4

From this morning I'm witnessing unfamiliar ads apearing in different pages while using Firefox which they say "Ads by DNSUnlocker".

dns-unlocker-ads

I searched for it and it seems this is a known adware infecting Windows PCs and there are several steps to get rid of it (source-1, source-2).

Since I'm on Ubuntu I believe I must've been infected by browsing to a malicious URL, or installing an untrusted Firefox add-on, or maybe this adware also has a Linux version!

Anyway, how can I get rid of it? I checked my Firefox add-ons and there was nothing unfamiliar. One of the steps in the Windows solution is to RESET Firefox and Chrome settings!

I really don't want to reset my settings since I need them and redoing all the preferences is not easy. I need some help to disinfect my system and preferably, find the root cause of it.


UPDATE:

I closed Firefox, and opened Chromium and the ads didn't show up in the same websites I visited in Firefox. Then I opened Firefox again and unfortunately the ads were back again. So it seems the problem is specific to Firefox.

Also it might be worth mentioning that in both Firefox and Chromium I've had the 'Adblock Plus' add-on activated for years and it works great, but since yesterday I'm witnessing these strange ads poping up in some webpages.


UPDATE-2:

I opened Firefox in safe-mode (all add-ons and custom settings disabled) to see if the ads will go away, but unfortunately the ads also apear in safe mode! I guess this means that even reseting Firefox won't fix the problem!

What other explanation could this have? Before this safe-mode test, I was almost certain that the problem was with Firefox being infected, but after this I don't know what's going on! Could my system be infected with a Linux-compatible malware?!

Now I'm really pissed-off! Any help?

  • You can try navigating to about:config in Firefox and searching for DNS or Unlocker. Remove or change the entries. – TheWanderer Aug 27 '15 at 21:22
  • @Zacharee1 Unfortunately, that didn't find anything modified. – Seyed Mohammad Aug 27 '15 at 21:32
  • Hmm. Check the Software Center for recently installed programs – TheWanderer Aug 27 '15 at 21:32
  • @Zacharee1 Nothing unfamilar there either. The last installations were on Monday. But I'm seeing these, since this morning. – Seyed Mohammad Aug 27 '15 at 21:36
  • 1
    might be the router that got infected then? – Mateo Aug 28 '15 at 10:21
3

So I figured out how to get rid of this pest. I thought using Firefox's "Safe Mode" was a true indicator if the infection was related to Firefox or not. But it turned out to be false!

The solution for this was to clear the .mozilla folder in the home directory (which is hidden), and it will make Firefox have a fresh start. Of course, this way you will lose all the bookmarks, saved passwords, sessions, add-ons, etc. But at least it gives you a clean browser back again.

Some of these can somehow be saved to restore again, like bookmarks can be saved by exporting them to JSON. Others (such as the add-ons) I don't recommend to backup and I recommend to reinstall them after reseting Firefox.

  • Hi Mohammad I did what you said but after hours it comes back !!! – mahdiar Sep 26 '15 at 9:52
  • @mahdiar Hi Mahdiar. Unfortunately I have nothing more to add here. I tried this on another infected Firefox on Linux Mint and it solved the problem. Make sure you delete the whole .mozilla folder. And make sure you don't bring anything smelly from the infected Firefox back. – Seyed Mohammad Sep 26 '15 at 12:27
  • This solution worked for me! – Jamess Feb 7 '16 at 16:16

protected by Community Aug 29 '15 at 3:10

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.