7

So randomly every now and then, when I click on a link - instead of opening it normaly, a new tab is opened and some website with "tracking" in the name (I haven't caught the full name yet, it's quite quick) a site called trackingclick.net redirects me to www.aliexpress.com.

I assumed it was because the websites I visited were fishy or something, but then it happened while I was developing a site on a local server. So it's clear this is something internal on my own machine. How do I track down what's causing this?

Maybe relevant info:
I'm running Elementary OS Luna. My current enabled extensions are: Hola, Ajax Debugger, Chrome Currency Converter, Chrome Apps & Extensions Developer Tool, Dimensions, Edge: The Web Ruler, JSON Viewer, Project Naptha, User-Agent Switcher for Chrome.

Improve this question
3
  • 3
    Not the answer for your question, but uninstall Hola right now... see adios-hola.org . There are a wonderful open-source blocker(not only ads) called Ublock origin. Chances are that the "tracking" server will be on their lists so this will stop happenning.
    – Freedo
    Jul 8, 2015 at 16:21
  • Discussion about whether this is on-topic in meta: meta.security.stackexchange.com/questions/1858/…
    – Jeff Ferland ♦
    Jul 8, 2015 at 18:20
  • @Freedom I removed Hola, but uBlock is uh... an adblocker. Hola is a VPN. Got any good alternatives to suggest?
    – yuvi
    Jul 8, 2015 at 19:02

3 Answers 3

Reset to default
6

This sounds like a browser redirect virus.

Does the same thing happen when you use a different browser? If no, then there is something in Chrome. I would start removing or disabling your extensions one by one STARTING WITH, God help us all, HOLA, until the problem goes away.

If other browsers have the same problem, then the issue is not with an extension or Chrome, but with something in your OS.

I suggest you use an intercepting proxy (Like Burp or Zap) to intercept the requests so you can have more information. At least it will reveal the identity of "some website with tracking in the name". This might help identify the virus and lead you to steps to remove it.

If those steps do not resolve the issue, I would also try Clam AV on Elementary OS. Instructions are here.

Since you say it happens when testing your locally hosted web app (I assume this means addresses like http://localhost/foo are being redirected too?), it is probably like you said, local to your machine. There is a chance that what ever is causing this has made changes to your hosts file to even redirect localhost. So, if you open the file /etc/hosts, what do you see in there?

Improve this answer
6
  • I removed Hola. I believe this happened to me on different computers using the same Chrome account (I'm not entirely sure yet) so I don't think this is related to the OS or some external software. I'll try some of your suggestions try to catch it. I really doubt there has been any change to my localhost file, but I'll check that too. Thanks for the tips I'll update soon
    – yuvi
    Jul 8, 2015 at 18:39
  • Is there a way to check past requests of chrome and filter them according to status code? Cause I can catch a redirect like that and then identify the website that's passing me to AliExpress
    – yuvi
    Jul 8, 2015 at 18:42
  • I don't know of a way to do that in Chrome. An intercepting proxy will do a better job of this but it happens only periodically, so that means using the proxy for a while.
    – mcgyver5
    Jul 8, 2015 at 18:55
  • Typing 404 or some other status code into the search box in Chrome's history kind of achieves this.
    – mcgyver5
    Jul 8, 2015 at 19:04
  • searching for 301 I only found the AliExpress address I've been redirected to, but then I tried searching tracking and found that the website as called trackingclick.net (I put that as "code" to avoid adding a link)
    – yuvi
    Jul 8, 2015 at 19:23
1

Definitely sounds like something local. Check the installed programs on your system to see if there's anything suspicious. I usually try to run browsers without extensions whenever possible. If you know those extensions that's good, but if you're not quite sure how one functions or you haven't seen it before I'd research it. Be aware while looking that some programs like this try to disguise themselves as legitimate programs, so if you see something that looks fishy and your not quite sure about it, Google it.

You may want to try the Top command in your OS's terminal to check out running processes too. You can find a process running in the background that can lead you to what is causing your browser issue. Things like this try to stay well hidden, so stay vigilant and you'll find what you're looking for.

Improve this answer
1
  • Most of my extensions are developer tools and are really helpful. I can try disabling some but I don't think I have anything fishy running
    – yuvi
    Jul 8, 2015 at 18:43
-1

You will not find anything. Ali Express alters data of Chrome. Deleting extensions will not help either. So the only way I know is to delete chrome and then re-install.

Improve this answer
1
  • 4
    Could you validate your claim and add a link to support it?
    – Matthew Peters
    Jul 13, 2015 at 3:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.