newpct1.com

Spanish supplemental subscription

Moderators: EasyList Authors, EasyList Spanish Mods

MrJustMe
New Member
New Member
Posts: 4
Joined: Wed Sep 27, 2017 8:46 am
Reputation: 0

newpct1.com

Post by MrJustMe » Wed Sep 27, 2017 9:57 am

Ugly and wierd one, i'm not a coder so i don't know nothing about rules or how to block this one, anyway:
The script, add, pop-up or whatever generate a new page with a temporary address similar to this one:

Code: Select all

http://askforhelp.cf/012345678910111...
This temporal page have a message telling you that your machine have been blocked, your hdd content is being deleted and they're trying to get you to call to the phone number: 900 XXX XXX, to get a code to reverse the situation.
This page block your browser, firefox in my case, and in some hardware blocks the entire machine requiring a hard (button) reset. You data is not deleted, if you machine is not blocked, you can stop the firefox process through task manager although your hdd ligth is continuing flashing and a normal windows restart is requiered, after that every is going to normally.

This script is loaded randomly alternating with advertising pages, porno pages, etc. on the following pages:

Code: Select all

http://newpct1.com/
http://tumejortorrent.com/
If you wanna see in it action go there and remember, the scripts loads randomly so perhaps you will have to play a little wih the page to see it in action.
This temporal page have the message in spanish. This clarification is given since I access to those pages from Spain so i do not know if visiting them from a different ip will show the script. For test the problem perhaps a vpn will requiered.

Have a nice day and excuse my English.

intense
Contributor
Contributor
Posts: 8019
Joined: Wed Mar 27, 2013 9:56 am
Reputation: 120

Post by intense » Wed Sep 27, 2017 10:38 am

Use ublock origin (disable other adblockers)

and test these filters

Code: Select all

.com/*.css$stylesheet,domain=tumejortorrent.com|newpct1.com,third-party
newpct1.com,tumejortorrent.com##script:inject(abort-current-inline-script.js, atob)

MrJustMe
New Member
New Member
Posts: 4
Joined: Wed Sep 27, 2017 8:46 am
Reputation: 0

Post by MrJustMe » Wed Sep 27, 2017 11:10 am

It works, thanks! and i have added another server to your rule:

Code: Select all

advserver.xyz

Code: Select all

.com/*.css$stylesheet,domain=tumejortorrent.com|newpct1.com|advserver.xyz,third-party
newpct1.com,tumejortorrent.com,advserver.xyz##script:inject(abort-current-inline-script.js, atob)
Question: This rule will be added in next versions of easylist or i have to make a security copy?.

intense
Contributor
Contributor
Posts: 8019
Joined: Wed Mar 27, 2013 9:56 am
Reputation: 120

Post by intense » Wed Sep 27, 2017 11:24 am

The second filter is uBo specific so it should go into ublock filters @okiehsch

(for other specific filters for uBo you could report directly here:
https://github.com/uBlockOrigin/uAssets/issues
)

okiehsch
uBlock Origin Author
uBlock Origin Author
Posts: 74
Joined: Wed Oct 12, 2016 9:00 pm
Reputation: 7

Post by okiehsch » Wed Sep 27, 2017 9:09 pm

Last edited by okiehsch on Wed Sep 27, 2017 9:27 pm, edited 1 time in total.

intense
Contributor
Contributor
Posts: 8019
Joined: Wed Mar 27, 2013 9:56 am
Reputation: 120

Post by intense » Wed Sep 27, 2017 9:14 pm

I corrected the link for filter issues, however the user reported also
advserver.xyz

okiehsch
uBlock Origin Author
uBlock Origin Author
Posts: 74
Joined: Wed Oct 12, 2016 9:00 pm
Reputation: 7

Post by okiehsch » Wed Sep 27, 2017 9:26 pm

||advserver.xyz^$third-party is already part of EasyList, so??

intense
Contributor
Contributor
Posts: 8019
Joined: Wed Mar 27, 2013 9:56 am
Reputation: 120

Post by intense » Wed Sep 27, 2017 9:51 pm

@MrJustMe
why did you add advserver.xyz to the filters ?
I thought is another similar site like the others

okiehsch
uBlock Origin Author
uBlock Origin Author
Posts: 74
Joined: Wed Oct 12, 2016 9:00 pm
Reputation: 7

Post by okiehsch » Wed Sep 27, 2017 10:01 pm

OK, you mean this advserver.xyz##script:inject(abort-current-inline-script.js, atob).
advserver.xyz is not related to the other sites, so this filter is pointless.

