sirpig

Q: onclickads.net and other ad pop ups in safari due to flash player?

Hello all,

 

This past week all of the browsers on my computer (google chrome/safari) has been experiencing random popup ads upon click on many websites.

 

These occur when I click somewhere on the website page and happens on almost all websites I go to.

 

The popup usually goes to "onclickads.net" then redirects, usually to mackeeper, but will sometimes redirect to other ads.

 

This morning I thought I identified the issue as a fake flash player that I had installed, so I followed Adobe's "how to uninstall flash player" guide and completely uninstalled flash player.

 

The problem instantly went away and I thought I would never have to deal with the annoying popups ever again.

 

This afternoon, I decided to reinstall Flash Player from Adobe's actual site because I need to use flash player for sites like youtube.

 

After I installed it, the problem with popups came back. Even though I knew that this time, it was definitely the legitimate copy of Flash Player.

 

Frustrated, I uninstalled the flash player again and like magic, the popups and ads went away with it.

 

Now I can still watch youtube videos from chrome because I think it comes with flash player preinstalled, but I would still like to have flash player on my main browser, safari.

 

Does anyone know what could be causing the problem? I don't think adobe would put these annoying ads in flash player.

 

I mean, if there's really no fix, I guess I'll just go with using google chrome when I need to use flash :\

 

Thanks a ton!

MacBook Pro with Retina display, OS X Mavericks (10.9.2)

Posted on Apr 28, 2014 4:32 PM

Close

Q: onclickads.net and other ad pop ups in safari due to flash player?

  • All replies
  • Helpful answers

first Previous Page 3 of 3
  • by Linc Davis,

    Linc Davis Linc Davis Apr 29, 2014 3:13 PM in response to sirpig
    Level 10 (208,037 points)
    Applications
    Apr 29, 2014 3:13 PM in response to sirpig

    208.67.222.222

    208.67.220.220

     

    thats what is says in DNS Servers.

     

    That's not what you had when you ran the test. The DNS server then was the router on the network you were connected to at the time, acting as a proxy.

     

    If you were getting the popups on that network, but not on another one, then while connected to the problem network, please change the DNS settings either to OpenDNS (as above) or to Google DNS (8.8.8.8, 8.8.4.4) and see whether the popups stop.

  • by sirpig,

    sirpig sirpig Apr 29, 2014 4:04 PM in response to thomas_r.
    Level 1 (0 points)
    Apr 29, 2014 4:04 PM in response to thomas_r.

    I came home and as you predicted, the ads immediately came back.

     

    I then manually set my dns settings on my computer to the two that I posted earlier, quit safari and relaunched.

     

    The ads went away.

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Apr 29, 2014 4:08 PM in response to sirpig
    Level 10 (208,037 points)
    Applications
    Apr 29, 2014 4:08 PM in response to sirpig

    There are two possibilities: either your router has been compromised, or the DNS servers used by your ISP have been. The former is more likely.

    Follow the manufacturer's instructions to reset the router to the default state. Usually that involves inserting a paper clip into a pinhole somewhere in the back of the device. Then repeat the initial setup process. Make sure it does not allow remote setup from the Internet. The DNS servers should be set automatically by your ISP.

    If you have a wireless network, it must be secured with WPA 2 encryption. The passwords for the network and the router must each be a string of at least 10 random upper- and lower-case letters and digits, and they should be different. A password that you can remember is too weak.

  • by groundhog75,

    groundhog75 groundhog75 Apr 29, 2014 8:28 PM in response to sirpig
    Level 1 (0 points)
    Apr 29, 2014 8:28 PM in response to sirpig

    I'm also having the same issue (or was). I noticed it on a few sites which I know wouldn't do pop ups in that way. And it being on Firefox and Safari was really making me scratch my head. I tried resetting and disabling everything but I still had the issue.

     

    It's interesting, though, that you are also in Northern CA. I, as well, have changed my DNS to Google's and the problem went away (my router's are still the same).

