If you have been following me on the blog for the last six months you know that I often write about how to remove pop up ads and how to remove unwanted sites showing up in the browser’s status bar. In those blog posts, I show how to track down and remove unwanted software by using the 1) Windows Control Panel, 2) the browser’s add-on dialog or 3) with the FreeFixer removal tool.

I often write a new blog post for each site that I find, which is quite time-consuming. The upcoming months I’ll be focusing on developing some back-end stuff for FreeFixer so I can’t be as active as I use to be on the blog. But I will at least summarise the finds that I do, with a screenshot, and post them here.

A pop up from se-arlig-undersokning.xyz:

spartoo.se pop up:

barnebys.se pop up:

us.fps-pb.com pop up:

and a pop up ad from luxuryslotonline.com:

A pop up from d31f5ec245utk2.cloudfront.net:

go.leguide.com pop up:

dream-marriage.com pop up:

tracking.tfxiq.net in the status bar:

Pop up from machine.billionoptions.net:

Pop up from aftonbladet.se.05b.xyz:

kds.adspirit.de pop up:

A pop up from chachagong23.com:

dry.papaerleaf.com in the status bar:

super-promo.guqu.info pop up:

rqf.receptorirrigated.com in the status bar:

A pop up ad from 123mymovies.com:

adss.comeadvertisewithus.com in Firefox’ status bar:

A pop up from static.millionairetruth.com:

gets.attracteffectclub.info in the status bar:

A pop-up ad from super-promo.gufu.info:

While doing at search at Google, ads.egrana.com.br showed up in the status bar:

pinsght.com in the status bar:

super-promo.goas.info pop up:

A pop-up from cnn.officialreport.info:

While searching at Google’s search engine, cdn1.clktag.com popped up in the status bar:

karriar-magazine.com pop up ad:

Pop-up ad from super-promo.gipi.info:

api.pixelcloudhit.com  in the status bar:

And a pop up from scanscasino.com:

Pop up ad from super-promo.giiy.info:

swf.chequebooksbruising.com in the browser’s status bar:

A pop up from super-promo.giip.info:

and cdn3.org showed up in the network log:

bcp.crwdcntrl.net loaded from google:

anddogen.com in the status bar:

A pop up from super-promo.gurs.info.

A pop up ad about oil-trading from preg.conquer-media.com:

i_sbitinbsjs_info.tlscdn.com showed up in the status bar of Mozilla Firefox while searching at Google. Here’s a dump from the network log.

technologiestuart.com also showed up in the status bar while doing the Google search:

The Wajam adware is responsible for that connection.

A bunch of netdna-ssl.com domains showing up in the Firefox status bar, while searching at Google. The domains were:

• 4x3zy4ql-l8bu4n1j.netdna-ssl.com
• 5k9v3bc1-enehfzfv.netdna-ssl.com
• d13j8bqw-l8bu4n1j.netdna-ssl.com
• j9bruvxk-l8bu4n1j.netdna-ssl.com

   

A pop-up ad from super-promo.gazy.info:

A survey pop-up ad from super-promo.gaol.info:

jscdnbox.com loading while searching at Google:

s.tlscdn.com in Firefox’ status bar:

Here’s isi.envelopspunnet.com in the status bar:

Pop up ad from super-promo.gaah.info:

stat.vidcore.tv in the status bar:

A pop-up from nordicslabel.com:

Adsvids.com in the status bar:

A pop-up ad from super-promo.fuvu.info:

The 8casino-x.com pop up ad:

omq.relievingdungeons.com may show up in your browser’s status bar:

go.herdailyvideos.com in Firefox’ status bar:

bit-search.com in the status bar:

search.smartshopping.com also in the status bar:

tracking.audience.media in the status bar, while searching at Google:

And here’s a pop up from super-promo.grav.info:

cf.vsavr.com in the network log:

prod.vsearchr.com, also in the network log:

A popup ad from super-promo.geew.info:

A pop up from financialsecrets.info.

Other sites that showed up in the network log while doing a search at Google:

• uhl.outspokentameness.com
• foi.slynessduplicating.com
• duu.ragsmarmoset.com
• opl.speculationsanorak.com
• vrr.unfamiliarcartographer.com
• nex.encirclelargish.com
• hev.sedentaryprosecutor.com
• drm.polysyllabicsurrounds.com
• ryz.affiliatedstammer.com
• monetserv.info
• nwv.vicescappuccino.com
• a.global-cdn.co
• pki.dowagersinimitable.com
• vmx.pukingtwirled.com
• yqg.employscitrate.com
• hzm.maximumfireplaces.com
• app.keymaxbit.com
• logs.keymaxbit.com
• ezl.allegesmourns.com
• tki.chimpanzeepooling.com
• www.unionismstream.com
• eam.duchessestallying.com
• ech.parallaxindecision.com
• www.physicianapologises.com
• www.decomposeselbows.com
• www.centrifugescompletions.com
• www.riderdismantled.com
• vsb.tatlocalisation.com
• yfv.humpstows.com
• dfe.contributorymethods.com
• hql.flirtationafricans.com
• sgn.egyptianobservably.com
• arj.keelconjectured.com
• t1.extreme-dm.com
• xhd.handbagoverturn.com
• yze.farcataclysm.com
• app.pricemoon.co
• jsgnr.pricemoon.co
• cwbl.pricemoon.co
• horusjs.s3.amazonaws.com
• i_crbfmcjs_info.tlscdn.com
• cdn.gosignserv.com
• c.crbsjs.info
• q.megainbsjs.info
• r6.kelkoo.com
• r.kelkoo.com
• m.megainbsjs.info
• adsroute.adk2x.com
• connect.facebook.net
• d2nq0f8d9ofdwv.cloudfront.net
• cdn.adpdx.com
• p.adpdx.com
• wcp.commonwealthprussia.com
• qzd.haemophiliacontextualisation.com

A few other sites that appeared in my network log:

• js.bitgenmax.com
• app.newcloudrack.com
• logs.newcloudrack.com
• js.newcloudrack.com
• js.keymaxbit.com
• m2.macutnova.com
• app.bitgenmax.com
• logs.bitgenmax.com
• c.megainbsjs.info
• f.asdfzxcv1312.com
• s.megainbsjs.info
• f.megainbsjs.info
• app.cloudmaxbox.com
• logs.cloudmaxbox.com
• d2avx7g1ttwebd.cloudfront.net
• d21r4q0rdzodf.cloudfront.net
• js.cloudmaxbox.com
• app.devgokey.com
• logs.devgokey.com
• js.devgokey.com
• danv01ao0kdr2.cloudfront.net
• portal.brandlock.io

Ran into a file signed by BoxI DJV.

Ran into a file signed by Media Theory (Fried Cookie Ltd):

Somewhat unrelated, but I’ve also run into a add-on called FirefixTab 0.1.13: