9

A pop-up ad box appears whatever site I am opening. Tried resetting settings, disabling extensions, removing all users on chrome.

It seems it is not about chrome since same thing happens on Firefox too which I hadn't even opened before.

I suspect it may have something to do with some repositories I added lately, even if so what to do?

Let me describe the pop-up since I can't upload an image because I don't have enough reputation. It places itself at the middle of the page and not so big. Does not move with the rest of the page, stays while scrolling the page. Inside there is sometimes google ads. AdBlock blocks the content but not the pop-up itself.

An image of the pop-up

The result of inspect element:

<div id="thisisonesplashforclicktocloseidhere" style=
  "position:fixed;z-index:999900;top:50%;left:50%;margin-top:-125px;margin-left:-150px;width:300px;height:250px;background-color:#fff;border:4px solid #444;-moz-box-shadow:0 0 12px 4px #888;-webkit-box-shadow:0 0 12px 4px #888;box-shadow:0 0 12px 4px #888;-webkit-border-radius:4px;border-radius:4px;">
  <iframe frameborder="0" height="0" scrolling="no" src=
  "http://guzelyemek.com/reklam.html?gads_300x250" style=
  "display: none !important; visibility: hidden !important; opacity: 0 !important;"
    width="0"></iframe><a href="javascript:hideADSnow()" id="clickonME" style=
    "position:absolute;top:-8px;right:-7px;display:block;width:29px;height:29px;background:transparent url(http://3.bp.blogspot.com/-2pNyEIhTbiU/UWJ-FMsZktI/AAAAAAAAUKg/3FPcPp0CNko/s1600/close-button.png) no-repeat top left;"></a>

chrome://plugins:

enter image description here

Note: Using AdBlock Plus it is possible to block it. I just added the id of the box's div to the filter list but that's just curing the symptoms not the actual illness. So journey continues.

About scanning with ClamTk: It found some 1732 threat which consist mostly (I mean almost all of them) of windows files and interestingly some of ClamAV's own files. Only meaningful entries were these:

  • /usr/lib/shim/shim.efi
  • /usr/lib/shim/shim.efi.signed
  • /boot/efi/EFI/ubuntu/shimx64.efi
  • /boot/efi/EFI/ubuntu/MokManager.efi
  • /home/mumi/.cache/mozilla/firefox/50ug9xkr.default/cache2/entries/35CD2F7BA91E394C584FB72D214090559CC987F8

I just deleted the Firefox thing but don't think other things are harmful.

Ok, I found this suspicious code from the sources tab of Firefox debugger tool:

f (window==window.top) {
   function hideADSnow() {
     document.getElementById('thisisonesplashforclicktocloseidhere').style.display='none';
     document.getElementById('thisisonesplashforclicktocloseidhere').innerHTML =' ';
  }

  var writeNow="";
  writeNow += "<div style=\"position:fixed;z-index:999900;top:50%;left:50%;margin-top:-125px;margin-left:-150px;width:300px;height:250px;background-color:#fff;border:4px solid #444;-moz-box-shadow:0 0 12px 4px #888;-webkit-box-shadow:0 0 12px 4px #888;box-shadow:0 0 12px 4px #888;-webkit-border-radius:4px;border-radius:4px;\" id=\"thisisonesplashforclicktocloseidhere\">";

  writeNow += "<iframe src=\"http:\/\/habermatich.com\/gads\/show_ads.php?format=gads_300x250\" width=\"300px\" height=\"250px\" frameBorder=\"0\" scrolling=\"no\"><\/iframe>";

  writeNow += "<a href=\"javascript:hideADSnow()\" id=\"clickonME\" style=\"position:absolute;top:-8px;right:-7px;display:block;width:29px;height:29px;background:transparent url(http:\/\/3.bp.blogspot.com\/-2pNyEIhTbiU\/UWJ-FMsZktI\/AAAAAAAAUKg\/3FPcPp0CNko\/s1600\/close-button.png) no-repeat top left;\"><\/a>";
  writeNow += "<\/div>";
  try { 
    var checkIs = document.getElementById('ads_boxy');
  } catch(err) { 
    var checkIs = null;
  }
  if (checkIs == null) {
    var adsbox = document.createElement('div');
    adsbox.id = 'ads_boxy';
    document.body.appendChild(adsbox);
  }
  var checkIs = document.getElementById('ads_boxy');
  checkIs.innerHTML = writeNow;
}

Even when trying to install Ubuntu from start it's there.