User avatar
smed79
Liste AR Author
Liste AR Author
Posts: 13757
Joined: Sun Jan 17, 2010 4:00 am
Reputation: 141
Location: EasyList Forum

Post by smed79 » Wed Sep 27, 2017 11:30 pm

@MrJustMe start here viewtopic.php?f=84&t=35435
•► Before posting, to find your answer fast, read Forum « RULES » and use « Search »
••► Don't post clickable links » use inline text bbcode notation « [ C ] » or « [ code ] »
•••► Use imgur.com, imgbb.com or vgy.me to upload your screenshots

MrJustMe
New Member
New Member
Posts: 4
Joined: Wed Sep 27, 2017 8:46 am
Reputation: 0

Post by MrJustMe » Thu Sep 28, 2017 2:56 pm

intense wrote:
Wed Sep 27, 2017 9:51 pm
@MrJustMe
why did you add advserver.xyz to the filters ?
I thought is another similar site like the others
Hi, sorry for delay, i was busy.
No it is NOT another site, just i'm not a coder at all, sorry :)

The problem with askforhelp.cf in newpct1.com and tumejortorrent.com seems to be fixed with the first answer in this thread. I just addded the advserver.xyz to fix another problem, it is probably not the correct way but it worked, now i will explain you what happen with that address.
If you play continuosly with newpct1.com and tumejortorrent.com pages, those page seems to continiuous load an script to show advertisings in a new tab, they are random and content all kind of content, porno, virus warnings etc. When this happend, it seems that some script is calling for this page advserver.xyz. If you block advserver.xyz everything returns to normal and all works as you should expect.

Example of the links called:
The script calls the next page in the new tab:
http://advserver.xyz/v2/gena?gid=OVKYGAW2FN&uid=164
In the new tab there is apparently another script that is in charge of calling the random final page that will be shown in the same tab: In this case it called this one:
http://www.adexchangecloud.com/script/preurl.php?r=1580475&sub1=PN164_119_3
Curiously, the page the script have called will not be the final page, it has coincided that this page is similar to the previous one. I mean, it will also call another random page, which finally has been this one.
  • porn link warning
http://crushandflirt.online/buen-polvo/1/?...

I hope my explanation has been usefull to you because my english is not good.
Have a nice day.

intense
Contributor
Contributor
Posts: 8019
Joined: Wed Mar 27, 2013 9:56 am
Reputation: 120

Post by intense » Thu Sep 28, 2017 3:13 pm

Update your "ublock filters", test again.
(no needing to post all those crap links, in the future just post the steps for whatever issue)

MrJustMe
New Member
New Member
Posts: 4
Joined: Wed Sep 27, 2017 8:46 am
Reputation: 0

Post by MrJustMe » Fri Sep 29, 2017 12:06 am

intense wrote:
Thu Sep 28, 2017 3:13 pm
Update your "ublock filters", test again.
(no needing to post all those crap links, in the future just post the steps for whatever issue)
Hi again.
Ok, ublock filters updated.
I have remove the following code from "ublock my filters" for test.

Code: Select all

.com/*.css$stylesheet,domain=tumejortorrent.com|newpct1.com,third-party
newpct1.com,tumejortorrent.com##script:inject(abort-current-inline-script.js, atob)
No, do not work. The advserver.xyz continuous calling pages in new tab, sometimes successfully, other times not but this was the same behavior that the page had before i have started posting here.
These pages are torrent download pages so they have a button for it (download your torrent), is when you press this button when you run that script. I have to clarify that before updating the filters the new tabs were opened almost by touching any link on the page, after updating them, it seems that it only does so by pressing the download button, so some of that malicious code must be there.
Now i'm going to bed. Bye.

pizza
Postaholic
Postaholic
Posts: 228
Joined: Sun Jul 09, 2017 7:09 pm
Reputation: 1

