Recently I've get stuck with a malware(adware/virus ?) which I can't remove. here is the condition:
I'm using Linux (Archlinux), it's uptodate and I don't install any packages outside standard repos PLUS some pretty well known AUR packages. I'll check further if this is the case.
I get pop-up, (ads by DNS Unlocker) on Chromium, FF (standard repo) and Google-Chrome-Stable (installed from AUR).
I have a windows and android box which all sync to one account
I'm using Tor (most of the time) with bridges which have been provided through official email
List of my recent installs and addons are listed below links:
sudo cat /var/log/pacman.log | grep -i installed: https://gist.github.com/anonymous/e118898bed35612cab12#file-recent-packages-installed
sudo pacman -Qm: https://gist.github.com/anonymous/674e1b7030e8cebadaee
Bookmark manager (ID: gmlllbghnfkpflemihljekbapjopfjik),
Evernote Clipper (ID: pioclpoplcdbaefihamjohnefbikjilc),
Google Scholar Button (ID: ldipcbpaocekfooobnbcddclnhejkcpn),
LastPass (ID: hdokiejnpimakedhajhdlcegeplioahd),
Proxy SwitchyOmega (ID: padekgcemlokbadohgkifijomclgjgif),
Save to Pocket (ID: niloccemoadcdkdjlinkgdfekeahmflj),
ScriptSafe (ID: oiigbmnaadbkfbmpbfijlflahbdbdgdf),
Zotero Connector (ID: ekhagklcjbdpajgpjgmbionohlpdbjgc)
$ cat /etc/hosts
127.0.0.1 localhost.localdomain localhost
::1 localhost.localdomain localhost
I've checked the network settings and my ip is set to DHCP.
somehow similar case has been reported recently, but there is a clear difference between what I see.
I'm sure about the first one, but the second one might be safe.
I'm not sure but it seems in safe mode (incognito) the pop up doesn't show. regarding extension I've tried newly installed browser and it get infected again.
the url hijack has been provoked on google searches (by clicking with new tab on links). and popups are seen on amazon and most e-shopping sites. Also I've seen it in TED.org which prevents me from downloading the video.
After some day struggling with the issue I couldn't find the route.
I've uninstall (
pacman -Rs chromium) and remove browsers folders manually (
rm -rf .chromium, .config/chromium, /local/share/chromium). With and without enabling the sync (even reset sync data at the server) I see the popups after a while. This happens on FF and Google-Chrome as well. Opera might be excluded I haven't test it yet.
There is two option which I'm suspect of:
- DNS, I've checked
Network Settingsbut I didn't see any configuration other than localhost or DHCP and I'm sort of newbie and not aware of any other vulnerability regarding DNS.
- I've a locally installed malware which I cant find.
- official bridges by Tor with I don't think be the cases (I've changed them but didn't change the result. I sometimes uses tor with scramblesuit bridges, all from official eamil).
I don't use tor browser bundle (I'm using tor as service and setting proxies)
Other devices are connected to the router and those has not affected by the maleware