X
Tap here to go to the mobile version of the site.

منتدى الدعم

I get spam malware messages on one profile only and not the others

Posted

A few days ago I started getting full page spam messages when looking at threads in one forum only. I have to keep backing out or closing out of Firefox. Initially FF blocked them, but not anymore. Norton never blocked them.

These messages only come up when using one FF profile, not another. They also do not show up when using a Chromebook, so I presume the problem is on my end.

I have cleared all cookies & cache and did a complete scan with Norton, Malwarebytes, & AdwCleaner. Even restored Windows 7 back to an earlier time. But none of this helped.

They are full page messages & say they're from AT&T, Walmart, or Visa. However the addresses all start out with: happy.luckyparkclub.com/………..

Sometimes the messages appears right away & sometimes it takes a few minutes.

I cleared FF cookies, went back to the forum, & then looked at the cookies again. I noticed that happy.luckyparkclub.com and dbmtrk.xyz both appeared in the cookies list at the same time, 23 seconds. The forum cookie was time stamped at 22 seconds.

If I look at the forum using a different FF profile there is no problem & neither of these 2 cookies are there.

If I open a New Private Window in the problem profile then I don't get the messages either, at least not yet.

What does the Private Window NOT access that the regular window does?

Which profile folder or file could be causing the problem?

Thanks for any suggestions.

A few days ago I started getting full page spam messages when looking at threads in one forum only. I have to keep backing out or closing out of Firefox. Initially FF blocked them, but not anymore. Norton never blocked them. These messages only come up when using one FF profile, not another. They also do not show up when using a Chromebook, so I presume the problem is on my end. I have cleared all cookies & cache and did a complete scan with Norton, Malwarebytes, & AdwCleaner. Even restored Windows 7 back to an earlier time. But none of this helped. They are full page messages & say they're from AT&T, Walmart, or Visa. However the addresses all start out with: happy.luckyparkclub.com/……….. Sometimes the messages appears right away & sometimes it takes a few minutes. I cleared FF cookies, went back to the forum, & then looked at the cookies again. I noticed that happy.luckyparkclub.com and dbmtrk.xyz both appeared in the cookies list at the same time, 23 seconds. The forum cookie was time stamped at 22 seconds. If I look at the forum using a different FF profile there is no problem & neither of these 2 cookies are there. If I open a New Private Window in the problem profile then I don't get the messages either, at least not yet. What does the Private Window NOT access that the regular window does? Which profile folder or file could be causing the problem? Thanks for any suggestions.
Quote

Additional System Details

Installed Plug-ins

Print Friendly, Tampermonkey

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0

More Information

FredMcD
  • Top 10 Contributor
4274 solutions 59937 answers

Okay, let's try this;

On the system/profile with the problem:

Type about:support in the address bar and press Enter. Under the main banner, press the button; Copy Text To Clipboard.. Now in the Reply Box on the forum page, do a right-click in the box and select Paste.

This will show us your system details. No Personal Information Is Collected.

Okay, let's try this; On the system/profile with the problem: Type '''about:support''' in the address bar and press '''Enter.''' Under the main banner, press the button; '''Copy Text To Clipboard.'''. Now in the Reply Box on the forum page, do a right-click in the box and select '''Paste.''' This will show us your system details. '''No Personal Information Is Collected.'''
Was this helpful to you?
Quote
FredMcD
  • Top 10 Contributor
4274 solutions 59937 answers

Many site issues can be caused by corrupt cookies or cache.

Warning ! ! This will log you out of sites you're logged in to. You may also lose any settings for that website.

If there is still a problem, Start Firefox in Safe Mode {web link} by holding down the <Shift> (Mac=Options) key, and then starting Firefox.

A small dialog should appear. Click Start In Safe Mode (not Refresh). Did this help?

While you are in safe mode;

Try disabling graphics hardware acceleration in Firefox. Since this feature was added to Firefox it has gradually improved but there are still a few glitches.

