Solved "dear user, congratulations"-redirect but only on certain sites

[alp0]

*windows 8.1

approx a week ago i checked a site that i haven't visited in a good while (100down org), there was a redirect. didn't think about it much, until the other day i checked another site (shaveclub fi) and had a similar pop-up. i then experimented googling some other sites and those are the only ones so far that redirect. i have not noticed anything else being wrong.


more detailed info:

redirects once, then can be visited normally until switching the router off and back on. just cutting the connection temporarily does not make the ads come back, so i assume it's probably once per ip thing, since i have a dynamic ip address.

seems to occur on both opera and ie, google and bing. it seems i can visit both sites without the pop-up if i go straight to the site from address bar.

there are no ads on 100down org according to opera adblock.

opera adblock seems to block one item on shaveclub fi.


programs i've used and results:

malwarebytes: normal and more thorough search for hidden malware, found stuff related to booking com on normal, nothing on thorough search. nothing malicious.

adwcleaner: pokki and booking files, also at first run it detected but didn't delete C:\Users\Koti\AppData\Local\SweetLabs App Platform. i didn't think much about it, just that it probably had a reason not to delete it, but when i ran adw the second time before i registered here, it did delete it (to no effect). nothing malicious here either.

hitmanpro: seemed to find only tracking cookies, nothing malicious.

zemana: only found "yhs4.search.yahoo com". not malicious

 

[alp0]

some more logs

 

[TwinHeadedEagle]

Hello,

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[alp0]

tried both sites before fixing and shaveclub was as it should, guess they fixed something on their end. unfortunately 100down redirected even after the fix.

 

[TwinHeadedEagle]

Then it is probably related to their website. Your computer seems clean.

 

[alp0]

all right, thank you very much, clint