3

It's about a month I'm experiencing a problem on my Ubuntu Desktop PC. Whenever I select a text or click somewhere on the browser, a popup window will be opened and then closed rapidly.

Finally, one time (by chance) I found out that popup window is opening a website with this address: gocloudly.com

With a few searches, I decided to delete Firefox folder in my home folder.
/home/user/.mozilla

The problem just solved for couple of days. Today, again I saw a new popup is opening. This time the address is wonderlandads.com and more repeatedly happens.

After so much searchs, most websites are telling me this is a malware. I installed ClamAV and Node32 for linux, fully scanned the local disk and 2 HTML Exploits found in .mozilla folder:

Html.Exploit.CVE_2016_7190-2

I deleted the /home/user/.mozilla folder, also reset Firefox to default settings again, but this time the problem didn't solved.

While I was trying to search and found a solution, something strange caught my attention. The popup window is just opening on Stack Exchange websites. I have tested this issue tens or probably hundreds of times on Ask Ubuntu, Stack Overflow, Super User and even on this website (stackexchange.com).

Mostly when I double click on a text, or select it by dragging the mouse, this popup window opens. It never happens on any other website but Stack Exchange websites.

Other solutions I have tested:

  • Reset my router to factory settings.
  • Changed DNS server to 8.8.8.8 to make sure there isn't a hijack.
  • Changed ISP and Internet connection.
  • Disabled all add-ons on my Firefox (despite I don't have any untrusted add-on).

Update

AS @oded mentioned in the comment, I found out it doesn't happen when I browse website over https. But also it doesn't happen in other non-ssl websites. It's just about this website and non-secure http protocol.

Also found another user which is affected with approximately the same situations.

10
  • 3
    Does this happen when you browse over https? If not, this means the malware content is coming from your ISP (or someone else between you and us), or that you have some malware on your computer.
    – Oded
    Jan 22, 2017 at 20:02
  • @Oded I tested it so much times with different situations. I should say NO, it doesn't happen when I browse your website over https. But also it doesn't happen in other non-ssl website. It's just about your website and non-secure http pages. Jan 22, 2017 at 21:02
  • 1
    I would have words with your ISP then. We do not serve these, nor does our CDN. Someone is injecting these into pages served by us (which they can't do over HTTPS) - and the likeliest is your ISP (or malware on your computer).
    – Oded
    Jan 22, 2017 at 21:19
  • Then you'd better take a good look at all the add-ons/plug-ins/extensions you have on your browser and possibly check your whole computer/network for malware.
    – Oded
    Jan 22, 2017 at 21:22
  • 1
    @Oded Even I changed my ISP and still the same problem. Does it make sense if there is a man-in-middle just between me and your servers? What the valuable thing can be hijacked? Jan 22, 2017 at 21:25
  • I don't know. I just know it isn't us that do this. The thread you found on superuser suggests that it is malware on the profile and the comments suggest that removing the infected files, logging out and back in solved it for that OP (the infected files were being synced before doing that).
    – Oded
    Jan 22, 2017 at 21:27
  • 1
    @Oded Yes, I know you are not doing this and that's why I'm asking here. However it's happening with your service. If you pay more attention, the comment in superuser is not from the same person who asked the question and the comment has been posted about 3 hours ago while question has been asked in Oct 2016. I don't think it has been solved. It worth it if you have more deeper investigation, maybe there is an infrequent issue. Jan 22, 2017 at 21:40
  • There is probably some list of popular sites in that malware, and it push those pop ups only on those sites. Jan 22, 2017 at 22:18
  • @ShadowWizard Makes sense. However, I guess stack exchange should redirect users to https if it is that much popular. This malware has been marked as dangerous by some refrences. Jan 23, 2017 at 9:23
  • @OmidAmraei Stack Exchange still does not support SSL. It is planned for long time, and might take some time to complete. But when it will be done, I believe that https will indeed be forced, i.e. SE will redirect. Jan 23, 2017 at 9:25

0

Browse other questions tagged .