won something or opinion survey popup for one website

[stargirl29]

Hi,

i am getting an "i won something" popup (on chrome on ipad) or an "opinion survey" on my desktop computer on firefox when i visit one particular website.  i am only asking here because i am concerned that my desktop computer might have gotten a virus or adware from this website.  i'm not so concerned about my ipad for now. i realize that for ipad questions i need to post in a different section.

besides determining if my computer is infected, i would like to know if this problem is with the website that's infected, or if it's a browser/scam issue.  i thought it was simply a browser issue with scammers on my ipad until i got the opinion survey on firefox on my desktop computer as well.

i'm running Windows 7, 64 bit.  firefox browser.  i have run malwarebytes on my computer, and no threats were found.  the owner of the website has assured me that he has scanned his website and found no threats on the website either.

while i think the problem is browser related, i would like to know for sure.  it's becoming such an issue that people are no longer wanting to visit the website when i post a link to it.  the website is owned by a friend of mine, and he has said that he scanned the website itself and found nothing malicious.

i've attached a screenshot of the popup i'm getting on my desktop computer on firefox.  sorry it's in Dutch, but it says "Dear Firefox user, you are the lucky visitor for today.  fill in this short survey and as a thank you, we give you a chance to win a samsung galaxy S9!

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.
Click Attach this file.
Click the Add reply button.
===

Please post the logs  for my review.

Wait for further instructions.

[stargirl29]

On 7/16/2018 at 3:14 PM, nasdaq said:

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.
Click Attach this file.
Click the Add reply button.
===

Please post the logs  for my review.

Wait for further instructions.

hi, thank you.  i'm sorry i didn't get a chance to reply here earlier.  i will run the scan and post the results here tomorrow. didn't have time to do it today.

[stargirl29]

On 7/16/2018 at 3:14 PM, nasdaq said:

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.
Click Attach this file.
Click the Add reply button.
===

Please post the logs  for my review.

Wait for further instructions.

Hi Nasdaq, here are the two files.  I'm sorry it took me a little longer than anticipated.

Addition.txt

FRST.txt

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please let me know if the problem persists.

fixlist.txt

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

[AdvancedSetup]

Topic has been reopened per request.

Thanks

 

[nasdaq]

stargirl29 I'm listening.

[stargirl29]

Hi, i have run the fix and here is the fixlog.  however the problem still persists when i visit the website in question.  i believe the problem is a web based problem as i stated earlier.  here is a link that explains the problem but i guess there's no way to prevent it? all visitors to the particular website receive the message,  not just me. i can send the link to the website in private if that will help see what's going on.  i don't want to post the website in public to give it negative advertising.

 

https://www.onlinethreatalerts.com/article/2018/4/29/beware-of-google-free-samsung-galaxy-s9-visitor-browser-opinion-survey-scam/

Fixlog.txt

[nasdaq]

Hi,

This could be a Syncing issue?

Are you Syncing Chrome with other devices?
To remove it you will have to reset the Sync in Chrome.

Read this article and proceed.

Chrome Secure Preferences detection always comes back
https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/
<<<>>>

FIREFOX SYNCING.
If Firefox still gives you problems and you are Syncing it with other Devices remove it.
https://support.mozilla.org/en-US/kb/how-do-i-set-sync-my-computer

When all is well you can re-sync your devices.
<<<>>>

Any luck?
 

[stargirl29]

On 7/31/2018 at 3:23 PM, nasdaq said:

Hi,

This could be a Syncing issue?

Are you Syncing Chrome with other devices?
To remove it you will have to reset the Sync in Chrome.

Read this article and proceed.

Chrome Secure Preferences detection always comes back
https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/
<<<>>>

FIREFOX SYNCING.
If Firefox still gives you problems and you are Syncing it with other Devices remove it.
https://support.mozilla.org/en-US/kb/how-do-i-set-sync-my-computer

When all is well you can re-sync your devices.
<<<>>>

Any luck?
 

hi, no it is not a problem with syncing. i don't sync my devices. and it happens with other people who visit the website as well. it is a scam problem. my question is, is there a way to prevent it.  the website owner has assured me that his website has been scanned and doesn't contain any virusus or malware.