How to disable Hardware Acceleration {web link}

Many site issues can be caused by corrupt cookies or cache. '''Warning ! ! ''' This will log you out of sites you're logged in to. You may also lose any settings for that website. * [https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored Delete cookies to remove the information websites have stored on your computer] {web link} * [https://support.mozilla.org/en-US/kb/how-clear-firefox-cache How to clear the Firefox cache] {web link} If there is still a problem, '''[https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode Start Firefox in Safe Mode]''' {web link} by holding down the '''<Shift> ''(Mac=Options)''''' key, and then starting Firefox. A small dialog should appear. Click '''Start In Safe Mode''' (not Refresh). Did this help? While you are in safe mode; Try disabling graphics hardware acceleration in Firefox. Since this feature was added to Firefox it has gradually improved but there are still a few glitches. ''[https://support.mozilla.org/en-US/kb/forum-response-disable-hardware-acceleration How to disable Hardware Acceleration]'' {web link}
Was this helpful to you?
Quote
FredMcD
  • Top 10 Contributor
4274 solutions 59937 answers
I was sent this link; Showing results for happy lucky park club https://www.google.nl/search?authuser=1&sxsrf=ACYBGNQoNzAlZdu9BaJ_LS3soFldIoc63w%3A1572092772172&source=hp&ei=ZDu0XfOcB4vUwAKIx7z4Bw&q=happy.luckyparkclub.com&oq=happy.luckyparkclub.com&gs_l=psy-ab.3..0i10i30.300.9331..9989...0.0..0.94.1562.23......0....1..gws-wiz.......0j35i39j0i10j0i30j0i13j0i13i30j0i13i10i30j0i8i13i30.THpVohRpA6Y&ved=0ahUKEwjz3vH59bnlAhULKlAKHYgjD38Q4dUDCAU&uact=5
Was this helpful to you?
Quote

Question owner

I cleared the cookies & cache & started in Safe Mode but it made no difference. Neither did disabling graphics hardware acceleration.

The link mentions looking for unfamiliar programs & processes. There are folders & files with non-descript names, such as the ones with 20-30 characters, but I have no idea what these are for. There is nothing unfamiliar in Control Panel > Installed Programs, and I have not installed any new software in a long time.

The links want me to install SpyHunter, but I’m reluctant to install anything at this point. Plus I’ve already done complete scans with 3 other programs.

I searched the registry for “Happy Lucky Park Club” and also each word separately. “Happy” & “park” showed up but they were related to programs I know about.

I'll take a look at the about: support and paste it here.

I cleared the cookies & cache & started in Safe Mode but it made no difference. Neither did disabling graphics hardware acceleration. The link mentions looking for unfamiliar programs & processes. There are folders & files with non-descript names, such as the ones with 20-30 characters, but I have no idea what these are for. There is nothing unfamiliar in Control Panel > Installed Programs, and I have not installed any new software in a long time. The links want me to install SpyHunter, but I’m reluctant to install anything at this point. Plus I’ve already done complete scans with 3 other programs. I searched the registry for “Happy Lucky Park Club” and also each word separately. “Happy” & “park” showed up but they were related to programs I know about. I'll take a look at the about: support and paste it here.
Was this helpful to you?
Quote
cor-el
  • Top 10 Contributor
  • Moderator
17589 solutions 159130 answers

Do you have any extensions installed in this profile ?

Did you check the connection settings ?

Do you have any extensions installed in this profile ? Did you check the connection settings ?
Was this helpful to you?
Quote

Question owner

cor-el said

Do you have any extensions installed in this profile ? Did you check the connection settings ?

I have 4 add-ons, but they were disabled & did not appear on the upper toolbar when I started FF in Safe Mode.

Which connection settings should I be checking?

''cor-el [[#answer-1261423|said]]'' <blockquote> Do you have any extensions installed in this profile ? Did you check the connection settings ? </blockquote> I have 4 add-ons, but they were disabled & did not appear on the upper toolbar when I started FF in Safe Mode. Which connection settings should I be checking?
Was this helpful to you?
Quote

Question owner

FredMcD said

Okay, let's try this; On the system/profile with the problem: Type about:support in the address bar and press Enter. Under the main banner, press the button; Copy Text To Clipboard.. Now in the Reply Box on the forum page, do a right-click in the box and select Paste. This will show us your system details. No Personal Information Is Collected.

I copied the about:support to my word processor & it has 15 pages of information. There is info about video, audio, & a big section just filled with characters. Do you want all of this or just certain sections?

