Thanks for catching this. It actually was not the ads this time (but Cesar did nail it on the head on why they are up).
I found some suspicious scripts/files in a cache directory. I went ahead and removed them. When I move TFF to a new server, it will give me a better chance to clean everything as it is transferred and upgraded, so just stand by!
thanks
Bookmarks