cancel
Showing results for 
Search instead for 
Did you mean: 

page transfer by a.kaytri.com top of page says Firefox

Highlighted
New Contributor

page transfer by a.kaytri.com top of page says Firefox

I am trying to sign into a website and before I can finish - I get a page that overlaps my website that I am trying to sign into. At the top of this overlapped page (for lack of a better word) it reads Mozilla Firefox - the web address of this page is www.a.kaytri.com - says please wait - and when it opens it is an ad for say McDonalds for example. How do I turn off this annoying pop-up page.

20 REPLIES
Legendary Contributor

Re: page transfer by a.kaytri.com top of page says Firefox

That is annoying.

You have some unusual sounding extensions in your "More system details" list. Can you recall what they're supposed to do? I suggest this test: disable all of them (except the Troubleshooter), restart Firefox, and test the problem site(s) again.

To disable extensions, you can use this page:

orange Firefox button (or Tools menu) > Add-ons > Extensions category

Any difference?

Legendary Contributor

Re: page transfer by a.kaytri.com top of page says Firefox

I see you are not alone. There was a post yesterday on these ads: I have been trying to remove this a.kaytri.com from firefox with no luck other then to change brower...

Please let us know whether disabling extensions helps, and if it reappears after you restart Firefox the next time.

New Contributor

Re: page transfer by a.kaytri.com top of page says Firefox

Wizards - hit this link - maybe it will help!? Says it is benign... BS - it's a RPITA!

http://jsunpack.jeek.org/?report=1f3829fabdef1a030f7870cede70b7cf61e60f31

3/16 Fresh install of W7/64. Only basic functional progs installed. Had AVG but swapped for Avast free/trial. Also have Malware bytes. CCleaner and MS Security Essentials. Tried the ADblocker listed on the other thread. NOTHING works. Run multiple times.

Add-ons : Extensions - ONLY Avast Ad-blocker 8.0 and Avast Web rep active. Problem could be from Avast DL from C|net. Hate C|net.

Control panel: internet options: security: restricted sites: have 10+ or so listed, including a.kaytri.com. Doesn't stop it. There could be 100's - NONE of the sites will allow anything NEAR an uninstall or method to stop. MOST hated site is Quibids.com. One site asked for my e-mail to unsubscribe - WHY? I never subscribed!! I closed...

I have another PC... NOT affected/infected. This is about 3 days old. Yes, it may be benign but it's still a pain in the ass... both running 19.0.2

I REALLY need to solve this problem as I NEED to create an ISO b/u disc, partition, clone....

I also have IE10, Chrome and AOL - none affected/infected. This is a FF problem.

Thanks - I'll keep reading.

Les

Legendary Contributor

Re: page transfer by a.kaytri.com top of page says Firefox

Hi lestr50, most of the settings in the Internet Options control panel are for IE only and do not pass through to Firefox. We'll have to solve this another way.

The site http://jsunpack.jeek.org is very handy, but the URL we need to submit is the lengthy URL for the specific ad. I found an example in a Google site search and watched what happened with that URL: it redirected to the intermediate site feed.validclick.com, which is part of an affiliate ad network run by Inuvo. So while it's very invasive advertising, I don't think we can learn how to remove it by looking at the back end.

If you can rule out problems from your extensions -- did you try disabling ALL of them despite their innocent looking names? -- you might also check plugins for anything unexpected or unecessary and disable that as well.

Next issue: have your connection settings been switched? Check here:

(WIN) orange Firefox button (or Tools menu) > Options > Advanced
(MAC) Firefox > Preferences > Advanced
(LINUX) Edit > Preferences > Advanced

On the Network mini-tab, click the Settings button. To use the default connection used by IE, choose "No Proxy" or "Use System proxy settings".

Also, if your external security software runs Firefox in a sandbox or virtual machine, you might want to test with that setting disabled.

Legendary Contributor

Re: page transfer by a.kaytri.com top of page says Firefox

By the way, in all my responses, I assumed that these were not ads the websites themselves were running. Could either of you supply some URLs to sites where this is happening so volunteers could check for that?

New Contributor

Re: page transfer by a.kaytri.com top of page says Firefox

Yes, I followed the suggestions. No relief. I copied the basic site address to MS security because that is the only place I COULD copy them TO for a double blind. FF doesn't allow this. Additionally, IF it got into FF it could also get into IE which I don't use often, however... it was a precautionary measure, if you will.

Next, I downloaded AVG and within 30-45 seconds on the first scan it let me know in no uncertain terms it found something and told me to reboot immediately.. did it... let it finish the scan after reboot. Have not been able to "draw fire" from the a.kaytri.com affiliates. They may not even KNOW about this crap. One site led to kpm7.com. pull it up.

C:\users.......\TIF\content.IE5\A1AFYU1S\HOSTS_Anti-Adware[1].exe identified as Worm/autoit.AZCH

That's the best I can do. I believe it's gone. some sites: secure.homeownershipgroup.com freedishHD.com Livesearchnow.com freescore360.com rent2own-usa.com There are a cople of others but... unbelivably it took the last of 4 programs to snuff it.

On re-thinking it - I may have got it when I downloaded Macrium Reflect from CNet and got hung into HAVING to try a stupid check up program. Maybe that's it. Not sure but all I can think of. Check your downloads. I simply let the "check up" run its thing and then I uninstalled - then was able to get Reflect to do the disc work I was after. I tried to get Reflect from other sites but was re-directed to CNet. I won't make that mistake again. I also have NOT used reflect. It was recommended as #1 by MaximumPC.

I hope this helps anyone who reads this. In essence FF did ABSOLUTEY NOTHING toward blocking it. Their AD Blocker doesn't work? Screw it.

That's about all I can add. Avast, Malware bytes and MS-SE all failed. VERY surprising. Think I'll keep 'em all.


Thanks for your input. Standard measures did zip.

Legendary Contributor

Re: page transfer by a.kaytri.com top of page says Firefox

Hi lestr50, thanks for reporting your experience. It sounds as though AVG was useful, and that it found suspicious software in your Internet Explorer cache (Temporary Internet Files). The reason for rebooting most likely is that a malware process resisted termination and could only be removed at boot time before it restarted.

There is some malware which runs externally to Firefox and launches pop-ups in your default browser after you launch it. If this program was based on a similar concept, that might explain why it wasn't affecting IE.

The AVG data on the detected malware flags file sharing sites as the most common source: http://www.avgthreatlabs.com/webthrea.../#analytics. You could check your download history for any files from those sites.

Anyway, whatever real-time antivirus protection you're using, you can reduce your exposure by keeping all internet-facing programs and plugins, and any program used to open email attachments, up-to-date with security patches.

New Contributor

Re: page transfer by a.kaytri.com top of page says Firefox

I too have (had ?) this problem.

I installed and ran AVG and it found something but I don't think (?) it was what was causing the a.kaytri.com problem.

I went to the windows 7 software uninstall page and deleted everything I did not recognize. I noticed that there was a software program called "discount buddy" (I think that was the name, it was something similar if not that) that I uninstalled.

I don't seem to have the problem anymore (did this yesterday). Could someone with this problem see if they have "discount buddy" installed on their computer? I did not intentionally install this program and don't know how/when it was installed.

New Contributor

Re: page transfer by a.kaytri.com top of page says Firefox

I'm having this same issue and I don't have "discount buddy". Running my AVG scan now hoping it will do the trick. <edit> BTW I'm using Chrome.