     

    My router is old. It's a Linksys E1000. What is yours? They recently released a firmware that "Addressed various security vulnerabilities" and I've upgraded to it. But the pop ups were still there after upgrading. (I've always had a very secure password on it.)

     

    At this point, I'm thinking it's a DNS issue. I change it back and the pop ups come back. It's a Comcast DNS that's compromised, if so.

     

    Thanks, everyone. I would have never thought of changing the DNS settings.

  • by omijan7,

    omijan7 omijan7 Apr 30, 2014 10:36 AM in response to Linc Davis
    Level 1 (0 points)
    Apr 30, 2014 10:36 AM in response to Linc Davis

    This is exactly what fixed my problem!  I've changed the DNS settings.  After trying to fix the "pop-up" problem, I subsequently had a problem sending and receiving my Comcast mail.  I spoke to Comcast and they gave me these DNS settings and now EVERYTHING WORKS!!

  • by justin12p,

    justin12p justin12p May 7, 2014 8:01 AM in response to sirpig
    Level 1 (0 points)
    May 7, 2014 8:01 AM in response to sirpig

    Thomas_r - I have been having this same problem on my iphone and I am hoping your fix will help me as well. When I am at work or on other networks, I don't have the ad pop up and app store launch of candy crush, but when I am at home I do. So my question is, when you say to check "what the DNS setting is when you're on that network". How do I do that? Is that on my desktop (PC) at home, or is that on the router, or on my phone? Thanks!

  • by justin12p,

    justin12p justin12p May 7, 2014 8:00 AM in response to thomas_r.
    Level 1 (0 points)
    May 7, 2014 8:00 AM in response to thomas_r.

    Thomas_r - I have been having this same problem on my iphone and I am hoping your fix will help me as well. When I am at work or on other networks, I don't have the ad pop up and app store launch of candy crush, but when I am at home I do. So my question is, when you say to check "what the DNS setting is when you're on that network". How do I do that? Is that on my desktop (PC) at home, or is that on the router, or on my phone? Thanks!

  • by CrapIssue,

    CrapIssue CrapIssue May 13, 2015 2:28 AM in response to thomas_r.
    Level 1 (0 points)
    May 13, 2015 2:28 AM in response to thomas_r.

    11251531_10155637892660651_737126750_n-2.jpg

    My wife had a computer firewall off and some kind dude moved in. Because the owner does not know a lot of computers.... in 4-5 days, it caused $1K bill.

    I have read and searched for information... still hasn't found a way to get rid of him.
    when i turn Wifi off and reboot ... it turns himself on and "dude" loads the data once again.

    I would be very very grateful if someone could help me find a solution.

    Monitoring with little snitch 3

    Mono-sgen... at the beginning 1,2,4 etc. Servers and then increasing ...100+ etc.

    blocks-1-control-system-com.s3.amazonaws.com
    control.symform.com
    71.43.68.34
    etc.etc.etc.
    Where: /Libary/Application Support/Symform/mono/bin
    Users: root
    symform

    Not sure what kind info is needed for help....

  • by thomas_r.,

    thomas_r. thomas_r. May 13, 2015 4:17 AM in response to CrapIssue
    Level 7 (30,944 points)
    Mac OS X
    May 13, 2015 4:17 AM in response to CrapIssue

    This is not at all related to the adware issues being discussed on this topic. Rather than beginning to discuss an unrelated, off-topic issue here, can you start your own new topic?

     

    You'll also need to post more concrete details, such as what specifically you are seeing happen. I have only a very vague idea of what's going on, as most of your post has more to do with your interpretations of that information. I will note that Symform is a legit cloud storage service that stores data in a "distributed" cloud - ie, basically, people who use the service can contribute some of their storage space to host other people's data, in encrypted form. I see no evidence anywhere that Symform is malicious.

first Previous Page 3 of 3