Some malware has crept into my ubuntu 16.04 LTS system (latest updated) which modifies source of web page, inserts this code in section, in both Firefox and Chrome (both latest). This changes behavior of any javascript click in the web page to an ad-popup.

<script data-cfasync="false" src="http://www.toponclick.com/a/display.php?r=1553359&amp;_=1494685778371&amp;treqn=172733714&amp;runauction=1&amp;crr=84119e388a96c5d1b150,,g2TPNpyK_84T9-yPP-aHNpy--5kbfuyTv_lfsu-Pu4lbv2RXqs6jP956P_i3u4k7_4iXu96nL4gDe0lKb0lKr1kK75jP-_052a77f1b12cc82f2600&amp;cbrandom=0.2537268017023072&amp;cbtitle=Maruti%20Car%20Price%2C%20New%20Car%20Prices%20in%20India%2C%20New%20Cars%20in%20India&amp;cbiframe=0&amp;cbWidth=1535&amp;cbHeight=773&amp;cbdescription=Submit%20a%20few%20details%20-%20select%20your%20city%2C%20the%20car%20model%20of%20your%20choice%20and%20get%20Maruti%20new%20car%20price%20in%20your%20location&amp;cbkeywords=new%20car%20prices%2C%20car%20price%20in%20india%2C%20maruti%20car%20price%2C%20maruti%20Suzuki%20car%20prices%2C%20maruti%20car%20prices%2C%20car%20prices%20in%20india&amp;slt=1"></script> 

I have reset both firefox and chrome but it did not help. I checked running processes and none seem suspicious to me. I purged both firefox and chrome but after re-install it has resurfaced again.

I'd looking for suggestions - where could such malwares be stored in the system? Or anyone has similar problem and have solved it, pls share your solution.

PS: I'm scanning with ClamAV anti-virus. Will update results if it's useful.


Problem comes for other user sessions as well. In fact, it shows up in windows partition as well.

I hard reset my router but still the problem persists!!

Problem shows up in macbook too.


Certainly the problem is not with Ubuntu or Chrome or Firefox. I'd keep this question alive so that others who face similar issues can pin-point their problem correctly, instead of ending up formatting their system unnecessarily.

  • It's most likely advertising code injected into you browsers from a tracking. In Firefox install adblock plugin, in Chrome you will update your privacy setting in Chrome's advance settings. Then if sync is turned on disable it... Clamav won't find a thing – George Udosen May 13 '17 at 16:37
  • here is a step by step guide to remove this on windows. I'm not sure what other places it infects in linux. Please share if you find a solution. – Sirajus Salekin May 13 '17 at 16:41
  • Try it on a different user account. If it happens there too, throw away the whole system installation and reinstall from scratch. Once any malware has dug in that deep, you can never know if you were able to remove all traces or if they still have another ace up their sleeves to restore their infection. If the other user does not have the problem, consider throwing away your current user account and start over with the new account. Always make sure to have backed up your important data before nuking anything though. – Byte Commander May 13 '17 at 16:56
  • @ByteCommander thanks i will try that option – Shaurabh Bharti May 13 '17 at 16:59
  • @SirajusSalekin thanks I checked the soln. I have already tried those options. It did not fix it. – Shaurabh Bharti May 13 '17 at 17:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.