EasyList Forum

Posted: **Wed Sep 27, 2017 9:57 am**

Ugly and wierd one, i'm not a coder so i don't know nothing about rules or how to block this one, anyway:
The script, add, pop-up or whatever generate a new page with a temporary address similar to this one:

Code: Select all

http://askforhelp.cf/012345678910111...

This temporal page have a message telling you that your machine have been blocked, your hdd content is being deleted and they're trying to get you to call to the phone number: 900 XXX XXX, to get a code to reverse the situation.
This page block your browser, firefox in my case, and in some hardware blocks the entire machine requiring a hard (button) reset. You data is not deleted, if you machine is not blocked, you can stop the firefox process through task manager although your hdd ligth is continuing flashing and a normal windows restart is requiered, after that every is going to normally.

This script is loaded randomly alternating with advertising pages, porno pages, etc. on the following pages:

Code: Select all

http://newpct1.com/
http://tumejortorrent.com/

If you wanna see in it action go there and remember, the scripts loads randomly so perhaps you will have to play a little wih the page to see it in action.
This temporal page have the message in spanish. This clarification is given since I access to those pages from Spain so i do not know if visiting them from a different ip will show the script. For test the problem perhaps a vpn will requiered.

Have a nice day and excuse my English.

Posted: **Wed Sep 27, 2017 10:38 am**

Use ublock origin (disable other adblockers)

and test these filters

Code: Select all

.com/*.css$stylesheet,domain=tumejortorrent.com|newpct1.com,third-party
newpct1.com,tumejortorrent.com##script:inject(abort-current-inline-script.js, atob)

Posted: **Wed Sep 27, 2017 11:10 am**

It works, thanks! and i have added another server to your rule:

Code: Select all

advserver.xyz

Code: Select all

.com/*.css$stylesheet,domain=tumejortorrent.com|newpct1.com|advserver.xyz,third-party
newpct1.com,tumejortorrent.com,advserver.xyz##script:inject(abort-current-inline-script.js, atob)

Question: This rule will be added in next versions of easylist or i have to make a security copy?.

Posted: **Wed Sep 27, 2017 11:24 am**

The second filter is uBo specific so it should go into ublock filters [mention]okiehsch[/mention]

(for other specific filters for uBo you could report directly here:
https://github.com/uBlockOrigin/uAssets/issues
)

Posted: **Wed Sep 27, 2017 9:09 pm**

Added https://github.com/uBlockOrigin/uAssets ... ab5a64daf3

Posted: **Wed Sep 27, 2017 9:14 pm**

I corrected the link for filter issues, however the user reported also
advserver.xyz

Posted: **Wed Sep 27, 2017 9:26 pm**

||advserver.xyz^$third-party is already part of EasyList, so??

Posted: **Wed Sep 27, 2017 9:51 pm**

[mention]MrJustMe[/mention]
why did you add advserver.xyz to the filters ?
I thought is another similar site like the others

Posted: **Wed Sep 27, 2017 10:01 pm**

OK, you mean this advserver.xyz##script:inject(abort-current-inline-script.js, atob).
advserver.xyz is not related to the other sites, so this filter is pointless.

Posted: **Wed Sep 27, 2017 11:30 pm**

@MrJustMe start here viewtopic.php?f=84&t=35435

Posted: **Thu Sep 28, 2017 2:56 pm**

intense wrote: ↑Wed Sep 27, 2017 9:51 pm @MrJustMe
why did you add advserver.xyz to the filters ?
I thought is another similar site like the others

Hi, sorry for delay, i was busy.
No it is NOT another site, just i'm not a coder at all, sorry

The problem with askforhelp.cf in newpct1.com and tumejortorrent.com seems to be fixed with the first answer in this thread. I just addded the advserver.xyz to fix another problem, it is probably not the correct way but it worked, now i will explain you what happen with that address.
If you play continuosly with newpct1.com and tumejortorrent.com pages, those page seems to continiuous load an script to show advertisings in a new tab, they are random and content all kind of content, porno, virus warnings etc. When this happend, it seems that some script is calling for this page advserver.xyz. If you block advserver.xyz everything returns to normal and all works as you should expect.

Example of the links called:
The script calls the next page in the new tab:
http://advserver.xyz/v2/gena?gid=OVKYGAW2FN&uid=164
In the new tab there is apparently another script that is in charge of calling the random final page that will be shown in the same tab: In this case it called this one:
http://www.adexchangecloud.com/script/preurl.php?r=1580475&sub1=PN164_119_3
Curiously, the page the script have called will not be the final page, it has coincided that this page is similar to the previous one. I mean, it will also call another random page, which finally has been this one.

porn link warning

http://crushandflirt.online/buen-polvo/1/?...

I hope my explanation has been usefull to you because my english is not good.
Have a nice day.

Posted: **Thu Sep 28, 2017 3:13 pm**

Update your "ublock filters", test again.
(no needing to post all those crap links, in the future just post the steps for whatever issue)

Posted: **Fri Sep 29, 2017 12:06 am**

intense wrote: ↑Thu Sep 28, 2017 3:13 pm Update your "ublock filters", test again.
(no needing to post all those crap links, in the future just post the steps for whatever issue)

Hi again.
Ok, ublock filters updated.
I have remove the following code from "ublock my filters" for test.