Post by pizza » Tue Nov 28, 2017 2:07 pm

Code: Select all

tumejortorrent.com
Until a few days ago it worked well with uBo .. but the Popups have returned

intense
Contributor
Contributor
Posts: 8019
Joined: Wed Mar 27, 2013 9:56 am
Reputation: 120

Post by intense » Tue Nov 28, 2017 2:28 pm

try

Code: Select all

tumejortorrent.com##script:inject(abort-current-inline-script.js, parseInt, tabunder)

User avatar
ric
New Member
New Member
Posts: 9
Joined: Thu Nov 02, 2017 9:54 pm
Reputation: 0

Post by ric » Fri Feb 23, 2018 8:58 am

The web newpct1 has changed its name to descargas2020.com. How does this affect the filters? Thanks.
 ! Message from: smed79
Merged forumsearch

User avatar
smed79
Liste AR Author
Liste AR Author
Posts: 13757
Joined: Sun Jan 17, 2010 4:00 am
Reputation: 141
Location: EasyList Forum

Post by smed79 » Fri Feb 23, 2018 9:52 am

add

Code: Select all

|http://$script,third-party,domain=descargas2020.com
|https://$script,third-party,domain=descargas2020.com
@@||code.jquery.com^$script,domain=descargas2020.com
@@||cdnjs.cloudflare.com/ajax/libs/$script,domain=descargas2020.com
or

Code: Select all

/^https?:\/\/www\.[a-z]{8,14}\.(bid|club|co|com|me|pro)\/[a-z]{1,12}\.js$/$script,domain=descargas2020.com
•► Before posting, to find your answer fast, read Forum « RULES » and use « Search »
••► Don't post clickable links » use inline text bbcode notation « [ C ] » or « [ code ] »
•••► Use imgur.com, imgbb.com or vgy.me to upload your screenshots

User avatar
ric
New Member
New Member
Posts: 9
Joined: Thu Nov 02, 2017 9:54 pm
Reputation: 0

Post by ric » Fri Feb 23, 2018 10:22 am

Want to skip the next pop-up window http://advserver.xyz/v2/gena?gid=OVKYGAW2FN&uid=164

intense
Contributor
Contributor
Posts: 8019
Joined: Wed Mar 27, 2013 9:56 am
Reputation: 120

Post by intense » Fri Feb 23, 2018 10:45 am

First: provide your feedback on the filters above.

User avatar
ric
New Member
New Member
Posts: 9
Joined: Thu Nov 02, 2017 9:54 pm
Reputation: 0

Post by ric » Fri Feb 23, 2018 10:54 am

All right for me except that pop-up window

User avatar
smed79
Liste AR Author
Liste AR Author
Posts: 13757
Joined: Sun Jan 17, 2010 4:00 am
Reputation: 141
Location: EasyList Forum

Post by smed79 » Fri Feb 23, 2018 6:06 pm

test

Code: Select all

.bid^$popup,domain=descargas2020.com
||advserver.xyz^$popup,third-party
descargas2020.com##a[style]
•► Before posting, to find your answer fast, read Forum « RULES » and use « Search »
••► Don't post clickable links » use inline text bbcode notation « [ C ] » or « [ code ] »
•••► Use imgur.com, imgbb.com or vgy.me to upload your screenshots

User avatar
ric
New Member
New Member
Posts: 9
Joined: Thu Nov 02, 2017 9:54 pm
Reputation: 0

Post by ric » Fri Feb 23, 2018 10:55 pm

It does not work. The pop-up window continues to appear.

User avatar
smed79
Liste AR Author
Liste AR Author
Posts: 13757
Joined: Sun Jan 17, 2010 4:00 am
Reputation: 141
Location: EasyList Forum

Post by smed79 » Fri Feb 23, 2018 11:06 pm

ric wrote:
Fri Feb 23, 2018 10:55 pm
It does not work. The pop-up window continues to appear.
test using a portable version of browser https://portableapps.com/apps/internet
•► Before posting, to find your answer fast, read Forum « RULES » and use « Search »
••► Don't post clickable links » use inline text bbcode notation « [ C ] » or « [ code ] »
•••► Use imgur.com, imgbb.com or vgy.me to upload your screenshots

User avatar
ric
New Member
New Member
Posts: 9
Joined: Thu Nov 02, 2017 9:54 pm
Reputation: 0

