newpct1.com

Spanish supplemental subscription

Moderator: EasyList Spanish Mods

MrJustMe
New Member
New Member
Posts: 4
Joined: Wed Sep 27, 2017 8:46 am

newpct1.com

Post by MrJustMe »

Ugly and wierd one, i'm not a coder so i don't know nothing about rules or how to block this one, anyway:
The script, add, pop-up or whatever generate a new page with a temporary address similar to this one:

Code: Select all

http://askforhelp.cf/012345678910111...
This temporal page have a message telling you that your machine have been blocked, your hdd content is being deleted and they're trying to get you to call to the phone number: 900 XXX XXX, to get a code to reverse the situation.
This page block your browser, firefox in my case, and in some hardware blocks the entire machine requiring a hard (button) reset. You data is not deleted, if you machine is not blocked, you can stop the firefox process through task manager although your hdd ligth is continuing flashing and a normal windows restart is requiered, after that every is going to normally.

This script is loaded randomly alternating with advertising pages, porno pages, etc. on the following pages:

Code: Select all

http://newpct1.com/
http://tumejortorrent.com/
If you wanna see in it action go there and remember, the scripts loads randomly so perhaps you will have to play a little wih the page to see it in action.
This temporal page have the message in spanish. This clarification is given since I access to those pages from Spain so i do not know if visiting them from a different ip will show the script. For test the problem perhaps a vpn will requiered.

Have a nice day and excuse my English.
intense
Contributor
Contributor
Posts: 10497
Joined: Wed Mar 27, 2013 9:56 am

Post by intense »

Use ublock origin (disable other adblockers)

and test these filters

Code: Select all

.com/*.css$stylesheet,domain=tumejortorrent.com|newpct1.com,third-party
newpct1.com,tumejortorrent.com##script:inject(abort-current-inline-script.js, atob)
MrJustMe
New Member
New Member
Posts: 4
Joined: Wed Sep 27, 2017 8:46 am

Post by MrJustMe »

It works, thanks! and i have added another server to your rule:

Code: Select all

advserver.xyz

Code: Select all

.com/*.css$stylesheet,domain=tumejortorrent.com|newpct1.com|advserver.xyz,third-party
newpct1.com,tumejortorrent.com,advserver.xyz##script:inject(abort-current-inline-script.js, atob)
Question: This rule will be added in next versions of easylist or i have to make a security copy?.
intense
Contributor
Contributor
Posts: 10497
Joined: Wed Mar 27, 2013 9:56 am

Post by intense »

The second filter is uBo specific so it should go into ublock filters [mention]okiehsch[/mention]

(for other specific filters for uBo you could report directly here:
https://github.com/uBlockOrigin/uAssets/issues
)
okiehsch
uBlock Origin Author
uBlock Origin Author
Posts: 98
Joined: Wed Oct 12, 2016 9:00 pm

Post by okiehsch »

Last edited by okiehsch on Wed Sep 27, 2017 9:27 pm, edited 1 time in total.
intense
Contributor
Contributor
Posts: 10497
Joined: Wed Mar 27, 2013 9:56 am

Post by intense »

I corrected the link for filter issues, however the user reported also
advserver.xyz
okiehsch
uBlock Origin Author
uBlock Origin Author
Posts: 98
Joined: Wed Oct 12, 2016 9:00 pm

Post by okiehsch »

||advserver.xyz^$third-party is already part of EasyList, so??
intense
Contributor
Contributor
Posts: 10497
Joined: Wed Mar 27, 2013 9:56 am

Post by intense »

[mention]MrJustMe[/mention]
why did you add advserver.xyz to the filters ?
I thought is another similar site like the others
okiehsch
uBlock Origin Author
uBlock Origin Author
Posts: 98
Joined: Wed Oct 12, 2016 9:00 pm

Post by okiehsch »

OK, you mean this advserver.xyz##script:inject(abort-current-inline-script.js, atob).
advserver.xyz is not related to the other sites, so this filter is pointless.
User avatar
smed79
Liste AR/FR Author
Liste AR/FR Author
Posts: 15839
Joined: Sun Jan 17, 2010 4:00 am
Location: EasyList Forum

Post by smed79 »

@MrJustMe start here viewtopic.php?f=84&t=35435
•► Read RULES / Use forum Search
••► Don't post clickable links
•••►Upload screenshots at imgbb.com
MrJustMe
New Member
New Member
Posts: 4
Joined: Wed Sep 27, 2017 8:46 am

Post by MrJustMe »

intense wrote: Wed Sep 27, 2017 9:51 pm @MrJustMe
why did you add advserver.xyz to the filters ?
I thought is another similar site like the others
Hi, sorry for delay, i was busy.
No it is NOT another site, just i'm not a coder at all, sorry :)

The problem with askforhelp.cf in newpct1.com and tumejortorrent.com seems to be fixed with the first answer in this thread. I just addded the advserver.xyz to fix another problem, it is probably not the correct way but it worked, now i will explain you what happen with that address.
If you play continuosly with newpct1.com and tumejortorrent.com pages, those page seems to continiuous load an script to show advertisings in a new tab, they are random and content all kind of content, porno, virus warnings etc. When this happend, it seems that some script is calling for this page advserver.xyz. If you block advserver.xyz everything returns to normal and all works as you should expect.

