Random ad links popping up and non-youtube banner ads

[Unknown_Gamer]

Hi,

For some reason, I've all of a sudden gotten infected with I think a virus/malware. It seems to put banner ads on pages like youtube and google. For sites that aren't supported with banner ads, whenever I click a link, it'll open up a new tab every so often with a link to a sketchy website with ads.

 

Preview of banner ads:

I've also look into the Inspec Element and this is the code I found for the about 960px banner ad found on the video above:

<script src="https://unpkg.com/ed4c0023d0428464c1b38e17b3862097/0.js"></sc ript></script>
<div style="position: absolute; background: rgb(255, 255, 255); top: 410px; z-index: 2147483647; left: 89px; width: 728px; height: 90px; text-align: center;" class="video_pl_p">
  <span style="z-index:999999999999999;color:red;font-size:25px;font-weight:bold;cursor:pointer;width: 15px;position: absolute;right: 2px;top:-4px;padding: 2px;font-family: &quot;YouTube Noto&quot;,Roboto,arial,sans-serif;">x</span>
  <div id="3750698553" style="display: inline-block;height:90px !important;width:728px !important;margin:0 auto;z-index:99999999;border:0;"><iframe src="//b.buywork.men/code/adv/b/?pid=792193&amp;adu=0&amp;s=728x90" scrolling="no" style="width:728px; height:90px;border:0;padding:0;overflow:hidden;position: relative;" allowtransparency="true" data-mytype="name_baner"></iframe></div>
</div>
<script type="text/javascript" src="https://like.xelppi.com/ysublod.php" gapi_processed="true"></script>
<script type="text/javascript" src="https://youtube.xelppi.com/yout_pro.php"></script>
<script type="text/javascript" src="https://like.xelppi.com/ysublod_2.php" gapi_processed="true"></script>

 

FRST.txt

Addition.txt

[Unknown_Gamer]

Just now, NooTiinG said:

Probably a solution, for me solves, i had the exactly same issue on youtube, google... If you have Betternet free vpn, disable it. Maybe other free extensions can put ads, strange no ? 

I don't have BetternetVPN so I don't think that is the problem.

[AdvancedSetup]

Hello @Unknown_Gamer and

 

Please restart the computer first and then run the following steps and post back the logs when ready.

STEP 01
Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus

STEP 02

 

 

Fix with AdwCleaner

 

Please download AdwCleaner by Xplode and save the file to your Desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now.
• After reboot, logfile will be opened. Copy its content into your next reply.

Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

STEP 03
Download Sophos Free Virus Removal Tool and save it to your desktop.
 

• Double click the icon and select Run
• Click Next
• Select I accept the terms in this license agreement, then click Next twice
• Click Install
• Click Finish to launch the program
• Once the virus database has been updated click Start Scanning
• If any threats are found click Details, then View Log file (bottom left-hand corner)
• Copy and paste the results in your reply
• Close the Notepad document, close the Threat Details screen, then click Start cleanup
• Click Exit to close the program
• If no threats were found, please confirm that result.

STEP 04
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron