1

Earlier today (~4:45 PM EST) I went on Stack Overflow to look up some information on Bash. Everything worked fine, and all text rendered normally.

I went on later (~7:45 PM EST) to check on something else only to find highly intrusive ads. This included bubble ads (see below), generated text links (also below), and full-page invisible links (where you click on the page and it loads another page in the background).

Example of Intrusive Ad

My first thought was a rogue extension, but Chrome (only browser installed) didn't have anything unusual. To be safe, I disabled everything and tried again. Still ads. I installed a script blocker (ScriptSafe for Chrome), which on first visit disabled scripts for Stack Exchange. This removed ads. Enabling scripts for the domain brought them back.

Developer Console seems to reveal the source of these popups is ados.js, served by Adzerk. I could be wrong; tracing JavaScript calls isn't my forte. If that's the case, though, shouldn't AdBlock Plus have blocked them?

I ran scans. Spybot S&D returned nothing. MBAM found four cookies. Windows Defender returned nothing. HitmanPro found tracking cookies. AdwCleaner returned nothing.

Update

I did a more thorough trace, and it oddly enough appears to be coming from Google Analytics. I traced backwards from the first occurrence of DNSUnlocker.

http://istatic.eshopcomp.com/fo/ec/gteamrs.js?subid=64001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com
    > http://m64.dnsqa.me/QualityCheck/ga.js : 10
http://m64.dnsqa.me/QualityCheck/ga.js
    > http://www.google-analytics.com/analytics.js : 45
http://meta.stackexchange.com/questions/267846/adzerk-and-dns-unblocker-intrusive-ads
    > http://www.google-analytics.com/analytics.js : 1374,1375

closed as off-topic by Patrick Hofman, Glorfindel, kiamlaluno, S.L. Barth, rene Dec 23 '16 at 9:05

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about the software that powers the Stack Exchange network, within the scope defined in the help center." – Patrick Hofman, Glorfindel, kiamlaluno, S.L. Barth, rene
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Updated Adblock Plus definitions. Running Windows Defender scan and Spybot S&D scan just to be on the safe side. – ndm13 Oct 14 '15 at 0:28
  • advertising-support.com/… Support link from one of the ads. – ndm13 Oct 14 '15 at 0:32
  • 13
    This is malware not being served by us. You have an infected program somewhere on your computer that is injecting these into your pages. Might want to read Remove Advertising-Support pop-up ads (Virus Removal Guide) – animuson Oct 14 '15 at 0:47
  • Updated. Not so sure. – ndm13 Oct 14 '15 at 1:58
  • 1
    Found a source to back me up: blog.voltagex.org/2015/10/07/… – ndm13 Oct 14 '15 at 3:18
  • Added a trace. Analytics looks like the source, oddly enough. Maybe I misjudged Adzerk. Still a big issue affecting multiple people. – ndm13 Oct 14 '15 at 3:42
  • 5
    If your computer is clean it seems probable that your DNS settings have been tampered with on your computer/router, or your ISP is injecting content into the response (given how terrible those ads are, hopefully this isn't the case). Does it stop happening if you go to visit over HTTPS? – Tim Stone Oct 14 '15 at 3:50
  • I just refreshed using HTTPS and thankfully the ads are gone. It's not an ISP or router issue because I went from my school network (ISP: Frontier) to my home network (ISP: Windstream) and the issue persisted. And it better not be a DNS issue since I'm using Google's DNS servers! – ndm13 Oct 14 '15 at 3:53
  • 2
    You could have gotten a compromised DNS response in the first location and had it remain in cache at the second location, I guess. You could check what chrome://net-internals -> DNS says for www.google-analytics.com, and then ipconfig /flushdns/Clear host cache in Chrome to reresolve. – Tim Stone Oct 14 '15 at 4:10
  • Same issue seems to be affecting Tom's Hardware. – ndm13 Oct 14 '15 at 15:37
  • Clearing the host cache in Chrome did nothing, even after flushing the DNS. www.google-analytics.com resolves to 74.125.29.113, 74.125.29.139, 74.125.29.138, 74.125.29.101, 74.125.29.102, and 74.125.29.100. These all seem to bounce to Google as Analytics typically does. – ndm13 Oct 14 '15 at 15:41
  • tracert.com/resolver is giving me the same set of addresses along with some bonus ones: 216.58.210.78, 216.58.210.46, 216.58.210.14, 216.58.208.46. I got fed up and blacklisted *.google-analytics.com, but I know that hurts site stats so I'd rather that not be the final solution. – ndm13 Oct 14 '15 at 15:49
  • Finally figured it out! I'll post an answer shortly. – ndm13 Oct 14 '15 at 17:10
4

DNS Unlocker - UnInstall. The title is misleading. The page gives instructions on how to remove a poisoned file for DNS Unlocker as well.

Here's an article explaining the situation as it applies to StackExchange. And another that goes over the general methods behind DNSUnlocker, albeit a different form.

This was a pain. Hopefully this gets moved somewhere appropriate, because a lot of people seem to be having issues with DNS Unlocker and many guides aren't helpful.

The step I didn't do was to clean my cached images and files, which contained a bad copy of analytics.js. I'm still not sure how this came about; my installation was virus-free, my DNS settings hadn't been changed, and I'm somewhat paranoid about what gets on my computer.

If you've checked your installed programs and found nothing out of the ordinary AND ran Spybot Search and Destroy and found nothing, try the above link before anything else. It will save you so much time!

  • 2
    The DNS Unlocker is a known virus, aka malware. Related article. – Shadow The Curly Braced Wizard Oct 14 '15 at 17:57
  • 1
    blog.voltagex.org/2015/10/07/… I did not have a virus. I don't know the origin of the file, but my computer was inactive between my clean visit and my ad-infested one, so I couldn't install any software. The initiator was a hijacked copy of analytics.js which was served on certain pages, NOT a browser extension or local application. – ndm13 Oct 14 '15 at 18:01
  • Fair enough. It sounds weird enough so probably true. You better mention this blog post in the answer too, not just in the comment. – Shadow The Curly Braced Wizard Oct 14 '15 at 19:05
  • I made a note in the question. I'll be sure to move it. – ndm13 Oct 14 '15 at 19:14
  • 1
    I recently helped someone else get rid of this. Another note to clarify: you must clean the cache from within the browser. Chrome uses a separate cache, which can be cleared at chrome://net-internals/#dns. – ndm13 Jan 11 '16 at 13:03
2

has your problem been solved? I also encountered DNS Unlocker problem and finally deleted it from my PC by changing the DNS to automatic. The steps below which I found in this post may help you solve the problem.

  • Click Start button, go to Control Panel and click the View network status and tasks link under Network and Internet category. (Note: The control panel screen is under View by: Category)

  • Then click on Local Area Connection.

  • In the pop-up Local Area Connection 2 Status window, you click on Properties button.

  • Click on Internet Protocol Version 4(TCP/IPv4) then click Properties button.

  • Select the Obtain DNS server address automatically option and click on OK button.

I hope this could do the trick, good luck.

  • Solved, but thanks anyway! Only thing to add is clear your cache. – ndm13 Oct 16 '15 at 4:13

Not the answer you're looking for? Browse other questions tagged .