Popup page & box in firefox offering a year free netflix (& online surveys too)

Hello,

I went to look at an already open tab on my firefox (so I didn’t click on anything new or open any new pages, just went from doing something different to go back to my open firefox window) and out of nowhere a new tab opened which had a box in it saying ‘To thank you for your loyalty to firefox, we’re giving you free netflix for a year’ along with a code for the offer and an ‘okay’ button to click. I closed the tab, but I’m obviously now concerned that I might have something on my system.

As I said, I didn’t click anything or open anything new to get it, I simply clicked on an already open tab. They’re all normal sites I had open as well, like aol.com and google hangouts, yahoogroups and google. I had a look at my firefox extensions and addons in case there was anything off there, but I only have Grammerly outside of regular Firefox ones.

Can anyone help with figuring out what it is? I have attached the log reports asked for, and below is the website history list that logs when it loads up (I’ve put a space between the https and the : to make sure no one accidentally clicks on a link!!!):

https ://trk.dsllgal.com/?utm_medium=25ad849d010cb6cde4544b8da1bb471d87a4e88a&utm_campaign=SK_UK

https ://trk.dsllgal.com/?utm_term=6598798907621245287&clickverify=1&utm_content=fdc2c69f9aafac9c919596a191959ca58bbbcdb9cbbfbc8c818586b1808280b5a7bdb889bc8fbebdb3bbb0b9b6b0b5b2aaa9aba89eae9c9d9293a19196a5a095d8dfe8e9ee898d819186e0e1d7e7d5d6cccdf8cec8c7fccdc2c6c6c1c1c592f5fafbfcf9fefdfefbf2f3a1f8f6fff4f570

https ://trk.dsllgal.com/?utm_term=6598798907621245287&clickverify=1&utm_content=fdc2c69f9aafac9c919596a191959ca58bbbcdb9cbbfbc8c818586b1808280b5a7bdb889bc8fbebdb3bbb0b9b6b0b5b2aaa9aba89eae9c9d9293a19196a5a095d8dfe8e9ee898d819186e0e1d7e7d5d6cccdf8cec8c7fccdc2c6c6c1c1c592f5fafbfcf9fefdfefbf2f3a1f8f6fff4f570#

https ://visit.net-ax51.stream/survey-r/nflix/index-en-nflix.html?country=GB&td=www.alittletasteofaloha.com&br=Firefox&isp=Firefox&cep=hm3Kr-_9qMFHrLHCOQjcNCmcV92yp0I542LXJQCpnkO_MVcWDFzpx9awG85K6jGquEK0CezqSl_HSln0uSRPE5G68CMB_RrQgikcPBHJCWGRVG14JERb9MtrN5Vw3Nhthv6tiPGcWK0rqc4bh6t1n12NDIgpwPcY-5hOdLZbZC-1DMQC8VDUdsLfZlXMartCfqihXUbL_Jwhz74ZuidxBJxHj1lYiJOCPVTCxsSpOmXDMDGBE7Ee7OgiVGRfgHFL&2=1975&3=1975-06bf658z&1=6598798907621245287

https ://visit.net-ax51.stream/survey-r/nflix/index-en-nflix.html?country=GB&td=www.alittletasteofaloha.com&br=Firefox&isp=Firefox&cep=hm3Kr-_9qMFHrLHCOQjcNCmcV92yp0I542LXJQCpnkO_MVcWDFzpx9awG85K6jGquEK0CezqSl_HSln0uSRPE5G68CMB_RrQgikcPBHJCWGRVG14JERb9MtrN5Vw3Nhthv6tiPGcWK0rqc4bh6t1n12NDIgpwPcY-5hOdLZbZC-1DMQC8VDUdsLfZlXMartCfqihXUbL_Jwhz74ZuidxBJxHj1lYiJOCPVTCxsSpOmXDMDGBE7Ee7OgiVGRfgHFL&2=1975&3=1975-06bf658z&1=6598798907621245287#

UPDATE: This has happened six times since writing this post…I can now add a screenshot (attached). I didn’t click anything, I was on this page and it loaded automatically.

Thanks,
CB

Does it happen when you only use Google Chrome?

Hi,

I don’t have chrome, but I’ve shut down firefox and am now using the Avast browser. So far I haven’t had it…I’m going to keep using Avast to test it though, because on firefox I had it once, then it was about an hour before I got it loads of times again.

UPDATE: just to add, Malware bytes found nothing, Avast found nothing and Spybot Search & Destroy just found the usual few cookies. And still no pop up tabs happening on the Avast browser (touch wood!).

In that case, disable Grammarly for Firefox and see will it again popup.

Hello,

I went to bed before I could follow this advice and see this message.

I hadn’t even opened firefox this morning, I was still using Avast browser, when firefox tried to open by itself. I chose to open it in safe mode, and another survey came up, just a different one (picture attached). I removed Grammerly, but as I’m writing this, I’ve had another 2 more windows open with the same survey at this address:

http ://pandarocksmedia.com/ukd151/index.html?dom=track.luxesailings.com&sid=%20ukd151&cep=cfBH5vgtdELii7O7chgBsmEUaeYVSyuLmodRmNgwjKoKz6qjdHcigD2uPud3uHK7J6ngykczYMdXW2aBNqRrBAvQjqsa5VBFaeiRShCHQF_YJYvxooGLUX1knseBhvYMU4bxWkZ0RfMdrcxSkDH3amn9IAZh9Dg9nDw__qrX8G_c2TrrK3rk38mJ4gd5Ju89Mv9DpULybLskAdCrBApjSwKVUULRLDbAs036II-AU7gepCSmTuldMCoocl2ntBQs&partner_id=1975&placement=1975-827c487z&cid=6599172449533691010

So there’s definitely something either in the browser or computer.

Can someone help please? I’ve had a number of these surveys open firefox automatically within the last 2 hours despite firefox being closed and not in use.

Does it happen when only YouTube is opened?

Hi,

I wasn’t using youtube at the time.

I found a suggestion on another forum that it could be the ads in Skype 7 causing it. I have since uninstalled Skype 7 and switched to Skype 8, and (touch wood!) I haven’t had any of the survey pop ups since.

I just wanted to reply in case anyone else looks at the thread with the same trouble so they know what helped for me, and to say thanks for your help :slight_smile:

Thanks!

That is really strange. Thanks for letting us know that Skype was culprit.

This issue only arises if you have old Skype version 7.xx. If you update Skype, it disappears.
Everyone who wants to stay with the old Skype version, I can offer you the remedy for the advert bug:

  1. Go to C:\Windows\System32\drivers\etc , open file “hosts” in any text editor with administrator rights and add these lines:

127.0.0.1 rad.msn.com
127.0.0.1 adriver.ru
127.0.0.1 api.skype.com
127.0.0.1 static.skypeassets.com
127.0.0.1 apps.skype.com

Save changes.
2. Open file config.xml from C:\Users\User_Name\AppData\Roaming\Skype\Your_Skype_Nickname (it is a hidden folder) in any editor and find lines and (if present), change parameters to 0. Save changes.
Voila… no addverts…