Categories

Malware Analysis

Text Popups

What is a text popup?

A text popup is a link that opens a popup box containing advertisements, usually prompted by a mouse-over.

Where do they come from?

As a moderator on a few forums and as an amateur web-designer, I often get complaints from people asking me to remove the annoying text popups or balloons from the site. Of course I always try to help these people, but most of the time the problem does not come from where they think it does.  The websites I moderate, or have designed, do not use this kind of advertising for the registered members. (And registration is free where they serve advertisements to visitors)

From the website

The misunderstanding comes from the fact that there are mainly two kinds of text popups which can be further divided. The first characteristic we use here to divide the text popups is the origin. There are the popups that are served by the site you are visiting. Most of them are created by using javascript, but using css is another popular option.

TPimg1

Example Javascript code

 

TPimg2

Example CSS code

 For both of the examples above the content and placement of the popups has to be defined in the html-code of the site itself.

 Can I block these? 

There is more than one reason to disable Java in your browsers, read for example our advisory Unpatched Java Exploit in the Wild. There you will also find instructions about how to disable Java in all the currently popular browsers. But Java and Javascript are two different languages.  For a fine explanation about the differences there is this article on NakedSecurity. You can find instructions how to disable (and enable)  Javascript for most browsers on Alan Wood’s Web site.

Disabling CSS is possible, but not advisable since CSS  determines the layout and style of most sites. The results would be ugly, in the literal sense.

You would be better off by installing a program to block advertisements. There is a great variety available. You should be able to find a suitable one for your browser, especially with the help provided in this article. When you do start using an ad blocker, you should realize that many sites depend on advertisements to generate an income and this income enables them to provide you with their services for free.

Or is it me?

The kind of text popups that is more worrying is the one that comes from your own computer, or usually, your own browser. Here we can make a distinction between wanted and unwanted. These vary from “I installed it myself and I find it useful” (for example the translation option in the Google Toolbar) to “downright annoying” (for example the CouponDropdown adware shown below).

TPimg3

Google translates a word that I point out

 

TPimg4

CouponDropdown underlines words on the site you are visiting and serves you an advertisement if you hover that link

 How do I disable those?

To disable the popups coming from toolbars that you have willingly installed, check the options that come with that toolbar, usually accessible with a right-click on the toolbar. For toolbars, add-ons, plug-ins etc. that you have not willingly and knowingly installed, check out our our article about browser malware.

From the fact that we classify most of these programs as potentially unwanted (PUP), you can tell that some people find them useful, but if you don’t, I would advise you to follow the instructions below.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
  • Update Malwarebytes Anti-Malware
  • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Review the list of results and put a checkmark before the items you wish to remove. PUP items will not be selected by default.
  • Click Remove Selected. Reboot your computer if prompted.
  • When completed, a log will open in Notepad. The adware application should now be gone.

You can change the way Malwarebytes Anti-Malware deals with PUP detections on the Settings tab under Scanner settings. This image shows the default settings.

Settings

PUP is set to show in results list but do not check for removal

 Summary

Summarizing, if you find annoying links on a site that you are visiting it is a good reason to check your own computer for adware, especially if the people owning or running the website tell you that they don’t use that kind of advertising.


2 thoughts on “Text Popups

  1. dargoth11 says on February 13, 2013 at 9:36 pm :

    An easy way to stop most of the pop-ups is to add the offending site(s) to your hosts file. Personally, I read while moving my mouse along, and the pop-up adverts were driving me crazy. So I did some research and started adding them to my hosts file…guess what? no more garbage pop-ups stopping my reading “flow”.

  2. Pieter Arntz says on February 13, 2013 at 11:46 pm :

    That is an option, but a lot of work, if you want to do it yourself. There are hosts files readily available like http://winhelp2002.mvps.org/hosts.htm and http://hosts-file.net/ for those that do not have the time.

Leave a Reply

Subscribe to our YouTube Channel