''FredMcD [[#answer-1261283|said]]'' <blockquote> Okay, let's try this; On the system/profile with the problem: Type '''about:support''' in the address bar and press '''Enter.''' Under the main banner, press the button; '''Copy Text To Clipboard.'''. Now in the Reply Box on the forum page, do a right-click in the box and select '''Paste.''' This will show us your system details. '''No Personal Information Is Collected.''' </blockquote> I copied the '''about:support''' to my word processor & it has 15 pages of information. There is info about video, audio, & a big section just filled with characters. Do you want all of this or just certain sections?
Was this helpful to you?
Quote
cor-el
  • Top 10 Contributor
  • Moderator
17589 solutions 159130 answers

You can check the connection settings here:

  • Options/Preferences -> General -> Network: Connection -> Settings

If you do not need to use a proxy to connect to internet then try to select "No Proxy" if "Use the system proxy settings" or one of the others do not work properly.

See "Firefox connection settings":

You can check the connection settings here: *Options/Preferences -> General -> Network: Connection -> Settings If you do not need to use a proxy to connect to internet then try to select "No Proxy" if "Use the system proxy settings" or one of the others do not work properly. See "Firefox connection settings": *https://support.mozilla.org/en-US/kb/firefox-cant-load-websites-other-browsers-can
Was this helpful to you?
Quote

Question owner

The setting was set for "Use system proxy settings". But it's the same for the profile that works.

I changed the problematic profile to "No proxy" but it made no difference. I still got the spam messages. Again, it's just one specific forum that has a problem when using my main profile. Everything else seems to work normally including other forums I visit.

When the problem first started a few days ago, Firefox would display a Red screen with a warning & it blocked the spam message. But after about 2 days Firefox no longer displayed the Red warning screen, and what I got was the spam screen. I have no idea why this changed, but apparently something triggered FF in the early stages.

The setting was set for "Use system proxy settings". But it's the same for the profile that works. I changed the problematic profile to "No proxy" but it made no difference. I still got the spam messages. Again, it's just one specific forum that has a problem when using my main profile. Everything else seems to work normally including other forums I visit. When the problem first started a few days ago, Firefox would display a Red screen with a warning & it blocked the spam message. But after about 2 days Firefox no longer displayed the Red warning screen, and what I got was the spam screen. I have no idea why this changed, but apparently something triggered FF in the early stages.
Was this helpful to you?
Quote

Question owner

There are quite a few folders & files in the Profile folder. Is there any particular one(s) that might be causing the problem? If so, I could swap in the matching ones from the good profile & see if that makes a difference. Or temporarily rename some folders or files & see if they're recreated with new ones that work. I might end up with some missing data or information, but that would at least narrow down where the problem is.

Any thoughts about doing this?

There are quite a few folders & files in the Profile folder. Is there any particular one(s) that might be causing the problem? If so, I could swap in the matching ones from the good profile & see if that makes a difference. Or temporarily rename some folders or files & see if they're recreated with new ones that work. I might end up with some missing data or information, but that would at least narrow down where the problem is. Any thoughts about doing this?
Was this helpful to you?
Quote
cor-el
  • Top 10 Contributor
  • Moderator
17589 solutions 159130 answers
See: *https://www.google.com/search?sa=N&num=100&q=%22happy.luckyparkclub.com%22
Was this helpful to you?
Quote

Question owner

I'm still looking at all the links to get rid of this spam.

Just thinking I should post the full address that's shows up in the FF address bar. Maybe something in it will help figure out the problem.

http://happy.luckyparkclub.com/bonus/com-us-cc-s10-iph11-cdn/lp1.php?c=4fz6swxaz4vz0&k=0ada4d0e0e1b1b9ac8b35501cbfb2253&country_code=US&carrier=AT&T&country_name=United%20States®ion=Illinois&city=Glenwood&isp=AT&T%20Services,%20Inc.&lang=en&os=Windows%207&osv=&browser=Firefox&browserv=69&brand=Desktop&model=Desktop&marketing_name=Desktop&tablet=4&rheight=768&rwidth=768

The first part between "bonus" and "country_code" is different depending on which spam message is displayed.

I'm still looking at all the links to get rid of this spam. Just thinking I should post the full address that's shows up in the FF address bar. Maybe something in it will help figure out the problem. http://happy.luckyparkclub.<!-- -->com/bonus/com-us-cc-s10-iph11-cdn/lp1.php?c=4fz6swxaz4vz0&k=0ada4d0e0e1b1b9ac8b35501cbfb2253&country_code=US&carrier=AT&T&country_name=United%20States&region=Illinois&city=Glenwood&isp=AT&T%20Services,%20Inc.&lang=en&os=Windows%207&osv=&browser=Firefox&browserv=69&brand=Desktop&model=Desktop&marketing_name=Desktop&tablet=4&rheight=768&rwidth=768 The first part between "bonus" and "country_code" is different depending on which spam message is displayed.

