0
I have a laptop with a mysterious pop up add that starts in a seperate tab. It opens some add site called "wonderlandads" which then redirects to other sites. (Links http://wonderlandads.com/afu.php?zoneid=437742 http://www.liveadexchanger.com/a/display.php?r=973139 )
I've scanned my laptop with avast and also kaspersky's rootkit detection program and they both haven't found anything. Even tried running Lavasoft's Adaware but no help.
After that I uninstalled and reinstalled chrome itself. Still no solution.
Internet explorer on the same laptop does not face this issue. I have manually set the dns server's to Google's 8.8.8.8 and 8.8.4.4. Also set the IPv6 DNS to google's servers.
I've checked the hosts file and there's no entries in there. Searched the registry but couldn't find any entry for "wonderlandads". I've disabled all extensions within Chrome.
If I open an incognito window within chrome then there this spam tab does not get invoked.
Any other tips? The Laptop is running Windows 8. What else can I do to debug this?
Update:
It seems I've temporarily fixed the problem. No more popups. My approach was to kill seemingly redundant chrome threads via the process explorer. One of them must have been the offending one. The solution sustains on hibernation. Now will see if it sustains a chrome restart & then a laptop reboot (doubt it).
1
When you reinstalled Chrome, did you sign back in with the same google account which synced the same settings?
Google support suggests you run their cleanup tool and reset your browser settings: https://support.google.com/chrome/answer/2765944#browsersettings
@beeks I don't synch chrome across machines so I don't sign in into chrome. I did run the chrome cleanup tool & it found nothing. – curious_cat – 2016-02-20T18:06:39.910
1If you hit F12 in Chrome and navigate to Sources -> Content Scripts, do you see anything unusual? – beeks – 2016-02-20T18:39:05.873
@beeks Nope. Its empty. Under sources I see scripts from googleapis.com superuse.com, scorecardresearch.com, sstaic.net, adzerk.net – curious_cat – 2016-02-20T19:25:04.023