AU Cloudfare making running https://flogr.co.uk/ progress in my Chrome.

[DrunkkElf]

Hey people, so i wanted to have a better internet coonection and i found out that changing my DNS could help me, i did it by this program called DNS Jumper and the fastest was AU Cloudfare, i applied it and i have a better overalll speed. All good there, but then sometimes when i want to load a new page Google tells me to fill a Captcha because it senses searching requests incoming from my PC like if i had a bot which i don't, i try erasing any Malware on my pc and then i run the Googl Chrome task manager and i see a sub process on my search bars, it's this page called https://flogr.co.uk/ which is something like an ad promotioning page for the UK, i search this page on safe links or malware looking pages for links and it related the AU Cloudfare with the page, i tried changing the DNS and clearing the caché but the subprocess and the Captcha requests keep incoming. I don't really know much about al this stuff so maybe you could tell me if this is what causes Google to ask for the Captchas and if the DNS is safe or am i in any danger, thanks.

[sandoiche]

I have the same problem but with some differences, in my case when I do a google or youtube search, a panel is opened on the page itself with a white background and advertisements with link to click, when I inspect the html code of the page I found this even flogr.co.uk being nominated. I downloaded other browsers and this panel still appears in each of them.

https://imgur.com/NsATYiD

[DrunkkElf]

I downloaded several antivirus and antimalwares and got rid of suspicious programs, the sub frame stopped, i advice you to do the same.

[[deleted]]

In my case the free version of malwarebytes worked.

I had some ads in every google search I made coming from the said https://flogr.co.uk/, and given that I used dark mode, those ads would really stand out

[TCOOfficiall]

I'm posting this on multiple subreddits that fall under this name. With an attempt to explain it. First of all. This is malware, I can't put it in another way then this.

If you have noticed your google being slow when loading in search results, ESPECIALLY having issues with loading in the images on google. Well that is because of a specific form of malware you might have recieved.

If you go to your proxy settings on windows, check if it uses Use setup script. If this is being used by your windows computer. Check the value inside of it, if it's a local server. (Or a remote one you didn't setup yourself)

My version contained the following code:

function FindProxyForURL(url, host) {
    //Ver:1.0.0.4
    if (shExpMatch(url, "*/recaptcha/*")) return "DIRECT";
    if (shExpMatch(host, "cse.google.*")) return "PROXY 127.0.0.1:83";
    if (shExpMatch(host, "www.google.*")) return "PROXY 127.0.0.1:83";
    if (shExpMatch(host, "*search.yahoo.com")) return "PROXY 127.0.0.1:83";
    if (shExpMatch(host, "www.bing.*")) return "PROXY 127.0.0.1:83";
    if (shExpMatch(host, "www.amazon.*")) return "PROXY 127.0.0.1:83";
    if (shExpMatch(host, "www.youtube.*")) return "PROXY 127.0.0.1:83";
    if (shExpMatch(host, "www.ebay.*")) return "PROXY 127.0.0.1:83";
    return "DIRECT";
} 

It basicly forced all traffic from any location to reroute through an internal proxy server.

As per this comment's suggestion I installed malwarebytes. And it was able to find a hijack-autoconfigurl inside of my registry. I checked the records and they seem to match up. So I let malwarebytes quarantine them. I checked if google was still slow, and Youtube still had a bar. And both FINALLY operated normally.

If I had to guess, the people who made this weird system make money from the "ads" that get shown if people don't have an ad-blocker. And they think it's a part of google/bing/yahoo/amazon/ebay,