Adware windows open up when using Mozilla FF

Hi -

I've been having this issue for a month or two when using Firefox and it seems to have gotten worse within the past couple of weeks. This does not happen when I use Google Chrome, which is what I primarily use - only when running Firefox. This is what typically happens:

When Firefox has been idle for a while, I'll go to use it and when I click on a link or within a page that's already open, a new window pops open with some kind of advertisement. The window I'm working in stays open and I have no problem surfing around, and no issues closing the window that pops up. This happens several times a day. Occasionally Avast! will tell me that it's blocked a malicious page when these pop open. The window that opens is not fully functional - it shows the URL of the ad, but I can't type a new address in, copy it, print from it, etc. (I'm sure there's a term for this - maybe it's a frame?)

I'm not sure if this is related or not, but earlier today, Firefox completely stalled when I was trying to use it. The browser window disappeared but the FF icon was visible in my tray and was still running. When I clicked on the icon in my tray to open it back up, it was unresponsive.

I uninstalled Firefox (I'm using Windows 7) using "Uninstall or Change a Program" found in the Control Panel, then ran through the full READ & RUN ME FIRST Malware Removal Guide (incl. spyware, virus, trojan, hijacker) found here.

After doing the above, I rebooted then manually deleted the Firefox installation program from my C drive at C:\Program Files (x86)\Mozilla Firefox as well as C:\Program Files\Mozilla Firefox. I did not remove my user data and settings. I then reloaded Firefox. Things seemed fine, then the adware windows started opening up again. I again had a stalling incident, and when I was able to reopen FF and opened a new tab, it showed these 4 sites as my visiting history:

m.t-pixel.info/mambo?srcid=tfz10

i.i2h5k342.info/ivory?srcid=tfz10

m.t-pixel.info/adam?srcid=tfz10

b.t-pixel.info/bingo?srcid=tfz10

(this was notable as I'd only been to a couple of websites since reloading.)

Fast forward a few hours, and another adware window opens. This time I right clicked on it and went to "View Page Info." This is what it says:

('General' Tab)

"Untitled Page:

Address: sensipoker.com/go.cgi?4

Type: text/html

Render Mode: Quirks Mode

Encoding: UTF-8

Size: 0.09 KB (95 bytes)

Referring URL: adserving.grandclix.com/newServing/go.php?nid=1&cpx=cpv&uid=31946781567043&pid=177628&sid=276401&spid=4901221314&kw=channel:General&af=3&rf=0&curl=http://sensipoker.com/go.cgi?4&chkjs=961582750+32

Modified: Wednesday, March 06, 2013 9:32:00 PM

Security information for this page: This website does not supply ownership information. Connection Not Encrypted."

In this particular instance, the ad did not open. It was blocked and the window says "Reported Attack Page! This web page at domainishere.biz has been reported as an attack page and has been blocked based on your security preferences." etc.

So that's my situation as best as I can describe it. Any help you can offer would be appreciated. Thank you.

 

Done, and no - this did not solve the problem. Still having the issue as described.

 

I tried to disable Avast as best I could, but it may have still been running in the background. Hopefully it didn't affect the results, which are attached.

Thanks again for your help.

 

Yep, that seemed to do it. Thanks so much for your help!

 

Thanks for following up. Just a couple of notes:

Step 5 –

I followed the instructions and double-clicked the .reg file, but when I later went to:

Control Panel > User Accounts and Family Safety > User Accounts > Change User Account Control settings

UAC, was still disabled, so I manually reset it to the default.

Also, under:

Step 10: “How to Protect yourself from malware!”

9) Disable the AutoRuns Feature

there are no instructions for installing the AutoRun patch for Windows 7. I ran the .reg file without having run any updates.

Other than that, it looks like all systems are a go. I began the "undo" process this a.m., so unless there's anything further, I think things are wrapped up?

Again, your assistance is greatly appreciated. Your site has been a lifesaver on a number of occasions, including this one