1

Just after visiting www.computerworld.com/article/2536806/networking/10-killer-texting-tricks.html on chrome a window opened up¹. The window showed an odd behavior; it kept on switching site posts in the same window².

There were two things I noticed. First, the site loaded in the windows was engine.spotscenered.info from which the site joystamps.com was redirected. Second, the window popped behind the main browser window unlike normal popups which literally pop.

After visiting the site for the second time the windows did not pop up at all but after a few minutes of browsing on the internet the window again popped up out of nowhere even with the computerworld.com tab closed. This something I don't get how come the windows popped up even with the tab having the script closed.

¹

²

  • 3
    Welcome to Information Security SE. What exactly is your question? – Jedi Jun 22 '17 at 22:19
  • Well even I after I had closed the tab, those popups popped up out of nowhere while I was browsing the internet. How is that possible? – Megh Gandhi Jun 22 '17 at 22:27
  • I can't answer your question as to how it's persisting, but I can tell you the point of it is to defraud advertisers by generating fake ad impressions (notice the generic content and heavy ads on the resulting pages, in addition to autorefresh). I see this a lot on fake news, domain squatting and other "sketchy" sites. My own efforts to investigate have always been thwarted by failure to replicate the situation, but unless this happens completely at random (i.e. not just after visiting one specific site) I'm quite confident it's not malware on your machine. – Ivan Jun 23 '17 at 14:16
1

Cursory Analysis of Questioner's Issue

I could not replicate the behavior at www.computerworld.com/article/2536806/networking/10-killer-texting-tricks.html with any of the test browsers, all of which are either Firefox or Chrome of various versions running on a LINUX OS. Checking the current state of the documents comprising the articles, they do not appear to reference any of the other domains you mentioned.

The behavior you are describing is typical of an infected operating system. Many software infections sell access to infected systems to other organizations, thus the various seemingly unrelated brands appearing. It is likely (but unprovable from basic information provided in a forum like this) that the first successful attack was invisible to you.

A Fairly Standard Remedy to Try

It is possible to avoid having to buy a new computer and start from scratch, but it usually takes significant expertise to remove all traces of infection. The best bet is to buy high quality protection software from a highly reputable vendor, install it, update the software's infection description database, and run it twice. If the behaviors go away and the second scan turns up nothing, you may be in the clear.

Whether you can clear up the current system or have to start with a fresh installation of the operating system, you may want to change your user practices. Starting fresh does not require that one purchases new computer hardware, but it may require some expense for the operating system, and it certainly requires considerable time and care to transfer your user files in such a way as to filter out any infections that they may contain.

A Stringent Practice of Prevention

As I mentioned, whether you can clean up all infectious artifacts or not, in the long term, it is probably important to you to avoid future infections.

At home, at client sites, or in the laboratory, I have a strict policy to never click on email attachments unless they are official documents that I requested from generally trustworthy sources. I always prefer that people post the document as a PDF so I can download it, scan it, and open it with an application that does not try to run anything from within the PDF.

I only visit sites of universities, corporations that have security teams, arms of government, and my own web pages. I have a physical firewall on my network. No one ever uses my accounts, and I don't install software unless I can read the source code first.

The precautionary policy that I use may be a bit extreme for most users, but I don't feel particularly limited in my use of computers even with all these "convenience" limitations, but then I haven't experienced the "inconvenience" of infection in nearly a decade.

  • Try clicking on white space.. you might see those popups – Megh Gandhi Jun 23 '17 at 13:57
1

If you closed the tab and all the popups, or better the whole browser. And "popups" kept opening. You're likely infected with malware (or visiting multiple suspicious sites at the same time).

  1. Run some antivirus and anti malware scans,
  2. Make sure everything is up-to-date,
  3. Install an ad blocker or (stricter) popup blocker.
  • I did a Full pc scan with AVG and also a malwarebytes scan – Megh Gandhi Jun 23 '17 at 5:05
  • And no malwarewe found – Megh Gandhi Jun 23 '17 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.