Random redirection to adult sites of mobile.juicyads.com

Question

Since two days ago, almost all of my clicks open new tab and redirect to this Adult-only URL:

mobile.juicyads.com/service_redirect.php?p=64686&s=124309&u=http://www.google.com

Parameters p and s are not fixed as far as I know but parameter u which is http://www.google.com is fixed and for all of redirections are same. I understood that the URLs which didn't visited yet are redirecting to mobile.juicyads.com websites so if we visit URL A and see the mobile.juicyads.com advertising once, we won't see it again if we go to URL A again.

What is the problem and how can I fix it? I use Windows 7 ultimate and Google Chrome browser and tried these:

• Scanning whole my drive for virus and other bad-wares using Avast!
• Restoring computer for earlier time using Restore Point
• Disabling plug-ins and extensions (Everything I could!)
• Clearing DNS cache and other caches
• Using different DNS servers on my modem-router
• Pinging pages that I didn't visited before, results were OK

I should say that it's not Only my problem and occurs for other people too. And also before this problem (about a month ago) pages were redirected to adfoc.us website (See related question).

Solution

You have malware on your system. Get Malwarebytes (or an equivalent piece of malware - which is distinct from antivirus software), run it and see if it cleans it up.

I note you may have some difficulty getting Malwarebytes if your system has been infected and is using a proxy to hijack your browser - using another browser MIGHT be a way arround this, otherwise download it from another system and use a USB or equivalent to get Malwarebytes to the infected system. To be safe you should probably not trust the USB key after its been plugged into the infected PC. (Or use a burnt CD so the contents can't be changed).

Comments

[marsh-wiggle]

What are the proxy settings of chrome?

[marsh-wiggle]

Proxy settings can be used for browser hijacking. Whate are your system proxy settings? Does it also happen in Internet Explorer?

[VahidN]

I'm living in Iran too (same as you), and I have the same problem. I think ISP's are doing something wrong. This the result of ipconfig /all on my system: DNS Servers : 91.212.124.159 and 8.8.8.8. --> 91.212.124.159 is from Ukraine!

[Ivan Viktorovic]

Did you install any software or drivers recently? Please check your Software and maybe post the most recent you installed.

[Braiam]

Try using another DNS instead.

[Amirreza Nasiri]

@bummi I know the rules here, as I said, I scanned my pc with avast! and malwarebytes so there is no "malware" and I even re-installed windows.

[Taoufix]

I ended up here after Googling the DNS primary sever I found on my laptop which was 91.212.124.159. The problem in my case was on the router (EDIMAX) I was using which apparently got hacked and has the primary DNS server it serves via DHCP changed to the one above.I set the original DNS back and disable access to the router from outside. This fixed the issue for me. I hope it helps.

[Amirreza Nasiri]

I even re-installed my windows after scanning twice with Malwarebytes (and seeing result, not fixed). and as I said, it's no only my PC and my Router's problem.