3

It's about a month I'm experiencing a problem on my Ubuntu Desktop PC. Whenever I select a text or click somewhere on the browser, a popup window will be opened and then closed rapidly.

Finally, one time (by chance) I found out that popup window is opening a website with this address: gocloudly.com

With a few searches, I decided to delete Firefox folder in my home folder.
/home/user/.mozilla

The problem just solved for couple of days. Today, again I saw a new popup is opening. This time the address is wonderlandads.com and more repeatedly happens.

After so much searchs, most websites are telling me this is a malware. I installed ClamAV and Node32 for linux, fully scanned the local disk and 2 HTML Exploits found in .mozilla folder:

Html.Exploit.CVE_2016_7190-2

I deleted the /home/user/.mozilla folder, also reset Firefox to default settings again, but this time the problem didn't solved.

While I was trying to search and found a solution, something strange caught my attention. The popup window is just opening on Stack Exchange websites. I have tested this issue tens or probably hundreds of times on Ask Ubuntu, Stack Overflow, Super User and even on this website (stackexchange.com).

Mostly when I double click on a text, or select it by dragging the mouse, this popup window opens. It never happens on any other website but Stack Exchange websites.

Other solutions I have tested:

  • Reset my router to factory settings.
  • Changed DNS server to 8.8.8.8 to make sure there isn't a hijack.
  • Changed ISP and Internet connection.
  • Disabled all add-ons on my Firefox (despite I don't have any untrusted add-on).

Update

AS @oded mentioned in the comment, I found out it doesn't happen when I browse website over https. But also it doesn't happen in other non-ssl websites. It's just about this website and non-secure http protocol.

Also found another user which is affected with approximately the same situations.

closed as off-topic by Patrick Hofman, Nathan Tuggy, ArtOfCode, Ward, Glorfindel Jan 23 '17 at 7:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about the software that powers the Stack Exchange network, within the scope defined in the help center." – Patrick Hofman, Nathan Tuggy, Ward, Glorfindel
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Does this happen when you browse over https? If not, this means the malware content is coming from your ISP (or someone else between you and us), or that you have some malware on your computer. – Oded Jan 22 '17 at 20:02
  • @Oded I tested it so much times with different situations. I should say NO, it doesn't happen when I browse your website over https. But also it doesn't happen in other non-ssl website. It's just about your website and non-secure http pages. – Omid Amraei Jan 22 '17 at 21:02
  • 1
    I would have words with your ISP then. We do not serve these, nor does our CDN. Someone is injecting these into pages served by us (which they can't do over HTTPS) - and the likeliest is your ISP (or malware on your computer). – Oded Jan 22 '17 at 21:19
  • Then you'd better take a good look at all the add-ons/plug-ins/extensions you have on your browser and possibly check your whole computer/network for malware. – Oded Jan 22 '17 at 21:22
  • 1
    @Oded Even I changed my ISP and still the same problem. Does it make sense if there is a man-in-middle just between me and your servers? What the valuable thing can be hijacked? – Omid Amraei Jan 22 '17 at 21:25
  • I don't know. I just know it isn't us that do this. The thread you found on superuser suggests that it is malware on the profile and the comments suggest that removing the infected files, logging out and back in solved it for that OP (the infected files were being synced before doing that). – Oded Jan 22 '17 at 21:27
  • 1
    @Oded Yes, I know you are not doing this and that's why I'm asking here. However it's happening with your service. If you pay more attention, the comment in superuser is not from the same person who asked the question and the comment has been posted about 3 hours ago while question has been asked in Oct 2016. I don't think it has been solved. It worth it if you have more deeper investigation, maybe there is an infrequent issue. – Omid Amraei Jan 22 '17 at 21:40
  • There is probably some list of popular sites in that malware, and it push those pop ups only on those sites. – Shadow The Dragon Wizard Jan 22 '17 at 22:18
  • @ShadowWizard Makes sense. However, I guess stack exchange should redirect users to https if it is that much popular. This malware has been marked as dangerous by some refrences. – Omid Amraei Jan 23 '17 at 9:23
  • @OmidAmraei Stack Exchange still does not support SSL. It is planned for long time, and might take some time to complete. But when it will be done, I believe that https will indeed be forced, i.e. SE will redirect. – Shadow The Dragon Wizard Jan 23 '17 at 9:25

Browse other questions tagged .