A few weeks ago my wife mentioned that she was always getting “Recommended for You” popup ads displayed in her browser whenever she visited a web site. The popup was an ad that would appear in the lower-right corner of her browser window. At first I thought it was related to the site she was visiting until I saw the popup appear on multiple sites. I wasn’t quite sure what was happening so I decided to do a little research.
The Recommended For You Issue
After performing a few tests I determined that there was indeed a problem on her laptop. While visiting a site an ad, with an iPhone or simple rectangle background, would appear in the lower-right corner of the Web browser window. While the ads didn’t appear to impact the laptop, they became annoying after a while.
The ads would appear on many different websites using multiple browsers. She uses Internet Explorer on Windows 7, so I originally thought it was limited to that browser. I was wrong. I launched Google’s Chrome Web browser and noticed that the ads appeared within that Web browser as well.
Next, I logged in with my own separate account and started to noticed the popup ads appear in my browser window as well. After seeing this I determined that it was a system-wide issue, and not related to a specific Web browser or user account.
The Fix
I first started to look at the actual HTML source code of the pages that displayed the popup ads using a Firefox plugin called “Firebug.” This plugin allowed me to go right to the lines of HTML code that displayed the popup ads.
The code indicated that the Javascript file being executed was ga.js from google-analytics.com. This web site is owned by Google, and redirects you to the actual Google Analytics home page, so I was confused at why this file would caused the problem.
I then thought about what could be the root cause, and it would need to be on the local system. I then thought about the “hosts” file, which allows someone to point a domain to a specific IP address.
I opened the hosts file, located in “C:\Windows\system32\drivers\etc”, into notepad to take a look at what was written in the file. I didn’t see anything out of the ordinary, but then I scrolled down and found the problem. The hosts file on the laptop was as follows:
::1 localhost
(200 blank lines)
149.5.18.172 www.google-analytics.com.
149.5.18.172 ad-emea.doubleclick.net.
149.5.18.172 www.statcounter.com.
108.163.215.51 www.google-analytics.com.
108.163.215.51 ad-emea.doubleclick.net.
108.163.215.51 www.statcounter.com.
The line “(200 blank lines)” was exactly that – 200 blank lines that pushed the last 6 entries below the viewing area of the file. What the last lines do is point popular website metrics and ad sites to another IP address. This IP address would then use it’s own copy of common Javascript files to display the “Recommended for You” popup ads.
To solve the problem I deleted the last 6 entries, as well as the 200 blank lines, and then saved the new hosts file. Of course, on Windows 7 I needed to log in as an administrator and change the permissions to allow me to write to the file first.
Once the change was made, the “Recommended for You” popup ads no longer appear in the Web browser. Now I just need to figure out how that file was modified.