Despite several attempts listed below certain websites are getting redirected to a certain ad website automatically, out of the blue on linux. When some website starts redirecting to this ad website is not predictable but once it happens it happens again and again. Here is what I did:

  • Removed all browser plugins, browser directories and the browsers themselves but after a little respite it came back.

  • Changed the user account, it wasn't seen for sometime but then it came there too.

  • Scanned the computer with two anti-viruses and two rootkit scanners but they turned up nothing.

  • Not using a router but an Android portable hotspot, which was scanned by anti-virus and i got nothing there.

  • Formatted the system and did a complete re-install and it is still happening.

Is it a virus running on another computer or is it just hidden somehow? What is this thing and where is it located?

  • I would also recommend to check your local DNS server for any anomalies. – Matze Nov 22 '14 at 16:02
  • surely you have been infected. Such attacks target the browsers themselves. For the moment, do not browse your sensible sites (facebook, emails, bank account ...). You can read more about such things by for example checking about CoolWebSearch – user45139 Nov 22 '14 at 22:22
  • That won't matter if it only affects certain browsers – Canadian Luke Nov 22 '14 at 23:23

Here are some of the steps I would take:

1) Run Burpsuite as a proxy server, intercept the calls, and analyze whether or not there is a specific page you are visiting that is causing this.

2) Uninstall any browser plugins you may be using

3) Remove and reinstall the browser(s)

The extreme measure would be to dig into your files and find where the redirects are coming from. For example, let's say one of the sites you are seeing is called www.HappyGoLucky.com, you could open a terminal and try the brutish method of finding where (in what files) is this site stored at:

find . | xargs grep -i happygo

But that would only find the domain if it hasn't been encoded (base64) or wrapped around some obfuscation.

| improve this answer | |
  • use: cd ~ ; grep -ri happygo . - be advised though, that will only recurse your home directory. You could also use: find / | xargs grep -ri happygo - or find / -type f | xargs grep -i "happygo" – munkeyoto Nov 22 '14 at 17:52

Since other user accounts seem fine, the system itself is probably not compromised. In that case, I'd back up the user's home directory, then nuke their preferences (every file and directory in $HOME that begins with a .). If that fixes it, I'd selectively restore files from backup until things break again, then take a careful look at the most-recently-restored file.

| improve this answer | |
  • I rather believe he describes a scenario where he is a victim. Lot of attacks targets browsers and have that effect he said. – user45139 Nov 22 '14 at 22:24
  • 1
    @begueradj, this is a Linux system. Since other user accounts are unaffected, it's a good bet that the browser binary and shared data files are unaffected. In such a case, the most likely place for the attack is per-user preference files (on Linux, things like browser extensions are stored as prefs); since it varies between browsers, it may be in something other than the browser-specific files. – Mark Nov 22 '14 at 22:33

Remove your browsers profile data from your account, and clean out any extension synchronization you might have. As others have said if other accounts are unaffected it is likely a rouge plugin of some kind.

I also wouldn't trust that profile for much, if it was me, I would get whatever static files I needed out of that account, delete it and make a new one, might even be faster than micromanaging the profiles, a process google has infinite guides for. Most of them live in places like ~/.config/ these days.

| improve this answer | |
  • Typically that stuff is built into a malicious plugin/extension, and I've seen any number of cases where you don't see them listed. You could try full removal of the software, and clearing the extension synchronization. – atyoung Nov 23 '14 at 17:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.