Malware (adware?) infection on linux

Question

Recently I've get stuck with a malware(adware/virus ?) which I can't remove. here is the condition:

• I'm using Linux (Archlinux), it's uptodate and I don't install any packages outside standard repos PLUS some pretty well known AUR packages. I'll check further if this is the case.

• I get pop-up, (ads by DNS Unlocker) on Chromium, FF (standard repo) and Google-Chrome-Stable (installed from AUR).

• I have a windows and android box which all sync to one account

• I'm using Tor (most of the time) with bridges which have been provided through official email

• List of my recent installs and addons are listed below links:

  sudo cat /var/log/pacman.log | grep -i installed: https://gist.github.com/anonymous/e118898bed35612cab12#file-recent-packages-installed

  sudo pacman -Qm: https://gist.github.com/anonymous/674e1b7030e8cebadaee

  Browser addons:
  Bookmark manager (ID: gmlllbghnfkpflemihljekbapjopfjik),
  Evernote Clipper (ID: pioclpoplcdbaefihamjohnefbikjilc),
  Google Scholar Button (ID: ldipcbpaocekfooobnbcddclnhejkcpn),
  LastPass (ID: hdokiejnpimakedhajhdlcegeplioahd),
  Proxy SwitchyOmega (ID: padekgcemlokbadohgkifijomclgjgif),
  Save to Pocket (ID: niloccemoadcdkdjlinkgdfekeahmflj),
  ScriptSafe (ID: oiigbmnaadbkfbmpbfijlflahbdbdgdf),
  Zotero Connector (ID: ekhagklcjbdpajgpjgmbionohlpdbjgc)
  

• $ cat /etc/hosts

  127.0.0.1 localhost.localdomain localhost
  ::1 localhost.localdomain localhost

  I've checked the network settings and my ip is set to DHCP.

• somehow similar case has been reported recently, but there is a clear difference between what I see.
  https://askubuntu.com/questions/666604/how-to-get-rid-of-the-dns-unlocker-adware

• the pop-up blocks if I disable this script by Script safe, scriptsafe shows the javascript as:
  m51.dnsqa.me (1)
  cdn.scarabresearch.com (1)
  I'm sure about the first one, but the second one might be safe.

• I'm not sure but it seems in safe mode (incognito) the pop up doesn't show. regarding extension I've tried newly installed browser and it get infected again.

• the url hijack has been provoked on google searches (by clicking with new tab on links). and popups are seen on amazon and most e-shopping sites. Also I've seen it in TED.org which prevents me from downloading the video.

After some day struggling with the issue I couldn't find the route.

I've uninstall (pacman -Rs chromium) and remove browsers folders manually (rm -rf .chromium, .config/chromium, /local/share/chromium). With and without enabling the sync (even reset sync data at the server) I see the popups after a while. This happens on FF and Google-Chrome as well. Opera might be excluded I haven't test it yet.

There is two option which I'm suspect of:

• DNS, I've checked resolve.conf and /etc/hosts and Network Settings but I didn't see any configuration other than localhost or DHCP and I'm sort of newbie and not aware of any other vulnerability regarding DNS.
• I've a locally installed malware which I cant find.
• official bridges by Tor with I don't think be the cases (I've changed them but didn't change the result. I sometimes uses tor with scramblesuit bridges, all from official eamil).

Update:

• I don't use tor browser bundle (I'm using tor as service and setting proxies)

• Other devices are connected to the router and those has not affected by the maleware

Answer 1

When you say you are using tor, are you using the tor browser bundle? or the stand alone version where you set it up as a proxy server and connect to tor using your normal browser?

I ask because from your details I suspect it's a DNS issue, but the tor browser bundle does not use your dns settings (at least not by default) so if you're using the browser bundle and still getting the issue then it's something else.

What I suspect may have happened is that the DNS settings on your router may have been compromised so what should happen is a DNS query goes:

1. First looks on your local computer (i.e. /etc/hosts)
2. Your upstream DNS from resolve.conf this is typically your local router and set by DHCP (typically other computers on your network and cached DNS records)
3. Your router looks at it's upstream DNS, this is typically your ISP

But I suspect that your router has been setup to use a malicious upstream DNS server that is redirecting your traffic to malicious web server / proxies that are injecting content into your browsing.

As an experiment try booting a live CD and see if you still get the issue, if you do I would factory reset your router¹ (or better yet re-flash it with the latest firmware) set the upstream DNS settings on your router to 8.8.8.8 (google's public DNS) and make sure you put a good password on your router.

---

1. The usual caveats apply, factory resetting your router will likely kill your internet connection so make sure you know how to set it back up again, if you need a username and password to connect to your ISP (most connections will) make sure you know what it is.

Answer 2

I also suspect that it is a DNS issue as the information on the pop-up ads by DNS Unlocker is the alert of an adware problem. After a research I found that DNS Unlocker is reported as PUP, adware and one of the distribution methods is bundling.

The good news is that it could be completely removed and you can also restore your DNS. More information on this security case you can read here. These guys really help me to solve my PC security related issues. Hope to find the solution of this annoying virus.