Could you check whether you have any unknown/unexpected extensions? That is a common source of "extra" ads inserted into pages. You can do that on the Add-ons page. Either:

• Command+Shift+a
• "3-bar" menu button (or Tools menu) > Add-ons

In the left column, click Extensions. Then cast a critical eye over the list on the right side. Everything here is optional; none are included with Firefox. If you find anything you do not recognize or need, try removing or disabling it.

Often a link will appear above at least one removed/disabled extension to restart Firefox. You can complete your work on the tab and click one of the links as the last step.

Does that help?

You might also want to supplement your regular security software with a scan using Malwarebytes Anti-Malware: https://www.malwarebytes.org/antimalware/mac/ (free edition)

jscher2000: I also have this problem. I looked at Extensions and had only two---AdBlock Plus and SaveFrom.net--Helper---neither of which would seem to be involved. A couple of days ago, I tried a scan with that free version of malwarebytes I had previously downloaded (I had tried tdsskiller [malware scan] before that, with no results) and then quarantined all the items reported, which had no effect. I did get "signed up" by malwarebytes, which didn't ask for but which they did anyway, for a two-week free trial of their pay-to-play version, which actually was handy because its continuous scan shows what must be this offensive Offerz4U site as being intercepted and blocked over and over again at about the same frequency that those awful slide-up intrusive ads used to appear (they have disappeared). The domain in every case is "f.asdfzxcv1312.com," IP: 207.244.65.143, Port: 51327, Type: Outbound, and Process: C:\Program Files (x86)\Mozilla Firefox\firefox.exe (I took a screen shot while one of these briefly appearing Malwarebytes warnings was on-screen). Is there no mechanism in Firefox for blocking websites? I have looked everywhere I could think to look, with no success.

Also, the naked deception and unbearably cloying fake friendliness encountered upon approaching these people is enough make saint swear. They send e-mails back with all sorts of instructions for eliminating the actual software---not theirs, they insist: they only use whatever it is by agreement for placing ads that they know I will enjoy if I would just give it a chance---which I must have downloaded intentionally or by mistake and, therefore---sadly---am responsible for removing. Only none of their instructions do anything (why am I not surprised?). Whatever they are doing, they gain a stranglehold and then never let go. Thanks in advance for helping me get rid of an intrusion whose perpetrators would be improved by being covered with molasses and then strapped on a fire ant hill.

Arvidd said

I also have this problem. I looked at Extensions and had only two---AdBlock Plus and SaveFrom.net--Helper---neither of which would seem to be involved.

What version of SaveFrom.net Helper do you have? You can find a full list of extensions with version numbers and ID codes on the Troubleshooting Information page, either:

• "3-bar" menu button > "?" button > Troubleshooting Information
• (menu bar) Help > Troubleshooting Information
• type or paste about:support in the address bar and press Enter

Another user with that extension reported problems recently but it wasn't confirmed whether that was the cause of the issue: New window automatically opens containing random sites when I use mozilla firefox. How can I fix this?

The user who started this thread was using Mac OSX; you're on a Windows PC. A lot more specific removal information for Windows - because it's more vulnerable I suppose.

https://malwaretips.com/blogs/remove-offerz4u-ads/

jschr2000:

Thank you.

I tried to find a "?" button after clicking the three-bar menu button, but there was no such selection. What am I missing? The buttons I see displayed are "New Window," "New Private Window," "Save Page," "Print," "History," "Full Screen," "Find," "Options," Add-ons," and "Developer." That's it.

Also, I fortunately have not been afflicted by that other, automatically opening new window with random sites problem.

the-edmeister:

Thanks for the link. It is too early to tell absolutely if it worked, but I cross fingers as I note no new notification slide-ups from Malwarebytes so far, but it's early days yet.

I already had tried removing the program from Windows (none of the permutations were listed, so that didn't work) and malwarebytes, which didn't remove it but did, as I said before, install a two-week trial of their pay version that came with real-time detection that produced those slide-up notifications that must be the attempts by Offerz4U to perpetrate more torture. I went to the third recommendation, AdwCleaner.

Strangely, it clearly downloaded somehow, but it shows up nowhere that I can find on my hard drive. It ran, and, after the scan had completed, it displayed 33 as the number of purportedly malicious files. None of them sounded like what I had seen as being related to OfferzrU, but then, none of them were anything I recognized nor seemed to need, either, so I clicked "Cleaning" and got rid of them all. The signs are hopeful so far, as I said, but time will tell if this actually did consign Offerz4U to the awful hell where it and its operators deserve to be.

Do you have any idea what is going on with AdwCleaner? I don't find anything suggestive of it in Program Files or in the "All Programs" list in the Windows 7 start button menu.

Arvidd said

I tried to find a "?" button after clicking the three-bar menu button, but there was no such selection. What am I missing? The buttons I see displayed are "New Window," "New Private Window," "Save Page," "Print," "History," "Full Screen," "Find," "Options," Add-ons," and "Developer." That's it.

It would be on a row at the bottom: Customize ? [power symbol]

I'm glad you are patient with fumbling Firefox users. I assumed (and you know what they say about ass-u-me) that there would be a big "?" icon up with all the other big icons and didn't even consider the tiny "?" down below. I will now try it.

The "Troubleshooting Information" page came up with "about:support" in the address bar already, and clicking again didn't help (it brought up a bunch of choices of support sites for various websites I've visited), so I went back to it as it came up in the first place. I scrolled through a bunch of technical stuff but didn't see anything that seemed pertinent to "Offerz4U" or any of those related names. What am I looking for and trying to do?

Thanks.

Update: I did finally find AdwCleaner, but not where it was supposed to have deposited itself. It never did appear in Start > All Programs, and it wasn't in Program Files, where it appeared as the default location but did not go there. Instead, it is directly in the "C" drive by itself, but at least it is there. I put a shortcut icon on the desktop.

The program quarantined two regular files and a bunch of registry files. All of these seem to have names that consist of 32 seemingly random letters. The two non-registry files have the extension .BACK. None of the names appear to have any logical relationship with Offerz4U or with anything else.

Also, the slide-up warnings from the free trial version of Malwarebytes Premium have resumed and have not stopped, indicating that our nasty friends at Offerz4U continue to persist. I'd rather get rid of Offerz4U by addressing the root cause than just paper it over by spending the 25 bucks Malwarebytes wants for a year of its premium version, which at least does seem to take it down consistently.

Troubleshooting Information page = internal address about:support so that is normal.

We can review your extension list to see whether we can spot the culprit. You can copy/paste the full list from the troubleshooting information page. Either:

• "3-bar" menu button > "?" button > Troubleshooting Information
• (menu bar) Help > Troubleshooting Information
• type or paste about:support in the address bar and press Enter/Return

Then scroll down to Extensions and just below that heading, select and copy the table, then paste that into a reply. It will look a bit messy, but we're used to it.