Modified by Chris Ilias

Was this helpful to you?
Quote
FredMcD
  • Top 10 Contributor
4274 solutions 59937 answers

Mike109 said

I copied the about:support to my word processor

Open a text/word program and load the file. Left-click once. Now <Control> A to highlight everything, then <Control> C to copy it.

Next, have your web browser go to; https://pastebin.com/

Paste <Control> P the content of the file in the window. Note: On the bottom, fill out the boxes as best you can.

Now press Create A New Paste. The page will reload. Copy the new web address, and post it here.

''Mike109 [[#answer-1261437|said]]'' <blockquote> I copied the '''about:support''' to my word processor </blockquote> Open a text/word program and load the file. Left-click once. Now '''<Control> A''' to highlight everything, then '''<Control> C''' to copy it. Next, have your web browser go to; '''https://pastebin.com/''' Paste '''<Control> P''' the content of the file in the window. '''Note: ''' On the bottom, fill out the boxes as best you can. Now press '''Create A New Paste. ''' The page will reload. Copy the new web address, and post it here.
Was this helpful to you?
Quote

Question owner

FredMcD said

Mike109 said
I copied the about:support to my word processor

Open a text/word program and load the file. Left-click once. Now <Control> A to highlight everything, then <Control> C to copy it.

Next, have your web browser go to; https://pastebin.com/

Paste <Control> P the content of the file in the window. Note: On the bottom, fill out the boxes as best you can.

Now press Create A New Paste. The page will reload. Copy the new web address, and post it here.

https://pastebin.com/7sgvpG1b

''FredMcD [[#answer-1261502|said]]'' <blockquote> ''Mike109 [[#answer-1261437|said]]'' <blockquote> I copied the '''about:support''' to my word processor </blockquote> Open a text/word program and load the file. Left-click once. Now '''<Control> A''' to highlight everything, then '''<Control> C''' to copy it. Next, have your web browser go to; '''https://pastebin.com/''' Paste '''<Control> P''' the content of the file in the window. '''Note: ''' On the bottom, fill out the boxes as best you can. Now press '''Create A New Paste. ''' The page will reload. Copy the new web address, and post it here. </blockquote> https://pastebin.com/7sgvpG1b
Was this helpful to you?
Quote

Question owner

Any luck finding a problem in the data?

Any luck finding a problem in the data?
Was this helpful to you?
Quote
FredMcD
  • Top 10 Contributor
4274 solutions 59937 answers

I didn't see anything, but called for more help

I didn't see anything, but called for more help
Was this helpful to you?
Quote

Question owner

As mentioned sometimes it takes a few minutes of reading the threads before the spam message appears. It's possible it might show up when using the second FF profile or Private Window if I looked at the forum threads for an even longer period of time. Anything's possible.

OTOH no one else on the forum has mentioned a problem.

I did edit the Hosts file using 127.0.0.1. It did block the spam message but gave me a full page error message instead. IOW nothing gained.

A few messages above, cor-el posted a link & it appears quite a few people are having the same issue.

The first day or two that a I had the problem Firefox blocked the spam message. But then it stopped blocking it. It must have initially detected something, if that means anything. Since the whole forum webpage is replaced with a full page spam message along with a different address, would this be considered a redirect vs. a popup?

As mentioned sometimes it takes a few minutes of reading the threads before the spam message appears. It's possible it might show up when using the second FF profile or Private Window if I looked at the forum threads for an even longer period of time. Anything's possible. OTOH no one else on the forum has mentioned a problem. I did edit the Hosts file using 127.0.0.1. It did block the spam message but gave me a full page error message instead. IOW nothing gained. A few messages above, cor-el posted a link & it appears quite a few people are having the same issue. The first day or two that a I had the problem Firefox blocked the spam message. But then it stopped blocking it. It must have initially detected something, if that means anything. Since the whole forum webpage is replaced with a full page spam message along with a different address, would this be considered a redirect vs. a popup?
Was this helpful to you?
Quote
d3von 3 solutions 38 answers

try clearing your all history and remove cache and all data , after that you wont get any pop ups or spam messages IM experince

try clearing your all history and remove cache and all data , after that you wont get any pop ups or spam messages IM experince
Was this helpful to you?
Quote
اطرح سؤالا

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.