https://encrypted-tbn1.gstatic.com/shopping

[mynameisnotspam]

https://www.google.ca/search?q=1.3 mete ... 0gSTv5LwAw


How do I block these and the container?

Thanks

[LanikSJ]

Update your filters first. For the record i'm not seeing the sponsored ads.

[intense]

which is the complete text: "sponsored ..." ?

[mynameisnotspam]

Sponsored ADS I think, sorry

Here is more

[intense]

Could you try firefox ? (now you are using pale moon I guess...)

[mynameisnotspam]

Not trying to be rude, I dont use FF anymore even to test.

More ads

https://www.google.ca/search?q=laptop i ... arch&hl=en

[intense]

probably it's malware / adware
see
faq.php#f11r0

see also
http://malwaretips.com/blogs/remove-sponsored-ads/

[mynameisnotspam]

malware that comes from Google itself?

[mynameisnotspam]

Code: Select all

# Support : http://toolslib.net/forum



***** [ Services ] *****





***** [ Folders ] *****





***** [ Files ] *****





***** [ Shortcuts ] *****





***** [ Scheduled tasks ] *****





***** [ Registry ] *****





***** [ Web browsers ] *****



[C:\Users\JohnDoe\AppData\Roaming\Moonchild Productions\Pale Moon\Profiles\tjg5dh7f.default\prefs.js] [Preference] Found : user_pref("browser.startup.homepage", " hxxps://ixquick.com/do/mypage.pl?prf=bd77df3c1c893016b386dac4aba31b2d ");



########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [800 bytes] ##########

Nothing...will try mbam and this one in safemode.
It's well known adwcleaner dislikes ixquick so I did not "fix" this.

[LanikSJ]

It's well known adwcleaner dislikes ixquick so I did not "fix" this.

I suggest resetting it to google.com or google.ca (I presume). Unless you set that ixquick page yourself.

Also it looks like I can reproduce this in Chrome on google.ca NOT google.com:
https://www.google.ca/search?q=laptop i ... arch&hl=en

Code: Select all

google.ca###center_col > div:nth-of-type(2)

google.ca###_Stg

https://www.google.com/search?q=laptop ... arch&hl=en
No ads.

[mynameisnotspam]

Yes I do like Ixquick instead of Google, but I still use google for right-click searches...
Mbam came up clean also.

Code: Select all

Malwarebytes Anti-Malware

http://www.malwarebytes.org



Scan Date: 9/6/2015

Scan Time: 2:07 AM

Logfile: wtf.txt

Administrator: Yes



Version: 2.1.8.1057

Malware Database: v2015.09.06.02

Rootkit Database: v2015.08.16.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled



OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: JohnDoe



Scan Type: Threat Scan

Result: Completed

Objects Scanned: 331153

Time Elapsed: 6 min, 17 sec



Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled



Processes: 0

(No malicious items detected)



Modules: 0

(No malicious items detected)



Registry Keys: 2

Hijack.SecurityRun, HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\PATHS\{48D87BF0-9ACC-4133-9827-8A1BD16C4C01}, , [7238af7ded9ea29489d6c7a4b94b55ab], 

Hijack.SecurityRun, HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\PATHS\{48D87BF0-9ACC-4133-9827-8A1BD16C4C01}, , [4466fd2fb5d6c4726df25e0d9a6a728e], 



Registry Values: 2

Hijack.SecurityRun, HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\PATHS\{48d87bf0-9acc-4133-9827-8a1bd16c4c01}|ItemData, C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe, , [7238af7ded9ea29489d6c7a4b94b55ab]

Hijack.SecurityRun, HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS\0\PATHS\{48d87bf0-9acc-4133-9827-8a1bd16c4c01}|ItemData, C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe, , [4466fd2fb5d6c4726df25e0d9a6a728e]



Registry Data: 0

(No malicious items detected)



Folders: 0

(No malicious items detected)



Files: 0

(No malicious items detected)



Physical Sectors: 0

(No malicious items detected)





(end)

It detected my group policies to block AntiVir's update nag...but no malware.

[mynameisnotspam]

https://www.google.ca/search?q=laptop i ... arch&hl=en

Code: Select all

google.ca###center_col > div:nth-of-type(2)

google.ca###_Stg

https://www.google.com/search?q=laptop ... arch&hl=en
No ads.

This worked.
Ads gone, thank you

[mynameisnotspam]

Code: Select all

google.ca###center_col > div:nth-of-type(2)

Might be a little too good though...

[LanikSJ]

How about:

Code: Select all

google.ca###center_col > div:nth-of-type(2) > div

[mynameisnotspam]

How about:

Code: Select all

google.ca###center_col > div:nth-of-type(2) > div

Same result

[LanikSJ]

Sorry that's about what I know (which is to say very little). Hopefully someone else can figure it out.

[mynameisnotspam]

Code: Select all

google.ca###_Stg

This does work.
I had to delete google.ca cookies and refresh to get rid of the ad images.
Please add it to the easylist.

Thank you

[mynameisnotspam]

The ads are back.

<div style="margin-top:4px">

<table class="ts">
<tbody>
<tr>
<td valign="top">
<div class="_cf" style="overflow:hidden">
<a href="http://www.google.ca/aclk?sa=L&ai=C94CG ... MBB10C.htm">
<span class="_Dkf" style="height:86px;width:86px">
<span class="_qYc"></span>
<img class="_DPg" width="86" height="86" src="https://encrypted-tbn0.gstatic.com/shop ... s&usqp=CAc" alt="Wood Framed Chalkboard 24"x30""></img>
</span>
</a>
<div style="height:2.4em;overflow:hidden"> … </div>
<div> … </div>
<div> … </div>
</div>