4

A weird adware is popping up every time I open a .com website and shows ad or redirects the page.
In chrome, I'm not even able to open an ordinary .com page because it immediately redirects to somewhere else.

I've reset Firefox, even purged and reinstalled it but the problem's not solved.
This is one screenshot of mine, you see the adware at bottom-right corner.
I'm using Kubuntu 14.04 with firefox 36.

enter image description here enter image description here
enter image description here

  • What are the extensions and add-on that you are using? – dadexix86 Mar 23 '15 at 20:25
  • extensions: Ubuntu Firefox Modifications and add-ons: shokwave flash, open264 video codec and skype buttons for kopete – Nowruz Mar 23 '15 at 20:28
  • Other addons, plugins, ecc? It's maybe better if you post the screenshots of these configurations. – dadexix86 Mar 23 '15 at 20:30
  • 2
    Have you made any changes to DNS settings? How do you connect to the Internet? Does this happen everywhere you use your computer? (if it's a laptop, obviously it's not portable if it's a desktop) – seanlano Mar 23 '15 at 22:26
  • 1
    @MohsenNowrouzi what your settings for the DNS servers? – dadexix86 Mar 23 '15 at 22:30
5

1. Maybe try to remove your personal files (or backup them first if you need to). They are located in:

~/.mozilla/firefox
~/.config/google-chrome

and some caches:

~/.cache/mozilla/firefox
~/.cache/google-chrome

Both of these browsers will create new profiles for you at first run.


2. You can also examine system-wide addons, they are at:

/usr/share/mozilla
/usr/lib/mozilla  
/usr/lib/chromium-browser  

3. If its not the addons that couses problems, it also can be Man-in-the-middle attack - something is changing HTML/JavaScript on the arrival - check your proxy settings, your routing tables, your internet gateway... Check network requests in "Developer Tools" in those browsers (Firefox: Ctrl+Shift+Q, Chrome: Ctrl+Shift+I). Download some .html in terminal (wget <url>), check if its changed.

  • Didn't help. why is it infecting both firefox and chromium? Has it infected my OS? Is it possible? – Nowruz Mar 23 '15 at 21:57
  • 1
    One workaround for my problem is to use https for all websites, but it's not always possible. – Nowruz Mar 23 '15 at 22:11
  • Of course it can be in your system. Not changing https (encrypted) pages is sort of a proof, that this malware modifies content of the pages (unencrypted). – madneon Mar 24 '15 at 11:22
1

You should probably check your running processes. See how here.

Try Privacy Badger (this wont solve the problem but at least may stop your ads). Install clamav and rkhunter.

If I were you, I would, personally, reinstall the OS, there is allways a new ubuntu version comming up.

  • An antivirus for Linux? Re-installing whole OS due to infection? These don't sound good. It reminds me MS Windows. – Nowruz Mar 23 '15 at 23:03
  • All systems Linux or not are vulnerable to malware. Yours is the proof, but it happens specially if you dont protect it well. Everybody should take this course: futurelearn.com/courses/introduction-to-cyber-security it's free, easy, and funny. – lapisdecor Mar 23 '15 at 23:15
1

Thank all for responses.
I installed "clamav" and ran a full scan on my system; Unfortunately I forgot to tell it to save scan log, I thought it would do it itself; anyway, my problem solved and I don't know what was the real cause.

0

I was having the same problem with firefox, I tried every malware and virus program know to man without any luck and uninstalled /reinstalled firefox many times. Then I was reading a blog on a related page and it mentioned the firefox folder, I took a chance and deleted the whole firefox folder and reinstalled firefox restarted the computer, restarted firefox and now no more adds.

I hope this helps others as much as it did me, I was at wits end!

  • 1
    Put link of that blog in your answer, it would be helpful for OP – Faizan Akram Dar Apr 9 '15 at 3:02
0

Try removing firefox and chrome from your system and removing all settings and config of these two apps by executing following command in terminal.

sudo apt-get remove firefox google-chrome --purge && rm -rf ~/.mozilla ~/.config/google-chrome ~/.local/share/applications/chrome* ~/.cache/google-chrome ~/.cache/mozilla ~/.config/chromium ~/.cache/chromium /opt/google/chrome && sudo rm -rf /usr/share/mozilla /usr/lib/mozilla /usr/lib/chromium-browser /etc/chromium /etc/firefox

Then reinstall firefox and chrome by executing following command in terminal.

sudo apt-get install firefox google-chrome
0

On all your browsers go to clear browsing data in menu->settings from the beginning to present, tick all boxes and go. you will be out of problem.

0

This is just a wild guess, but what is your home router DNS settings? As an experiment, change your system DNS resolver to f.e. Verisign Public DNS - (64.6.64.6) or Google Public DNS (8.8.8.8) and see whether this changes your experience.

If yes, then throw your home router to trash, as there are many security bugs in home routers and exploits are running wild. Buy something more decent that receives updates or OpenWRT/LEDE can be installed there (Turris Omnia might be a good option).

0

As a safety measure Install Adblock Plus on your both of the browsers. Once install ,it will ask you to turn on the features that you want (it will be the page where they will request you for donation , scroll down to see the options ). Turn on all of the options for safe and add free browsing.

0

There are browsers other than Firefox and chromium that block malware and popup-ads and additionally, block trackers, fingerprinting and third party cookies. The Brave browser does this. check out brave at https://brave.com/ You can download brave on Ubuntu by using the Sudo apt install brave or the Debian command sudo apt-get install brave

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.