Post by ric » Sun Feb 25, 2018 9:29 am

Forget this. Thank you very much.

andromeda_90
New Member
New Member
Posts: 5
Joined: Wed Mar 02, 2016 7:26 pm
Reputation: 0

Post by andromeda_90 » Mon Feb 26, 2018 8:35 pm

smed79 wrote:
Fri Feb 23, 2018 9:52 am
add

Code: Select all

|http://$script,third-party,domain=descargas2020.com
|https://$script,third-party,domain=descargas2020.com
@@||code.jquery.com^$script,domain=descargas2020.com
@@||cdnjs.cloudflare.com/ajax/libs/$script,domain=descargas2020.com
or

Code: Select all

/^https?:\/\/www\.[a-z]{8,14}\.(bid|club|co|com|me|pro)\/[a-z]{1,12}\.js$/$script,domain=descargas2020.com
testing, it seems to work

User avatar
ric
New Member
New Member
Posts: 9
Joined: Thu Nov 02, 2017 9:54 pm
Reputation: 0

Post by ric » Tue Feb 27, 2018 10:53 am

Perdón por adelantado por expresarme en español pero es la única manera de explicarme bien. Tengo activado el bloqueo de ventanas emergentes, también he deshabilitado el filtrado cosmético y además también tengo activa la prohibición de scripts de terceros.Con eso tengo controlada totalmente la cuestión, pero quiere saltar una ventana emergente, no llega a abrirse, se cierra sóla pero no la para la extensión, me salta el aviso en el navegador (Chrome, Opera). Perdón por el rollo y por el idioma. Un saludo y gracias todos.
P.D: los últimos filtros tampoco funcionan para esa cuestión.

diaux
EasyList Spanish Author
EasyList Spanish Author
Posts: 173
Joined: Sat Jan 14, 2017 2:01 am
Reputation: 3
Location: Mendoza, Argentina

Post by diaux » Wed Feb 28, 2018 5:51 pm

No hay problema si usas español en este sub-foro (EasyList Spanish). Si lo que deseas solucionar es el inconveniente de una ventana emergente (popup) que se abre pero se cierra inmediatamente (por el navegador), entonces lamento informarte que no hay solución para eso.

User avatar
ric
New Member
New Member
Posts: 9
Joined: Thu Nov 02, 2017 9:54 pm
Reputation: 0

Post by ric » Thu Mar 01, 2018 9:00 am

Ok. Muchas gracias a todos.

pizza
Postaholic
Postaholic
Posts: 228
Joined: Sun Jul 09, 2017 7:09 pm
Reputation: 1

Post by pizza » Wed May 02, 2018 12:59 am

I find in this post this filter:

Code: Select all

||hitopadxdz.xyz/164/BBTJ6UD9A8/$popup
and now tumejortorrent .com have this: hitopadxdo.xyz
https://i.imgur.com/efytRvv.png

is the same but finished in "o"

this filter maybe works (I changed the last 2 digits of the domain for *) :roll:

Code: Select all

||hitopadx*.xyz/164/BBTJ6UD9A8/$popup,third-party
And with "third-party" works better.

User avatar
smed79
Liste AR Author
Liste AR Author
Posts: 13757
Joined: Sun Jan 17, 2010 4:00 am
Reputation: 141
Location: EasyList Forum

Post by smed79 » Wed May 02, 2018 2:00 am

MoveAds.net popups

Code: Select all

||hitopadxdo.xyz^$popup
||hitopadxdy.xyz^$popup
||hitopadxdz.xyz^$popup
||hiqheoidgnqiceoj.bid^$popup
||oiqheoiwgnqiweoj.bid^$popup
||moveads.net^$popup,third-party
propellerads popup + blank ad spaces, add

Code: Select all

##.pub160x600
##.pub300x250
##.pub728x90
torrentlocura.com,tumejortorrent.com##.mod-pubb
torrentlocura.com,tumejortorrent.com##a[style][rel]
•► Before posting, to find your answer fast, read Forum « RULES » and use « Search »
••► Don't post clickable links » use inline text bbcode notation « [ C ] » or « [ code ] »
•••► Use imgur.com, imgbb.com or vgy.me to upload your screenshots

Post Reply