ttj.js keeps popping up on my screen

[The Hypno-Toad]

Some people on the internet seem to suggest the work of the devil but I thought I'd ask you guys for a sensible opinion plus a way to get rid of it if it is dodgy.

I'm running Windows 8.

Thanks in advance.

[130R]

From ib.adnxs.com? http://malwaretips.com/blogs/ib-adnxs-popup-virus/

[The Hypno-Toad]

That's the one.

Thanks for your help and suggestions. I've done the first two parts and we'll see what happens.

[The Hypno-Toad]

no good, keeps turning up.

Any other thoughts?

[stevoknevo]

Did you undertake all of the processes in the previous link? I noticed you said you had done the first two, but trying doing all of them. Also trying running malwarebytes in safe mode without networking; go in to your browser add ons and delete/disable any that you have not added.

[RichB]

Recently I've started getting this too. Interestingly it's only when opening Pistonheads. I'll try the suggestions and report back.

[Glosphil]

RichB said:

Recently I've started getting this too. Interestingly it's only when opening Pistonheads. I'll try the suggestions and report back.

Yep. Same with me - only happens when opening Pistonheads.

[The Hypno-Toad]

stevoknevo said:

Did you undertake all of the processes in the previous link? I noticed you said you had done the first two, but trying doing all of them. Also trying running malwarebytes in safe mode without networking; go in to your browser add ons and delete/disable any that you have not added.

Hi. Sorry I haven't got back to you earlier.

I tried all those options apart from the last one, which would appear to mean losing all my favourties and passwords, which seemed a bit of a nuclear option if I might be able to find another way.

Got to say it does seem to come up most often when I either open Pistonheads or Crash.net.

[nickwilcock]

I'm only seeing this pop-up when viewing PistonHeads. Presumably some greedy advertiser has allowed the site to cause the infection?

[RichB]

Yes, it looks like it's Pistonheads that's infected with the virus!

Edited by RichB on Monday 4th May 10:44

[The Hypno-Toad]

RichB said:

Yes, it looks like it's Pistonheads that's infected with the virus!

Edited by RichB on Monday 4th May 10:44

I'd doubt it but I was just reporting what I'd found. As can be seen from post count this probably my favourite website but it does come up all the time on crash.net too and I don't actually go there that often. There are other sites that I don't visit as much as PH but way more than crash where it doesn't show at all.

Weird.

[RichB]

Dunno, I only see it when visiting Pistoheads and only then on first load and only on IE. Not on Chrome and not on any other site.

[Hoover.]

what is ttj.js ???

[Studio117]

Hoover. said:

what is ttj.js ???

.js is a java script file extension. But its likely to be a executable file for some adware/malware.

[piper]

I got it to, just reformatted my C drive re-loaded everything, visited Pistonheads on IE and its back, just cannot get rid of it. Does anyone out there know how to destroy it?

Edited by piper on Monday 4th May 23:12

[b0rk]

The orange popup banner is the virii asking you to install it, you do not actually have it assuming you ignore banner.

It appears from digging round with the network debugger present in firefox that plugin.mediavoice.com/plugin.js is the script responsible PH really should remove/ban the offending advertiser or ad network. The modified/malicious bits of the script appear to only target IE.

[piper]

It looks like Pistonheads have dealt with the issue; it's not appearing anymore..!

[Higgs boson]

'never had the banner on PistonHeads, but it appears on Crash.net.

[The Hypno-Toad]

piper said:

It looks like Pistonheads have dealt with the issue; it's not appearing anymore..!

This.

Odd.

[RichB]

Yep - it's gone.