Rainmeter Forums

Does anyone know the source of a popup ad like the attached image?
It was not contained in a Firefox or other browser window.
Reasonable guesses would include:
* a virus (although no viruses are currently detectable on my system)
* BBC iPlayer
* Qlock (just uninstalled)
* OneDrive
* DropBox
* Yoono
* Rainmeter

Thanks,
Drew

It's certainly not Rainmeter. You need to run Malwarebytes AntiMalware, check to see what hideous addons have been added to Firefox (yes, Firefox most likley IS where it is coming from), run Autoruns to see what unknown programs are being executed at Windows startup, and all the other usual steps when you get some kind of malware that is causing popups in your system.

Thanks for the tip jsmorley.
I ran the scan. About 20 items were detected. I can't say right now that the problem's been solved. If I don't post anything within 2 weeks, assume it has been.
The problem item list is attached.

Thanks,
Drew

The popup just occurred again. The window closed before I was able to figure out its source. I tried closing Firefox, but I can't conclusively say whether closing Firefox caused the ad to close.
This time a Malwarebytes scan detected one softonic HK key. I just deleted it.
I just had another thought. Maybe this is an upgrade nag window generated by Nero Express.

Thanks,
Drew

I just uninstalled something called "Nero Info."
Nero Express still launches.
We'll see if the ad pops up next month.