Strange Things Happening With "Powered by Wikia" Sites. Do I have Adware?

[ElectroTheDevolian]

So ever since this afternoon I went onto one of my usual wikias for a game, when out of nowhere it started acting strange. It hasn't done this until today, and that's including yesterday when I last used it. It's using an excessive amount of cookies, and the domains in my Ublock aren't looking like they normally are. It even redirected from the original wikia, to a strange URL, back to the wiki. I have no idea what happened, and I don't know if it's because of the site or suspected adware. What makes this even more confusing is that it doesn't seem to be happening to everyone. Neither Malwarebytes not ADWcleaner is picking it up, so I think it's a site issue. I honestly don't know what to do in a situation like this, because it's only the sites that are "Powered by Wikia." Do I have Adware, or is this something happening to the sites themselves?

[ElectroTheDevolian]

I also have a list of a few of the cookies used on the site, if needed.

[AdvancedSetup]

Hello @ElectroTheDevolian

Not sure about the site itself but let's scan your system for any type of infection.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[ElectroTheDevolian]

@AdvancedSetup

Nothing infected seems to be showing up in all 3 of these, but I did talk to a few friends about my current situation. Some didn't have the strange occurance on the site, and some did. I'm honestly not sure what's going on. We all tested it with the same preferences (Ublock Origin in Incognito with antivirus active.)

Update: I'm looking through the site's cookies and local in the preferences listed above, and it's a complete mess. It seems to be corrupted for most official cookies, while the strange ones are long lines of numbers and letters.

Threat Scan.txtFRST.txtAdwCleaner[C1].txtAddition.txt

Edited December 13, 2017 by ElectroTheDevolian
Update about the situation at hand

[AdvancedSetup]

You can try clearing all your cookies and doing a browser reset and see if that helps or not.

 

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
  • 
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer now and make sure there are no longer any redirects or other browser issues. 

 

[ElectroTheDevolian]

I just tried this, and it's still happening on that site domain (Google Chrome). Is there anything else I could possibly do?

[AdvancedSetup]

Does the issue ONLY happen in Chrome? or does it happen in other browsers too?

 

[ElectroTheDevolian]

It seems to only be Chrome.

[ElectroTheDevolian]

23 hours ago, ElectroTheDevolian said:

It seems to only be Chrome.

@AdvancedSetup

Update: I found a temporary workaround with the site domain. As long as I block the site's cookies entirely, it doesn't pull a redirect. It's back in working order, but I know the problem is still there if I allow cookies again. I did manage to find the redirect URL that it gives me every time I enter the site with cookies on, as listed here:
 

warframe.wikia.com/g00/wiki/WARFRAME_Wiki?i10c.encReferrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8%3D&i10c.ua=1

Be reminded this redirect happens with every wikia site, so I'd like to figure out how to block the site domain from creating cookies entirely if possible. My guess is that this redirect leads to a faux site, which would explain why the cookies domains are much different. Hopefully someone can figure out why this was happening to me and a few select people. It definitely seems to only happen on Chrome, as Firefox and Edge seemed to be safe from the redirect. I'll get back to you if any other problems persist with this.

[AdvancedSetup]

Okay, please follow the directions exactly as shown in this topic and let me know if it helps

Thanks

Ron

 

[ElectroTheDevolian]

I did the steps in the topic, and it seems to still be happening. I'm starting to think it's a site issue rather than an infection. I even did a full scan this time just to make sure.

[AdvancedSetup]

Are you able to use Internet Explorer, Firefox, Opera or one of the many others?

Personally don't like or use Chrome except when forced to.

We can look at doing a full manual removal of Chrome and then reinstall once all traces of have been removed to see if that helps.

Let me know.

Ron

 

[ElectroTheDevolian]

I prefer to use Chrome, but I may switch to Firefox in a few months. With this temp fix of blocking cookies, the problem seems to be resolved.

[AdvancedSetup]

Yes, appears to just be a browser issue not really an infection in the typical sense. If it gets worse though let me know and we can try a manual full removal and reinstall of Chrome.

Ron