Pop Up Ads and Status Bar Messages – October 2015

If you have been following me on the blog for the last six months you know that I often write about how to remove pop up ads and how to remove unwanted sites showing up in the browser’s status bar. In those blog posts, I show how to track down and remove unwanted software by using the 1) Windows Control Panel, 2) the browser’s add-on dialog or 3) with the FreeFixer removal tool.

I often write a new blog post for each site that I find, which is quite time-consuming. The upcoming months I’ll be focusing on developing some back-end stuff for FreeFixer so I can’t be as active as I use to be on the blog. But I will at least summarise the finds that I do, with a screenshot, and post them here.

A pop up from se-arlig-undersokning.xyz:


spartoo.se pop up:

spartoo.se pop up

barnebys.se pop up:

barnebys.se pop up

us.fps-pb.com pop up:

us.fps-pb.com pop up

and a pop up ad from luxuryslotonline.com:

luxuryslotonline.com pop up

A pop up from d31f5ec245utk2.cloudfront.net:

d31f5ec245utk2.cloudfront.net pop up

go.leguide.com pop up:

go.leguide.com pop up

dream-marriage.com pop up:

dream-marriage.com pop up

tracking.tfxiq.net in the status bar:


Pop up from machine.billionoptions.net:


Pop up from aftonbladet.se.05b.xyz:

aftonbladet.se.05b.xyz pop up

kds.adspirit.de pop up:

kds.adspirit.de pop up

A pop up from chachagong23.com:

chachagong23.com pop up

dry.papaerleaf.com in the status bar:


super-promo.guqu.info pop up:


rqf.receptorirrigated.com in the status bar:


A pop up ad from 123mymovies.com:

123mymovies.com pop up

adss.comeadvertisewithus.com in Firefox’ status bar:


A pop up from static.millionairetruth.com:

static.millionairetruth.com pop up

gets.attracteffectclub.info in the status bar:


A pop-up ad from super-promo.gufu.info:

super-promo.gufu.info pop up

While doing at search at Google, ads.egrana.com.br showed up in the status bar:

ads.egrana.com.br status bar

pinsght.com in the status bar:


super-promo.goas.info pop up:

super-promo.goas.info pop up

A pop-up from cnn.officialreport.info:cnn.officialreport.info pop up

While searching at Google’s search engine, cdn1.clktag.com popped up in the status bar:

cdn1.clktag.com status bar

karriar-magazine.com pop up ad:

karriar-magazine.com pop up

Pop-up ad from super-promo.gipi.info:


api.pixelcloudhit.com  in the status bar:

api.pixelcloudhit.com status bar

And a pop up from scanscasino.com:

scanscasino.com pop up

Pop up ad from super-promo.giiy.info:


swf.chequebooksbruising.com in the browser’s status bar:


A pop up from super-promo.giip.info:


and cdn3.org showed up in the network log:


bcp.crwdcntrl.net loaded from google:


anddogen.com in the status bar:


A pop up from super-promo.gurs.info.

A pop up ad about oil-trading from preg.conquer-media.com:

preg.conquer-media.com pop up

i_sbitinbsjs_info.tlscdn.com showed up in the status bar of Mozilla Firefox while searching at Google. Here’s a dump from the network log.


technologiestuart.com also showed up in the status bar while doing the Google search:


The Wajam adware is responsible for that connection.

A bunch of netdna-ssl.com domains showing up in the Firefox status bar, while searching at Google. The domains were:

  • 4x3zy4ql-l8bu4n1j.netdna-ssl.com
  • 5k9v3bc1-enehfzfv.netdna-ssl.com
  • d13j8bqw-l8bu4n1j.netdna-ssl.com
  • j9bruvxk-l8bu4n1j.netdna-ssl.com

4x3zy4ql-l8bu4n1j.netdna-ssl.com   5k9v3bc1-enehfzfv.netdna-ssl.com

A pop-up ad from super-promo.gazy.info:

super-promo.gazy.info pop up

A survey pop-up ad from super-promo.gaol.info:

super-promo.gaol.info pop up

jscdnbox.com loading while searching at Google:


s.tlscdn.com in Firefox’ status bar:


Here’s isi.envelopspunnet.com in the status bar:


Pop up ad from super-promo.gaah.info:

super-promo.gaah.info pop up

stat.vidcore.tv in the status bar:


A pop-up from nordicslabel.com:

nordicslabel.com pop up

Adsvids.com in the status bar:


