Couchtuner.la Pop ups ABP not working

[Draden]

Go to Couchtuner.la when in Chrome and abp is enabled in extentions. Fresh install of OS windows 10 and Chrome Version 45.0.2454.101 m.

I have run the following
Chrome tool
Malewarebyes
Adwcleaner
hitman pro
rouge killer
rkill
tdsskiller

Every time i go to this site in chrome only and select a link or anywere on the page i get a pop up behind my chrome browser of these sites. http://startinghobbies.com/ , http://easyrecipesite.com/ .

I have done some investigating and discovered that both Couchtuner and these links i am refered to are hosted by cloudflare .
I would use firefox but i hate it and only use it for testing stuff from one browser to another to see if chrome is working .


Please help as this is really pissing me off .

[mapx]

Did you update easylist ?
see
https://forums.lanik.us/viewtopic.php?f=62&t=25652

[Draden]

thanks for your reply .

Easylists are updated and added . with no change to the issue . anymore idea's

[Draden]

thanks for your reply .

Easylists are updated and added . with no change to the issue . anymore idea's

please help

[mapx]

The problem is I can't reproduce your issue

[couchtunerhaspopups]

I can confirm couchtuner has popups.

Anywhere you click, whenever you first get to the page in chrome.

http://www.couchtuner.la/

If you cannot replicate it, you need to close all of your chrome processes. Let it sit for 180 seconds, and then go to default landing page, and click anywhere on any link. The popup comes up fullscreen, and goes behind the main window right after appearing.
I can also attest no spyware, no rootkits, no malware, of any sort. Combo fix, avast, adwcleaner, spyware hunter etc etc etc etc. Running adblock plus, and adblock pro. Nothing solves it, it has happened since couchtuner went from .eu to .la.

Also:
It seems inconsistent as to how long between it happening. Also whenever i try to monitor the traffic in chrome console it just stops the page from loading (ie, its knowing preventing whatever script that is enabling the invisible overlay from being recorded and viewed. it just prevent the script from being loaded on the fly)

If you cannot replicate it, then rotate vpn to somewhere in the US (just an idea in that it seems if i swap to say UK or EU vpn it doesn't happen as often)
It also happens on show pages, but not when you get into an individual episode as it did in months past.

It's real. There is just a timeout per IP it seems.

[couchtunerhaspopups]

Here is an image.
It was not popping up.
1. Kill all chrome process
2. rotate vpn to somewhere else
3. go incognito mode
4. click anywhere

[mapx]

I just tested with US vpn, nothing, firefox / chrome the same. No popup window. Main page or show page.
(also I deleted the cookies)
Can you reproduce it in firefox ?

[couchtunerhaspopups]

I have just tested 15 times.
Above directions work in replicating.

Whenever you try to capture timeline the below happens (sorry for the multipost)

EDIT:
I never even see popups in firefox. It is chrome specific i believe. Certainly try incognito.
I am rotating all around US, seems to sometimes not work, but it certainly isn't repeatable without Doing manual kill .bat:

Code: Select all

taskkill /F /IM chrome.exe

Win7 x64 SP1

[mapx]

I disabled ABP too, I cant reproduce the issue.
btw, don't use adblock pro, it's some crap. Use only ABP.

[couchtunerhaspopups]

Ha the only reason I strayed is because of these popups. I even did fresh install of win7 out of the madness.

Certainly try that hard chrome kill script. that makes a difference.

Chrome up to date:
Version 46.0.2490.71 m
I am having no problem replicating as long as I move geo within US. IE doesnt happen when I reconnect to the same node area of US locale. So there seems to be some kind of geographic count "when i see this are x times, stop showing them" making it hard to track down.

But it certainly is repeating, and I am literally out of things to try. I have spent months trying to find a way to stop this nonsense, every single virus/malware/spyware/rootkit I can get off bleeping computer. And it ONLY happens with couchtuner.la.

At the very least, I am quite impressed with whatever the exploit is that they are using.

[couchtunerhaspopups]

^ Purple is the popup.
Sec I think i just got it.
The onclick event:

Code: Select all

 document.addEventListener("click", function(event)
  {
    // Ignore right-clicks
    if (event.button == 2)
      return;

    // Search the link associated with the click
    var link = event.target;
    while (!(link instanceof HTMLAnchorElement))
    {
      link = link.parentNode;

      if (!link)
        return;
    }

    if (link.protocol == "http:" || link.protocol == "https:")
    {
      if (link.host != "subscribe.adblockplus.org" || link.pathname != "/")
        return;
    }
    else if (!/^abp:\/*subscribe\/*\?/i.test(link.href))
      return;

    // This is our link - make sure the browser doesn't handle it
    event.preventDefault();
    event.stopPropagation();

    // Decode URL parameters
    var params = link.search.substr(1).split("&");
    var title = null;
    var url = null;
    for (var i = 0; i < params.length; i++)
    {
      var parts = params[i].split("=", 2);
      if (parts.length != 2 || !/\S/.test(parts[1]))
        continue;
      switch (parts[0])
      {
        case "title":
          title = decodeURIComponent(parts[1]);
          break;
        case "location":
          url = decodeURIComponent(parts[1]);
          break;
      }
    }
    if (!url)
      return;

    // Default title to the URL
    if (!title)
      title = url;

    // Trim spaces in title and URL
    title = title.trim();
    url = url.trim();
    if (!/^(https?|ftp):/.test(url))
      return;

    ext.backgroundPage.sendMessage({
      type: "add-subscription",
      title: title,
      url: url
    });
  }, true);

[mapx]

I got it once ...

[couchtunerhaspopups]

Yes! It seems too, obviously i cant save timeline raw data in incognito, and thats the only way i can replicate.
After 4 months of madness the end is in sight!

From what my poor js skills are telling me, is its actually rewriting an element overtop of the site on mouseclick event.

[mapx]

where did you see that code ?

what about adding this filter:

Code: Select all

||machings.com^