Anyone had experience with this virus/popup before?

Batmann77

Honorable
Dec 2, 2013
7
0
10,510
Hey guys.

I turned my computer on this morning, and after accessing the internet, i keep getting these popups every 30 seconds or so from 'us-e-node4.smartyads.com to download a .json file. The file name is different every time a new popup comes up.

I tried a search, but it seems like not many have come across it yet. I did find a suspiciously convenient 'removal tool', but I decided not to download it for obvious reasons.

Ironically, i found a post by someone that was apparently working for said website, and they were asking on the Malwarebytes forum why their website was being listed as malicious.

Anyway, i closed all my internet tabs, re opened it, and now nothing is popping up anymore, but I know these things don't just go away like that.

I have run Avast and Malwarebytes scans, and nothing came up.

Any input will be greatly appreciated, and I will post updates as they come.
 

gilbadon

Distinguished
Jun 16, 2008
67
1
18,610
It could be a add-on for your browser that the browser disabled once you closed and re-opened it. Check for any inactive add-ons you have not seen before and remove them from the system. Some things that cause that behavior do not need to be installed however. Some are just the nature of the website which can take control of your browser until it shuts down. This seems the most likely
 

The malware might not have anything to do with smartyads.com. They may just be using smartyads as a hosting service for their "ad", and their "ad" contains the malware .json. Smartyads still bears responsibility since their screening process for the ads is allowing it to slip through. But since they're just the deliveryman and not the actual authors of the malware, a search under their name may not turn up anything.

Anyway, i closed all my internet tabs, re opened it, and now nothing is popping up anymore, but I know these things don't just go away like that.
It actually might be just that simple. I've seen scripts which "take over" your browser so their ads are displayed on any future pages you open up. When you close the browser, the script is erased from memory and the ads are gone the next time you start up the browser (at least until you revisit the site which was running this malicious script). It's pretty clever programming, and I often wonder why these guys don't use their programming skills for good instead of evil.

Anyway, check your extensions as suggested above. And I'd recommend installing an ad-blocker (I've switched to uBlock Origin ever since Adblock Plus sold out). If you're running Firefox, you may wish to install NoScript as well. That's the nuclear option though, and will break a lot of websites. It took me close to a year building up an exception list in it before I could browse for 15 minutes without having to review which scripts to allow.