Example of the links called:
The script calls the next page in the new tab:
http://advserver.xyz/v2/gena?gid=OVKYGAW2FN&uid=164
In the new tab there is apparently another script that is in charge of calling the random final page that will be shown in the same tab: In this case it called this one:
http://www.adexchangecloud.com/script/preurl.php?r=1580475&sub1=PN164_119_3
Curiously, the page the script have called will not be the final page, it has coincided that this page is similar to the previous one. I mean, it will also call another random page, which finally has been this one.
  • porn link warning
http://crushandflirt.online/buen-polvo/1/?...

I hope my explanation has been usefull to you because my english is not good.
Have a nice day.
intense
Contributor
Contributor
Posts: 10497
Joined: Wed Mar 27, 2013 9:56 am

Post by intense »

Update your "ublock filters", test again.
(no needing to post all those crap links, in the future just post the steps for whatever issue)
MrJustMe
New Member
New Member
Posts: 4
Joined: Wed Sep 27, 2017 8:46 am

Post by MrJustMe »

intense wrote: Thu Sep 28, 2017 3:13 pm Update your "ublock filters", test again.
(no needing to post all those crap links, in the future just post the steps for whatever issue)
Hi again.
Ok, ublock filters updated.
I have remove the following code from "ublock my filters" for test.

Code: Select all

.com/*.css$stylesheet,domain=tumejortorrent.com|newpct1.com,third-party
newpct1.com,tumejortorrent.com##script:inject(abort-current-inline-script.js, atob)
No, do not work. The advserver.xyz continuous calling pages in new tab, sometimes successfully, other times not but this was the same behavior that the page had before i have started posting here.
These pages are torrent download pages so they have a button for it (download your torrent), is when you press this button when you run that script. I have to clarify that before updating the filters the new tabs were opened almost by touching any link on the page, after updating them, it seems that it only does so by pressing the download button, so some of that malicious code must be there.
Now i'm going to bed. Bye.
pizza
Postaholic
Postaholic
Posts: 452
Joined: Sun Jul 09, 2017 7:09 pm

Post by pizza »

Code: Select all

tumejortorrent.com
Until a few days ago it worked well with uBo .. but the Popups have returned
using uBlock Origin in Chrome
intense
Contributor
Contributor
Posts: 10497
Joined: Wed Mar 27, 2013 9:56 am

Post by intense »

try

Code: Select all

tumejortorrent.com##script:inject(abort-current-inline-script.js, parseInt, tabunder)
User avatar
ric
Site Member
Site Member
Posts: 29
Joined: Thu Nov 02, 2017 9:54 pm

Post by ric »

The web newpct1 has changed its name to descargas2020.com. How does this affect the filters? Thanks.
 ! Message from: smed79
Merged forumsearch
Moved from Report unblocked content to EasyList Spanish on Fri Feb 23, 2018 9:29 am by smed79

User avatar
smed79
Liste AR/FR Author
Liste AR/FR Author
Posts: 15839
Joined: Sun Jan 17, 2010 4:00 am
Location: EasyList Forum

Post by smed79 »

add

Code: Select all

|http://$script,third-party,domain=descargas2020.com
|https://$script,third-party,domain=descargas2020.com
@@||code.jquery.com^$script,domain=descargas2020.com
@@||cdnjs.cloudflare.com/ajax/libs/$script,domain=descargas2020.com
or

Code: Select all

/^https?:\/\/www\.[a-z]{8,14}\.(bid|club|co|com|me|pro)\/[a-z]{1,12}\.js$/$script,domain=descargas2020.com
•► Read RULES / Use forum Search
••► Don't post clickable links
•••►Upload screenshots at imgbb.com
User avatar
ric
Site Member
Site Member
Posts: 29
Joined: Thu Nov 02, 2017 9:54 pm

Post by ric »

Want to skip the next pop-up window http://advserver.xyz/v2/gena?gid=OVKYGAW2FN&uid=164
intense
Contributor
Contributor
Posts: 10497
Joined: Wed Mar 27, 2013 9:56 am

Post by intense »

First: provide your feedback on the filters above.
User avatar
ric
Site Member
Site Member
Posts: 29
Joined: Thu Nov 02, 2017 9:54 pm

Post by ric »

All right for me except that pop-up window
User avatar
smed79
Liste AR/FR Author
Liste AR/FR Author
Posts: 15839
Joined: Sun Jan 17, 2010 4:00 am
Location: EasyList Forum

