The sdf.ly is what shows up in my browser window, dozens of them. I researched the condition and it seems to be a money making scheme by having these websites pop up automatically and if the user clicks on one of them the sender makes a few pennies. The real problem is that it's opening dozens of them, even if my browser is closed - and I can't stop it. I have managed to block the opening of the page with Viper, and now it just opens dozens of pages with blocked by Viper. I've looked for hidden scripts everywhere, everything points to "winlogon.exe", I've scanned it and replaced it - so somewhere there's a script writing to it. I also tried MalwareBytes. Any ideas?