This guy seems to have the same problem with me. I suspect this is a root kit of some kind but both rkhunter and chkrootkit didn't find anything. Maybe it is a new root kit.

I tried another router with no luck. Restarting router numerously didn't help. It doesn't show on the windows machine on the network or windows on my machine(it is a dual boot system) any more but I saw at least once on both. I guess I only have one option now.

  • 1
    Could you add to your question a snapshot of that ad pop-up or screen-shot of chrome or firefox ? – Sergiy Kolodyazhnyy Oct 28 '14 at 16:27
  • 2
    Please upload the snapshot at imgur.com and add the link in your question. Someone will put the actual picture in there. – user68186 Oct 28 '14 at 16:48
  • 1
    In chrome, try going to chrome://plugins and posting a list of what you see there in the main post. – MoonRunestar Oct 28 '14 at 16:56
  • 1
    Hmmm, plugins page is same as mine - nothing fishy there, it seems – Sergiy Kolodyazhnyy Oct 28 '14 at 17:10
  • 2
    This looks like a man-in-the-middle injection of ads. Are you on a trusted network? Can you post the details of your proxy settings, if you are using a proxy? Also, if possible, could you post a link to the full HTML of a webpage that shows the popup? Finally, does the popup appear if you visit an encrypted page, like your webmail? – Travis G. Oct 28 '14 at 20:00
9

Since you mentioned in comment that the other computer on the network started having the same issue, it may well be that your router settings are altered or the router is infected (yes, that is possible). In fact, your problem is very very similar to this post from security.stackexchange.com . FIY, you may want to use that site in such cases , cuz there's more people who deal with this type of issues.

OK, back to the problem . If you research it a little you'll find that probably a very common problem with routers is when DNS settings are altered. There's also more serious malware for routers,too. DNS server is basically a translator: since computers only deal in numbers, when you type "google.com" in a browser, your computer will send request to DNS servers saying " Hey, what's IP address for google.com? " . DNS server on his side looks through databases, and finds what IPs belong to google.com. Now, if your router's DNS settings are changed, the request goes to a fake DNS server, which will redirect you to fake website or a website that looks like real thing but with malware.

What can be done is the following:

  • Access your router's settings, and check if DNS settings have been altered. You can access them typically by typing 192.168.0.1 into address bar of Firefox or any other browser, and it should open a page with all sorts of settings for your router (read up on your router's manual to make sure the address is right). But if you've never looked at these settings before, it may be hard to determine whether or not something has been changed. Also, look if any routing settings were changed or you see something fishy there.

  • Reset the router to default settings. Again, this can be done through 192.168.0.1 . This may be under "Advanced Options", but search around the settings or just read the manual. Good idea is to reboot the router after you changed the settings back to default to make sure it takes effect. If that helps and the popup doesn't come up any more on either machine, change router's admin password to something else than before and something strong, plus maybe change wifi password (WPA PSK or whatever you're using).

  • Get a new router. You could either buy one yourself and configure it or contact your Internet service provider , explaining the situation. They may offer more options, too.

Among other things, what I'd do in such case is do some small tests.

  • You mentioned that you connect by wifi and have Windows files there. So is it a laptop ? you double boot ? Try taking it to another network, and see if pop-up persists. If it doesn't show up on another networ - it's definitely your router.

  • Does it show up in Windows ? If it's the router , it's definitelly not related to OS or your browsers or anything like that.

