I seem to have a virus I cannot trace on my computer, it basically rewrites pages filled with ads in the form of videos. It seems to be using AJAX here is a screenshot attached. I traced a few files and have them posted here how can I remove this virus? Where is it located on my computer?

enter image description here

It is writing your page too

enter image description here

I have some of their source I traced links will be in the comments cause I am still finding and pasting them.

At first I thought that it was writing things by latching on to source code but it is ajax from what I saw on one of their files - Also the frame src leads to a website called cliphub.tv

  • Ignatius - the only solution you can rely on here is to nuke it. There is no other way to be sure you have removed the virus. Virus removal tools can do a certain amount, and if your virus is recognised by one of them, then you may be in luck, but there are simply so many ways this could be infected that you need to just bite the bullet and start from scratch. One of the reasons questions like this are off topic here. This conversation has been moved to chat
    – Rory Alsop
    May 30, 2016 at 17:22
  • Cant access chat the page was rewritten with loads of ads. How do I nuke it then?
    – Ignatius
    May 30, 2016 at 17:47
  • 1
    Wipe everything. Format your drive. Reinstall from discs, clean backups etc.
    – Rory Alsop
    May 30, 2016 at 18:34
  • Any other suggestions I have a website I am working on and I dont want to have to go through the trouble of reinstalling my server
    – Ignatius
    May 30, 2016 at 19:57
  • No. That really is the only way to be sure. This is why backups are so essential. If you've never taken backups you'll see why they make sense after you rebuild your whole system.
    – Rory Alsop
    May 30, 2016 at 20:21

1 Answer 1


There are several ways such an ad-injecting malware might work and it does not even need to be installed on your system. Common ways are:

  • Browser extension: there were several prominent cases where common browser extension were sold and went malicious. These probably can do anything, including manipulating data accessed by https.
  • Local proxies. In this case there is a local proxy which rewrites the traffic. This is often coupled with injecting a new CA into the trust store so that https traffic can be manipulated too. Check your proxy settings. Note that it is not enough to just reset the proxy settings because usually the malware will change these again.
  • Hijacked router. In this case all devices in the network are affected and https traffic is not modified (or would cause browser warnings).

But it is not clear what exactly is the reason in your case and how it can be resolved.

  • Browser extension is ruled out. Local proxies however I need to be looked into let me do something real quick...
    – Ignatius
    May 30, 2016 at 16:39
  • Router I dont think so... let me check everyones phones but my phones personally have not been harmed.
    – Ignatius
    May 30, 2016 at 16:41

Not the answer you're looking for? Browse other questions tagged .