Code: Select all

.com/*.css$stylesheet,domain=tumejortorrent.com|newpct1.com,third-party
newpct1.com,tumejortorrent.com##script:inject(abort-current-inline-script.js, atob)

No, do not work. The advserver.xyz continuous calling pages in new tab, sometimes successfully, other times not but this was the same behavior that the page had before i have started posting here.
These pages are torrent download pages so they have a button for it (download your torrent), is when you press this button when you run that script. I have to clarify that before updating the filters the new tabs were opened almost by touching any link on the page, after updating them, it seems that it only does so by pressing the download button, so some of that malicious code must be there.
Now i'm going to bed. Bye.

Posted: **Tue Nov 28, 2017 2:07 pm**

Code: Select all

tumejortorrent.com

Until a few days ago it worked well with uBo .. but the Popups have returned

Posted: **Tue Nov 28, 2017 2:28 pm**

try

Code: Select all

tumejortorrent.com##script:inject(abort-current-inline-script.js, parseInt, tabunder)

Posted: **Fri Feb 23, 2018 8:58 am**

The web newpct1 has changed its name to descargas2020.com. How does this affect the filters? Thanks.

!	Message from: smed79
	Merged forumsearch

Posted: **Fri Feb 23, 2018 9:52 am**

add

Code: Select all

|http://$script,third-party,domain=descargas2020.com
|https://$script,third-party,domain=descargas2020.com
@@||code.jquery.com^$script,domain=descargas2020.com
@@||cdnjs.cloudflare.com/ajax/libs/$script,domain=descargas2020.com

or

Code: Select all

/^https?:\/\/www\.[a-z]{8,14}\.(bid|club|co|com|me|pro)\/[a-z]{1,12}\.js$/$script,domain=descargas2020.com

Posted: **Fri Feb 23, 2018 10:22 am**

Want to skip the next pop-up window http://advserver.xyz/v2/gena?gid=OVKYGAW2FN&uid=164

Posted: **Fri Feb 23, 2018 10:45 am**

First: provide your feedback on the filters above.

Posted: **Fri Feb 23, 2018 10:54 am**

All right for me except that pop-up window

Posted: **Fri Feb 23, 2018 6:06 pm**

test

Code: Select all

.bid^$popup,domain=descargas2020.com
||advserver.xyz^$popup,third-party
descargas2020.com##a[style]

Posted: **Fri Feb 23, 2018 10:55 pm**

It does not work. The pop-up window continues to appear.

Posted: **Fri Feb 23, 2018 11:06 pm**

ric wrote: ↑Fri Feb 23, 2018 10:55 pm It does not work. The pop-up window continues to appear.

test using a portable version of browser https://portableapps.com/apps/internet

Posted: **Sun Feb 25, 2018 9:29 am**

Forget this. Thank you very much.

Posted: **Mon Feb 26, 2018 8:35 pm**

smed79 wrote: ↑Fri Feb 23, 2018 9:52 am add

Code: Select all

|http://$script,third-party,domain=descargas2020.com
|https://$script,third-party,domain=descargas2020.com
@@||code.jquery.com^$script,domain=descargas2020.com
@@||cdnjs.cloudflare.com/ajax/libs/$script,domain=descargas2020.com

or

Code: Select all

/^https?:\/\/www\.[a-z]{8,14}\.(bid|club|co|com|me|pro)\/[a-z]{1,12}\.js$/$script,domain=descargas2020.com

testing, it seems to work

Posted: **Tue Feb 27, 2018 10:53 am**

Perdón por adelantado por expresarme en español pero es la única manera de explicarme bien. Tengo activado el bloqueo de ventanas emergentes, también he deshabilitado el filtrado cosmético y además también tengo activa la prohibición de scripts de terceros.Con eso tengo controlada totalmente la cuestión, pero quiere saltar una ventana emergente, no llega a abrirse, se cierra sóla pero no la para la extensión, me salta el aviso en el navegador (Chrome, Opera). Perdón por el rollo y por el idioma. Un saludo y gracias todos.
P.D: los últimos filtros tampoco funcionan para esa cuestión.

Posted: **Wed Feb 28, 2018 5:51 pm**

No hay problema si usas español en este sub-foro (EasyList Spanish). Si lo que deseas solucionar es el inconveniente de una ventana emergente (popup) que se abre pero se cierra inmediatamente (por el navegador), entonces lamento informarte que no hay solución para eso.

Posted: **Thu Mar 01, 2018 9:00 am**

Ok. Muchas gracias a todos.

Posted: **Wed May 02, 2018 12:59 am**

I find in this post this filter:

Code: Select all

||hitopadxdz.xyz/164/BBTJ6UD9A8/$popup

and now tumejortorrent .com have this: hitopadxdo.xyz
https://i.imgur.com/efytRvv.png

is the same but finished in "o"

this filter maybe works (I changed the last 2 digits of the domain for *)

Code: Select all

||hitopadx*.xyz/164/BBTJ6UD9A8/$popup,third-party

And with "third-party" works better.

Posted: **Wed May 02, 2018 2:00 am**

MoveAds.net popups

Code: Select all

||hitopadxdo.xyz^$popup
||hitopadxdy.xyz^$popup
||hitopadxdz.xyz^$popup
||hiqheoidgnqiceoj.bid^$popup
||oiqheoiwgnqiweoj.bid^$popup
||moveads.net^$popup,third-party

propellerads popup + blank ad spaces, add

Code: Select all

##.pub160x600
##.pub300x250
##.pub728x90
torrentlocura.com,tumejortorrent.com##.mod-pubb
torrentlocura.com,tumejortorrent.com##a[style][rel]

EasyList Forum

newpct1.com

newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com

Re: newpct1.com