The script address matched the one that was blocked by the antivirus. This might’ve been it, I’ll follow up in about an hour to make sure it stopped for good.
The pop-ups are still happening. I don’t know if this helps but I’ve attached a screenshot of the URL and process that Avast is blocking.
DOes they still happen even after PC restart?
Yes
Please scan your PC with Kaspersky Virus Removal Tool.
http://devbuilds.kaspersky-labs.com/devbuilds/KVRT/latest/full/KVRT.exe
Hi sorry for not replying for a while got caught up with other stuff. I have done a full scan with Kaspersky and it found one Trojan file which it quarantined and deleted but after reboot the pop ups are still happening.
Can you open KVRT again, click on Reprots and take screenshot of detected file?