Post by smed79 »

test

Code: Select all

.bid^$popup,domain=descargas2020.com
||advserver.xyz^$popup,third-party
descargas2020.com##a[style]
•► Read RULES / Use forum Search
••► Don't post clickable links
•••►Upload screenshots at imgbb.com
User avatar
ric
Site Member
Site Member
Posts: 29
Joined: Thu Nov 02, 2017 9:54 pm

Post by ric »

It does not work. The pop-up window continues to appear.
User avatar
smed79
Liste AR/FR Author
Liste AR/FR Author
Posts: 15839
Joined: Sun Jan 17, 2010 4:00 am
Location: EasyList Forum

Post by smed79 »

ric wrote: Fri Feb 23, 2018 10:55 pm It does not work. The pop-up window continues to appear.
test using a portable version of browser https://portableapps.com/apps/internet
•► Read RULES / Use forum Search
••► Don't post clickable links
•••►Upload screenshots at imgbb.com
User avatar
ric
Site Member
Site Member
Posts: 29
Joined: Thu Nov 02, 2017 9:54 pm

Post by ric »

Forget this. Thank you very much.
andromeda_90
New Member
New Member
Posts: 5
Joined: Wed Mar 02, 2016 7:26 pm

Post by andromeda_90 »

smed79 wrote: Fri Feb 23, 2018 9:52 am add

Code: Select all

|http://$script,third-party,domain=descargas2020.com
|https://$script,third-party,domain=descargas2020.com
@@||code.jquery.com^$script,domain=descargas2020.com
@@||cdnjs.cloudflare.com/ajax/libs/$script,domain=descargas2020.com
or

Code: Select all

/^https?:\/\/www\.[a-z]{8,14}\.(bid|club|co|com|me|pro)\/[a-z]{1,12}\.js$/$script,domain=descargas2020.com
testing, it seems to work
User avatar
ric
Site Member
Site Member
Posts: 29
Joined: Thu Nov 02, 2017 9:54 pm

Post by ric »

Perdón por adelantado por expresarme en español pero es la única manera de explicarme bien. Tengo activado el bloqueo de ventanas emergentes, también he deshabilitado el filtrado cosmético y además también tengo activa la prohibición de scripts de terceros.Con eso tengo controlada totalmente la cuestión, pero quiere saltar una ventana emergente, no llega a abrirse, se cierra sóla pero no la para la extensión, me salta el aviso en el navegador (Chrome, Opera). Perdón por el rollo y por el idioma. Un saludo y gracias todos.
P.D: los últimos filtros tampoco funcionan para esa cuestión.
diaux
EasyList Spanish Author
EasyList Spanish Author
Posts: 176
Joined: Sat Jan 14, 2017 2:01 am
Location: Mendoza, Argentina

Post by diaux »

No hay problema si usas español en este sub-foro (EasyList Spanish). Si lo que deseas solucionar es el inconveniente de una ventana emergente (popup) que se abre pero se cierra inmediatamente (por el navegador), entonces lamento informarte que no hay solución para eso.
User avatar
ric
Site Member
Site Member
Posts: 29
Joined: Thu Nov 02, 2017 9:54 pm

Post by ric »

Ok. Muchas gracias a todos.
pizza
Postaholic
Postaholic
Posts: 452
Joined: Sun Jul 09, 2017 7:09 pm

Post by pizza »

I find in this post this filter:

Code: Select all

||hitopadxdz.xyz/164/BBTJ6UD9A8/$popup
and now tumejortorrent .com have this: hitopadxdo.xyz
https://i.imgur.com/efytRvv.png

is the same but finished in "o"

this filter maybe works (I changed the last 2 digits of the domain for *) :roll:

Code: Select all

||hitopadx*.xyz/164/BBTJ6UD9A8/$popup,third-party
And with "third-party" works better.
using uBlock Origin in Chrome
User avatar
smed79
Liste AR/FR Author
Liste AR/FR Author
Posts: 15839
Joined: Sun Jan 17, 2010 4:00 am
Location: EasyList Forum

Post by smed79 »

MoveAds.net popups

Code: Select all

||hitopadxdo.xyz^$popup
||hitopadxdy.xyz^$popup
||hitopadxdz.xyz^$popup
||hiqheoidgnqiceoj.bid^$popup
||oiqheoiwgnqiweoj.bid^$popup
||moveads.net^$popup,third-party
propellerads popup + blank ad spaces, add

Code: Select all

##.pub160x600
##.pub300x250
##.pub728x90
torrentlocura.com,tumejortorrent.com##.mod-pubb
torrentlocura.com,tumejortorrent.com##a[style][rel]
•► Read RULES / Use forum Search
••► Don't post clickable links
•••►Upload screenshots at imgbb.com
Locked