A pop-up ad from super-promo.fuvu.info:

super-promo.fuvu.info pop up

The 8casino-x.com pop up ad:

8casino-x.com pop up

omq.relievingdungeons.com may show up in your browser’s status bar:


go.herdailyvideos.com in Firefox’ status bar:


bit-search.com in the status bar:


search.smartshopping.com also in the status bar:


tracking.audience.media in the status bar, while searching at Google:


And here’s a pop up from super-promo.grav.info:super-promo.grav.info pop up

cf.vsavr.com in the network log:


prod.vsearchr.com, also in the network log:


A popup ad from super-promo.geew.info:

super-promo.geew.info pop up

A pop up from financialsecrets.info.

Other sites that showed up in the network log while doing a search at Google:

  • uhl.outspokentameness.com
  • foi.slynessduplicating.com
  • duu.ragsmarmoset.com
  • opl.speculationsanorak.com
  • vrr.unfamiliarcartographer.com
  • nex.encirclelargish.com
  • hev.sedentaryprosecutor.com
  • drm.polysyllabicsurrounds.com
  • ryz.affiliatedstammer.com
  • monetserv.info
  • nwv.vicescappuccino.com
  • a.global-cdn.co
  • pki.dowagersinimitable.com
  • vmx.pukingtwirled.com
  • yqg.employscitrate.com
  • hzm.maximumfireplaces.com
  • app.keymaxbit.com
  • logs.keymaxbit.com
  • ezl.allegesmourns.com
  • tki.chimpanzeepooling.com
  • www.unionismstream.com
  • eam.duchessestallying.com
  • ech.parallaxindecision.com
  • www.physicianapologises.com
  • www.decomposeselbows.com
  • www.centrifugescompletions.com
  • www.riderdismantled.com
  • vsb.tatlocalisation.com
  • yfv.humpstows.com
  • dfe.contributorymethods.com
  • hql.flirtationafricans.com
  • sgn.egyptianobservably.com
  • arj.keelconjectured.com
  • t1.extreme-dm.com
  • xhd.handbagoverturn.com
  • yze.farcataclysm.com
  • app.pricemoon.co
  • jsgnr.pricemoon.co
  • cwbl.pricemoon.co
  • horusjs.s3.amazonaws.com
  • i_crbfmcjs_info.tlscdn.com
  • cdn.gosignserv.com
  • c.crbsjs.info
  • q.megainbsjs.info
  • r6.kelkoo.com
  • r.kelkoo.com
  • m.megainbsjs.info
  • adsroute.adk2x.com
  • connect.facebook.net
  • d2nq0f8d9ofdwv.cloudfront.net
  • cdn.adpdx.com
  • p.adpdx.com
  • wcp.commonwealthprussia.com
  • qzd.haemophiliacontextualisation.com

A few other sites that appeared in my network log:

  • js.bitgenmax.com
  • app.newcloudrack.com
  • logs.newcloudrack.com
  • js.newcloudrack.com
  • js.keymaxbit.com
  • m2.macutnova.com
  • app.bitgenmax.com
  • logs.bitgenmax.com
  • c.megainbsjs.info
  • f.asdfzxcv1312.com
  • s.megainbsjs.info
  • f.megainbsjs.info
  • app.cloudmaxbox.com
  • logs.cloudmaxbox.com
  • d2avx7g1ttwebd.cloudfront.net
  • d21r4q0rdzodf.cloudfront.net
  • js.cloudmaxbox.com
  • app.devgokey.com
  • logs.devgokey.com
  • js.devgokey.com
  • danv01ao0kdr2.cloudfront.net
  • portal.brandlock.io

Ran into a file signed by BoxI DJV.

BoxI DJV file

Ran into a file signed by Media Theory (Fried Cookie Ltd):

Media Theory (Fried Cookie Ltd)

Somewhat unrelated, but I’ve also run into a add-on called FirefixTab 0.1.13:

FirefixTab 0.1.13


1 thought on “Pop Up Ads and Status Bar Messages – October 2015

  1. Hi there and thank you for your hard work!! 🙂
    I have an issue with yfv.humpstows.com and yxo.warmportrait .They keep poping up all the time.I scanned with FreeFixer and carefully examined the results,but I didn’t find anything suspicious when I clicked “more info”,or anything that seems to have a connection with this.Can you please help me with this?
    Thank you!!

Comments are closed.