My PC has been infected with a malware that opens pop-up to some ads, mostly in my native language (Persian) but from (wonderlandads.com), when I click on a link or in an input box in StackExchange websites. Interestingly, it just occurs for these websites and no other website! It occurs in both Firefox and IE

I scanned my computer with NOD32 7.0.2 , and some freeware malware scanner (kaspersky tools,...), but they couldn't find it. I reinstalled the Firefox and disabled startups but couldn't fix it.

What is the cause? and what can I do?

How it can hide itself from powerful antiviruses and anti-malware?


Update It seems I could handle it by killing running processes and refreshing the firefox.

marked as duplicate by DavidPostill, Community Dec 13 '15 at 19:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from security.stackexchange.com Dec 13 '15 at 17:28

This question came from our site for information security professionals.

  • Are you sure that your PC is infected? It might be your router instead. See pcworld.com/article/2926312/… or darkreading.com/attacks-breaches/… – Steffen Ullrich Dec 13 '15 at 11:04
  • @SteffenUllrich I use ADSL in two cities, I have different modems and connect to different ISPs, but in both places, I have this problem, then it must be in PC, In addition recently I tried to install some cracker and key generators programs for Sony Vegas, and I think they are the source of problem – Ahmad Dec 13 '15 at 11:10
  • Your question doesn't seem to be about information security, but just about your malware problem – Beat Dec 13 '15 at 11:25
  • 1
    You should buy software instead of using cracks, they are often infected and have backdoors. You get what you pay for. Scan your PC with some Live CDs and from safemode eg with Malwarebytes and others. You also did not provide enough information like the name of the process of the malware. – Daniel Ruf Dec 13 '15 at 11:28
  • 2
    I cannot understand the trust you have into cracked software. It is more likely that this is the source of your problem than the cure. – Steffen Ullrich Dec 13 '15 at 11:28

In this link, you can find the details about removing Wonderlandads pop-up malvare.


  • Kill running process by task manager (especially suspicious ones)
  • Uninstall recently installed programs (especially cracked and suspicious ones)
  • Disable suspicious programs from start up.
  • Reset your web browser.

As this pop-ups occurs only for the websites of StackExchange, I cleared the cache items related to *.stackexchage.com as it is in How can I clear a single site from the cache in Firefox?. Now the problem has been resolved without any restart or killing a process. Then I guess some client-side scripts were infected and by removing them you can solve the problem.

Not the answer you're looking for? Browse other questions tagged or ask your own question.