvy person there is, but I do try to remain safe and use things such as Web of Trust, Adblock, https everywhere, and am very conscious about which sites I visit. So if you can bear with me, I will try my best to give you what you need so that you can help me, and others who have this problem such as my friend. Hopefully the information that I have already given is at least somewhat helpful. Thank you. :slight_smile:

Here is a recent screenshot (taken yesterday, Jan 21) of it happening, just as I opened the Neverwinter launcher. (Usually it happens when I’m in game though. Also, ignore some of the stupid things in the background lol.) : http://i.imgur.com/s3VkE4e.png

And here is a screenshot of another issue that may or may not be linked, but I figured it may help so I’ll include it. (To me it seems like a harmless skype related error when trying to load an add or something, but hey, you never know) :

http://i.imgur.com/MQJQAfH.jpg

And here are the logs. The Malwarebytes log is from the 19th; if that’s too old, then I’ll do another scan.

That looks to be a webpage generated one

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

I don’t appear to have a log file named [S1], but there is an [S0]. Hopefully that works, or maybe I did something wrong. Seems to have cleaned up something though.

A few orphaned adware entries :slight_smile:

Could you see if that popup appears again please

I will definitely post back if/when it does again. It’s very random, so it may or may not take a while for it to pop up again. Thank you very much for the help.

No problem, we shall see what happens

Welp… Here we go again. The same problem is back. The pop up opened twice in less than 30 minutes just out of nowhere. And I got a very suspicious sounding notification on a wikidot website as well. I’ve had that wikidot tab open for a week or so and I have never had that notification until just now interestingly enough. I did NOT have Neverwinter running this time, so that’s out of the picture.

Here are 3 screenshots in case they help: http://imgur.com/a/ZZALV#1

And here are the logs.

The logs are clean I believe it may be related to that website as opposed to anything else

Wikidot is a pretty safe website as far as I know. Besides, that ar.voicefive pop up has occurred without that website being open in the past, as shown by one of my screenshots in my first post. In fact all I have open in that screenshot is an imgur and a guitar center link. I really don’t think either of those two sites would force an ad to open in a new tab, and get past adblock with no interaction from me, otherwise more people would be complaining about this issue. I want to believe it’s website related, but I just don’t think it can be. Or am I misunderstanding something?

If it was on your system it would be on a very regular basis and not just once or twice every few weeks/months

There is no indication of anything on your system that is untoward or unusual

Alright then. Just seems a bit odd how it’s always the same site that pops up. In the future I’ll try and see which websites are the ones doing it, and avoid them. Thanks for all the help.

What is the address of the website and I will check it out

The address of the one that’s been popping up? If so, here you go.

https://ar.voicefive.com/global/invite/invite_inv_3.htm?&pid=p242651985&prad=8519227&ar_c=18050828&dom=159&inv=pop_up_inv_3&methodology=8&branding=&version=3&location=http%3A%2F%2Fnym1.ib.adnxs.com%2Fif%3Fenc%3DmpmZmZmZ6T-amZmZmZnpP3sUrkfhevA_ZmZmZmZm8j9mZmZmZmbyP8nUqDEfUF52g8xc0zYhKB8-dS9TAAAAAERPEgAYAQAAvAQAAGUAAABVTa8A4y0DAAAAAQBVU0QAVVNEACwB-gB5JwAAiBsAAgUCAQIAAIYA3SXRvAAAAAA.%26tt_code%3DSKYUSEN3%26click%3Dhttp%253A%252F%252Fbid.g.doubleclick.net%252Fxbbe%252Fcreative%252Fclick%253Fd%253DAPEucNU7IqpIrdzSk0vX5Vm4NJc1HuuOEYOTEojbbjexEn02_t2ORmEQej-H6tJbSVWBwtPAtjCUkTaPwGNbducXNWqTF8HN7Ji9_78IMHVZtVejro8E5DU%2526nct%253D1%2526r1%253D%26vpid%3D812%26apid%3D150794%26referrer%3Dhttp%253A%252F%252FSkype.com%26custom_macro%3DCLICK_URL_ENC%255Ehttp%253A%252F%252Fbid.g.doubleclick.net%252Fxbbe%252Fcreative%252Fclick%25253Fd%25253DAPEucNU7IqpIrdzSk0vX5Vm4NJc1HuuOEYOTEojbbjexEn02_t2ORmEQej-H6tJbSVWBwtPAtjCUkTaPwGNbducXNWqTF8HN7Ji9_78IMHVZtVejro8E5DU%252526nct%25253D1%252526r1%25253D%255EIM_OBA_CPS%255E%255EDYNAMIC_CREATIVE_PIXEL_DATA%255EAPEucNVqzSVAnv5Msijupf2YhJjym5KNb2XE7_iy5EnybJJ2fmvP_-OiOXiUzvmtJumiBrmgOApp%255EBID_DATA%255EAPEucNW-vUkaMwDGKDIbOvGVayVW28z-7VRTOS9yjKjzf-svImv1aQVxMRWemdwb3XEmfAq7hpc5xLfi2MAAJnuBaHwfu3q4c3RuPjqB3GXE9YUG3mL8KHzVCpxZPmbKbaJvyHfe2I4xISVC3_M930qTRrA9oE2vtYxK4-Hf5zPsbQEnM3CcQN4nC4qMOb2J8imdaxB9tzkirhrKHshDHOYSiYOHsxcOjY4k61JuynIij-Qcu9HnxPgh9dfhlSXeNU_gNnqRftfkWQxHZVj7GlTcbpniv6mWWg%26media_subtypes%3D1%26ct%3D0%26dlo%3D1&referrer=&path=https%3A%2F%2Far.voicefive.com%2Fbmx3%2F&cid=367622&sz=300x250&clid=13458403&cpn=&as=mm&recruitFrequency=0.1&grp=1&1395619131779

Also here’s its WOT scorecard, if that is at all helpful to you.

https://www.mywot.com/en/scorecard/ar.voicefive.com?utm_source=addon&utm_content=contextmenu

This is triggered by a cookie so I would recommend that you delete all cookies when you close your browser and set it to deny third party cookies

Done and Done. Hopefully that’s the last I see of that site. Thank you. :slight_smile:

OK keep me informed, I did some checking on the net for this and I saw so much rubbish about it being on the system and you must download this or that programme to fix it (not free :slight_smile: )

Right, I did the same and I didn’t trust any of the stuff I saw either, which is why I came here. I’ll certainly try and post back here if anything comes up or if I feel that everything is fine. Thanks again.