(06-10-2015 11:17 PM)MsMagick Resident Wrote: FYI - my girl says one common trick within ANY browser is for something on the webpage to tell you that you need to use a plug-in to view a video, then when you click to install it, you download and install Malware. Some of these requests are legit, but just be very careful when you're asked to install or give access to anything.
The best rule of thumb is to never EVER click on a link for a download that you did not specifically ask for.
For example, if a site says you need Real Player (is that still around? just an example) and either offers to download it, or offers a link to the publisher's page, NEVER click the link and ALWAYS cancel any automatic download.
If you need Real Player (for this example), open another browser window or tab, and go to a trustworthy search engine. Locate the actual web site. You'll find the download link there.
Remember, just because they say they're downloading Real Player does not mean it actually IS Real Player they're having you download. And just because they say they're sending you to Real Networks so you can download it yourself, does not mean they're sending you to the actual site.
As to the actual source of the OP's issue, determining the source of an infection is usually impossible.
In my experience, claims of 'never going anywhere' but are usually wrong.
Take this page you're reading now.
You think it's just "kittycats.biz"?
Nope.
It's also Google, Facebook, Twitter and Flicker.
While it's possible someone in the selling sections of the forums have a link to an infected site (I don't go in those sections, so there COULD be) ...
I can assure you that there no questionable components on the Kittycats site, and that includes the components from Google, Facebook, Twitter and Flickr, which appear on almost every page here,
I know this not because I view the pages, or because my security systems say they're clean, but because I've been reading the actual bits and bytes coming down the wire as they're going into my browser.
The only even faintly disturbing thing I've seen in the weeks I've been doing so has been the junk inserted into the page by my ISP letting me know they've scheduled yet another maintenance period for yet more service upgrades. That bothers me because it means, yep, they're watching every page I visit any, sure enough, can modify it on-the-fly before passing it to my network.