Unsolicited ad inserted behind main browser window (pop-under)

Question

Unsolicited ad inserted behind main browser window (pop-under) every time TheBlaze.com is visited.
ENVIRONMENT
Win7 SP1
Firefox 34.0 (Pop-up windows are blocked)
DESCRIPTION OF PROBLEM
Once the requested home page, from theBlaze.com server, is received by Firefox on your PC, your first mouse click will trigger the pop-under creation process. Pop-under ads are similar to pop-up ads, but the ad window appears hidden behind the main browser window rather than superimposed in front of it. The ad window is located in a new copy of Firefox. Additional mouse clicks may produce cumulative pop-under ad window creations. So, you may end up with multiple pop-under ad windows, each in a new copy of Firefox. According to many marketing “genius” this method of presenting unsolicited ads is much less abrasive than pop-ups used to be, and now recommend the use of pop-unders.
The HTML source file received from TheBlaze.com server contains (in clear) between line 158 and line 202 , the JavaScript code needed to generate the pop-under windows and also contain the URL of the advertiser.
Line numbers may vary from user to user, but look in the source file and locate the beginning and the end of the script at:
BEGIN ADSUPPLY →
the script is located here (approx 44 lines of code)
<!-- END ADSUPPLY →
The fact that the advertiser URL is contained in the source file indicates that, this is a well organized advertizing business. In the examined case the advertiser was "gorgonkil.com".
SOLUTIONS TO STOP POP-UNDERS
This pop-under unsolicited ad plague can originate from any Web site, not only from TheBlaze.com. This is not hidden malware, but highly visible in the HTML page received from the unscrupulous Web site. Be aware that using the “block pop-up windows” parameter in Firefox > Tools > Options > Content > will not solve this problem.
InternetExplorer 11 also falls victim of the pop-under unsolicited ads. SlimBrowser7 survives elegantly and no pop-under windows are opened.
In the proposed 2 solutions, you will need to receive a first unsolicited ad, then take note of the advertiser URL and insert it in the Win7 Firewall or in the BlockSite Firefox extension.
If the unscrupulous Web site sends a large number of new and different advertiser URLs during one browsing session, then you will need to find a more elegant solution to the problem.
WIN7 Firewall
The received ad normally contains the advertiser URL (e.g. gorgonkil.com).
The Win7 firewall has the capability to block IP addresses.
The fact that Win7 Firewall requires IP addresses be expressed in dotted-decimal notation (e.g. 172.16.254.1) makes it less attractive. But, should you decide to use the dotted-decimal notation, it should work perfectly
Block Site 1.1.8 Firefox extension
Install Firefox extension “Block Site 1.1.8”. It is working very well for me.
You need to go to Block Site “Options” and “add” the URL (e.g. gorgonkil.com) you want to block.
Once enabled, the Block Site extension will display a small window for 3-4 seconds (lower right position) every time a pop-under creation is attempted by any unscrupulous offender and the pop-under will not be created.
My own “Options” file now contains more then 18 advertiser URLs (over 3-4 months).
I have stopped visiting TheBlaze.com Web site as of yesterday.
WEB SITE REPUTATION & REVIEW SERVICE
You may obtain a reputation rating for many Web sites by installing a Fiirefox extension: Web of Trust - WOT
WOT adds intuitive traffic light-style icons next to search results and URLs to help you make informed decisions about whether to visit a site or not.
A review has been submitted to WOT (12-19-2014) pertaining to TheBlaze.com. The rating is in bright red “I don't trust” (Ads/Pop-ups).
deBeaujeu

Answer 1

Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of.
You can try these free programs to scan for malware, which work with your existing antivirus software:
* [http://www.microsoft.com/security/scanner/default.aspx Microsoft Safety Scanner]
* [http://www.malwarebytes.org/products/malwarebytes_free/ MalwareBytes' Anti-Malware]
* [http://support.kaspersky.com/viruses/disinfection/5350 Anti-Rootkit Utility - TDSSKiller]
* [http://general-changelog-team.fr/en/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner AdwCleaner] (for more info, see this [http://www.bleepingcomputer.com/download/adwcleaner/ alternate AdwCleaner download page])
* [http://www.surfright.nl/en/hitmanpro/ Hitman Pro]
* [http://www.eset.com/us/online-scanner/ ESET Online Scanner]
[http://windows.microsoft.com/MSE Microsoft Security Essentials] is a good permanent antivirus for Windows 7/Vista/XP if you don't already have one.
Further information can be found in the [[Troubleshoot Firefox issues caused by malware]] article.
Did this fix your problems? Please report back to us!