  • Change your settings for DNS in Ubuntu. The thing is that Ubuntu's Network Manager by default will let a dnsmaq plug in decide what DNS to use (and typically it will be your internet service provider's'). Now, you can use your own DNS regardless of what internet service provider gives. To do that - open the Networ Manager indicator in the right side corner and go to Edit connections. Select the network, and click Edit button. Go to IPv4 tab, change drop down menu from "Automatic (DHCP)" to "Automatic (DHCP) addresses only", and where DNS servers type in whatever DNS server you like. You can choose 8.8.8.8 (Google's public DNS). I use OpenDNS(208.67.222.222). these are well known and trusted. Then open terminal and type sudo nano /etc/NetworkManager/NetworkManager.conf and change line dns=dnsmasq to #dns=dnsmasq. Save file with Ctrl+O and exit with Ctrl+X. Now you could either do sudo service network-manager restart or simply reboot the computer. I'd prefer rebooting. Connect again to your network, and once ready in terminal type nm-tool | tail. It should confirm you're using your selected DNS. If popup doesn't persists with such settings - definitely router's DNS problem. Steps I've gone through here is same as I've described in my other post here

That is it. I'm in no way computer security expert, so everything in this post is the best I can suggest. Best of luck! and let us know if this helps, or how you solved the problem in the end.

  • Full reset in the router is probably the best option you can do yourself – Sergiy Kolodyazhnyy Oct 31 '14 at 15:03
1

Could it be your Proxy settings routing your traffic via some server that injects this in to the HTML? Try this from your terminal:

echo $http_proxy

Should come back with nothing. (Or at least nothing unexpected.)

  • 1
    Yeah it printed nothing – mumi Oct 29 '14 at 0:06
  • 1
    OK. So it's probably not a proxy thing. Another suggetsion: have you tried firing up the Chrome Debugger (F12), use the Network tab, visit a simple page, then looking at the Network traffic? Is the code for the pop-up served anywhere here? Or failing that: Wireshark. Again, visit the simplest page that generates an ad, and see where the traffic for this is coming from. If it's not coming via the network, then yep, it's probably a plug-in. – Chrisky Oct 29 '14 at 8:42
  • It somehow stopped on chrome but on firefox it shows on network. but I really didn't understand what they mean. They are just domains that uses google ads to advertise. If there is a way to share the result of the network tool, I can. – mumi Oct 29 '14 at 11:44
0

Just re-install of browsers should fix this. I had similar issue and removed as many toolbars possible; but nothing helped. If you could, take a backup of bookmarks and re-install the browsers.

  • it seems it has nothing to do with browsers but will give it a try if nothing helps at the end. – mumi Oct 28 '14 at 16:41
0

Try installing Ad-block plus addon for chrome and firefox from Chrome Web store and Firefox Addon store respectively. That should get rid of anything erratic like your problem.

Hope this helps...

  • Ad preventing extensions blocks the ads inside the box but not the box itself. That's why I think it's probably a kind of malware. But thanks. – mumi Oct 28 '14 at 18:04
  • 1
    ABP can block the box as well... – manishraj2011 Oct 28 '14 at 18:08
  • 1
    I managed to prevent it to show itself by blocking its div id from adblock settings, so practically the problem is solved but there might be deeper reasons to it so let me wait a bit to accept this as answer but thanks a lot. – mumi Oct 28 '14 at 21:22
0

It can be a browser extension. Please enter in Menu > Tools > Extensions, uninstall all extensions that you consider suspect.

So, you can try remove the configuration files from these browser.

Close the browser,open the terminal and perform:

rm -fR ~/.config/google-chrome

Open the browser.

Good luck.

  • Only adblock is active now and I really don't have much extension.Just one question about removing things on a linux system: is this reversible? – mumi Oct 28 '14 at 19:38
  • 1
    If you remove this directory, it won't make any trouble on your system. The directory ./config/google-chrome is created when you open the browser at first time. When you remove it and reopen the browser the directory is created again. So, if you don´t syncronize your bookmarks, I recommend you rename the directory using mv ~/.config/google-chrome ~/.config/google-chrome-backup for example. – Marcos Silveira Oct 28 '14 at 20:18
  • Hmm.. That didn't work for me :( I mean not the backup thing but deleting config file. – mumi Oct 28 '14 at 22:13
  • @mumi You mentioned that it stopped in chrome somehow. Did it stop after deleting folder and reboot? Or just randomly stopped? – Sergiy Kolodyazhnyy Oct 30 '14 at 21:18
  • @Xieerqi Randomly stopped and came back plus started at the other computer on the network – mumi Oct 31 '14 at 0:41
0

A fresh install of ubuntu seems to solve the problem.

protected by Community Sep 8 '15 at 14:53

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.