Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This question already has an answer here:

I have a virus on my windows computer. It seems to create new chrome tabs when I start using a new application. For example, if I go to Youtube and I start up flash, it may create a new tab.

When I navigated to the superuser question entry field it created a new tab and that tab was an advertisement for a survey to win 50 bucks.

A friend of mine commented:

Hmmmm. You might be able to delete it manually if you find where it is on your computer. If you go in the Task Manager, there's an option to show the command line argument that was used to run a program so you might find its filepath that way. You could also just try and stop it from launching by deleting the launch operation from the Windows Registry. Just google Regedit and find the section for .exe files and check if there are any fishy things in it.

Any help is appreciated! :3

Windows 8

EDIT:

I've run

avast antivirus ad-aware antivirus

ad-aware quaranteened some files, but the problem persists.

share|improve this question
    
I typically am reluctant to point out the obvious, but couldn't you just run an antivirus program? I assume one is installed, right? –  Matt Jul 28 '13 at 0:09
    
Matt sorry i should have added that. I'll edit the original with an update mentioning those things. –  IamPolaris Jul 28 '13 at 5:58
    
I wonder if its a browser 'addon' - does this happen with all browsers? –  Journeyman Geek Jul 28 '13 at 6:12
    
"just google regedit and find the section for .exe files" hehehe good advice. ;) –  techie007 Jul 28 '13 at 7:10
    
JourneyMan -> It appears to be happening on firefox and chrome –  IamPolaris Jul 28 '13 at 22:27
show 1 more comment

marked as duplicate by techie007, slhck Jul 28 '13 at 10:40

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

I assume this issue also occurs across different browsers not just Chrome? Do a test...can you download a new browser ie Firefox , fresh install and see if the ads still pop up right away.

It is very likely and simply a resident program and can be killed from within Task Manager -- Just post here a list of your running tasks and we can tell you which one is the evil doer. Sadly i dont have Windows 8 (only using W7) so i may not be entirely familiar with all the new System processes. I suggest you open Task Manager, right-click for Properties for each running process and identify and close each app (via "End Process") that is not an executable file located within the C:\Windows folder. And then see if the pop ups still persist. Also run Microsoft's monthly updated "Malicious Removal Tool" (type "mrt.exe" from the Run dialog -- assuming the tool is updated for July 2013) to make sure none of your System files have been tampered with. Yes the obvious thing a spam tool writer would do is copy their file into the system folder and rename itself as a benign filename but just want to narrow the field. After you do all that and the problem persists then jump into the Services (via "services.msc" from the Run dialog) and turn off Services that are not system specific. You should be able to identify which ones via "msconfig" (via Run dialog) and clicking the "Services" tab and selecting "Show only non-Microsoft Services" -- the ones that remain try turning them all off (or rather: Stopping the service) and then checking your browser.

Another possiblity is that they replaced your winsock stack with their own infected one which monitors your in/outs.

If they are really creative they could simply inject their dll into a running browser like Chrome which then it could do all sorts of things.

But in most cases you have a evil running process (or service) which can be spotted and killed via he Task Manager.

Anti-Virus/Anti-Malware tools aren't very reliable since its way too easy to make apps to get around them. Experience to know what is happening and why is the best defense.

share|improve this answer
    
imgur.com/EZCjglc Here is another symptom. underlined links with advertisements associated. They appear in firefox and in chrome. –  IamPolaris Jul 28 '13 at 22:20
    
pastebin.com/689EyS6P heres a list of my processes using get-process in powershell –  IamPolaris Jul 28 '13 at 22:44
    
windows maliciious software removal tool finds nothing. –  IamPolaris Jul 28 '13 at 23:34
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.