[nasdaq]

Hi,,

Read this article on the issue.
https://www.onlinethreatalerts.com/article/2018/4/29/beware-of-google-free-samsung-galaxy-s9-visitor-browser-opinion-survey-scam/
===

The only thing I can suggest for your is to remove and reinstall FireFox.

Before proceeding save your Bookmarks. (Export)
https://support.mozilla.org/en-US/kb/export-firefox-bookmarks-to-backup-or-transfer

Firefox Password manager - Import your passwords.
Password Manager - Remember, delete, change and import saved passwords in Firefox
https://support.mozilla.org/en-US/kb/password-manager-remember-delete-change-passwords

If you are Syncing Firefox it with other Devices remove it.
https://support.mozilla.org/en-US/kb/how-do-i-set-sync-my-computer

When all is well you can re-sync your devices. NOT NOW.
<<<>>>

Clean the Firefox Cache.
https://kb.iu.edu/d/ahic#firefox

Remove Firefox using the instructions one this page.
https://support.mozilla.org/en-US/kb/uninstall-firefox-from-your-computer

Restart the computer normallhy.

Install the latest version of the application.
https://www.mozilla.org/en-US/firefox/new/

Import your Bookmarks. Same link as the Export function above.

Restart the computer normally.

Keep me posted.

 

[stargirl29]

5 minutes ago, nasdaq said:

Hi,,

Read this article on the issue.
https://www.onlinethreatalerts.com/article/2018/4/29/beware-of-google-free-samsung-galaxy-s9-visitor-browser-opinion-survey-scam/
===

The only thing I can suggest for your is to remove and reinstall FireFox.

Before proceeding save your Bookmarks. (Export)
https://support.mozilla.org/en-US/kb/export-firefox-bookmarks-to-backup-or-transfer

Firefox Password manager - Import your passwords.
Password Manager - Remember, delete, change and import saved passwords in Firefox
https://support.mozilla.org/en-US/kb/password-manager-remember-delete-change-passwords

If you are Syncing Firefox it with other Devices remove it.
https://support.mozilla.org/en-US/kb/how-do-i-set-sync-my-computer

When all is well you can re-sync your devices. NOT NOW.
<<<>>>

Clean the Firefox Cache.
https://kb.iu.edu/d/ahic#firefox

Remove Firefox using the instructions one this page.
https://support.mozilla.org/en-US/kb/uninstall-firefox-from-your-computer

Restart the computer normallhy.

Install the latest version of the application.
https://www.mozilla.org/en-US/firefox/new/

Import your Bookmarks. Same link as the Export function above.

Restart the computer normally.

Keep me posted.

 

Hi,

i guess you did not read all of my comments. i posted that article on monday for you.

it's not only a firefox issue.  it also happens in Chrome and if i'm on my ipad or desktop computer.

[nasdaq]

Hi,

I have checked the Link address of your popup from your first post.

It's https://content.invisioncic.com/Mmalware/monthly_2018_07/66417782_firefoxuser.JPG.a91c9f186c607b0c8ebea943a9999d0f.JPG

Was the image posted by you at invisioncic.com or is this the site were the popup originates from?

It might help also if you could right click on the image, not the OK button, and if you see a command to copy the link address do so.
The link will be copied to the cliipboard.

Open Notepad right click the text are and select Paste.

Post the complete link if it's not Invisioncic.com

p.s.
Make sure you use the RIGHT CLICK.

[stargirl29]

hi,

no, that URL isn't the one for the site that's in question. that must be where the popup originates from. i hadn't even noticed that when i made the screenshot.  i've been trying to get the popup to appear again but unfortunately it's sporadic in it's appearance.  it only appears if i've not visited the site in a while.  or if one is a new visitor.  is it possible that i can send you the link to the website in a private message? i'd rather not post the website here since it's not mine and i don't want others to think of it negatively because of the popups.

[nasdaq]

Quote

is it possible that i can send you the link to the website in a private message?

Yes please do.

[nasdaq]

Are you still with me?

[stargirl29]

yes, are you still with me? i sent the website to you in a PM last wednesday.

[nasdaq]

Hi,

Sorry. I may have deleted it.

Please try again.

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks