I have a serious problem when visiting web pages, with anything in any moment, as you can see in the screenshots.
photo1 – ubuntu-es | photo 2 – ask ubuntu |
i.imgsafe.org/373b693.png | i.imgsafe.org/647e06c.png | i.imgsafe.org/638cecf.png | i.imgsafe.org/61d3cf8.png | i.imgsafe.org/373b693.png
When I visit a page it is caught and present "Sponsored", "Search Results", "Sponsored Listings" or in spanish too, "fichas patrocinadas" "enlaces patrocinados".
The phishing? take the icon of the web and put an star yellow icon width a dark background. The URL doesn't change. If I refresh many times the page can or cannot show correctly.
I thought that only happens in Firefox for the fake flash plug-in, or something like that, but the same thing occurs in Chromium. Looking at the page code I can't find anything, just some suspect scripts, but don't know. The pages voodoo.com, doubleclick.net appear in the code, and sometimes redirections go to those sites.
The same thing occurs in another machine with no contact with my notebook, on another internet connection, and a friend time ago had the same problem.
I reinstalled Firefox, but nothing happened, upgraded my software and the same.
Sorry for my English, but what's happening with my Ubuntu installation? Has someone had the same problem? Is it adware, a worm, a package, a malicious plug-in? Ubuntu is the newest version, I only installed a PPA for fingerprint but now I delete them. What can I do? I haven't found anything about that 🙁 I hope I'm in the right site, it looks an Ubuntu problem.
I have Ubuntu 14.04, with Unity and Gnome too.
Here is the code of one of the pages:
pastebin.com/GYjAM16h
And can't open in the browser, show "This webpage is not available
ERR_CONNECTION_REFUSED" and download a file called status_002.php who only contain var resp='Thanks';
In many of times it show The file or directory could not be found. in chrome and "Firefox can't find the file at /sf.php."
I download the whole site width wget and uploaded in ge.tt/8s6dMPV2/v/0
If I save single page the code is:
<html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMLl0RJYcDS0N2xIgi01rOAcEtvCUTUq+IuNz5PA8eXYsfPLRkgnNehO+NbOZAlLoQnSpB5rXuRxRCTF+T1iU9sCAwEAAQ==_uWlZ+qnSvZC2E3zQu+ELXpyIUzY7N410RqH5IYFajAd18OSxAVChhd4ZxZ9s1h8+Xm9R+mMRf5GeY0yBJRAwzA==" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>askubuntu.com</title>
<meta name="keywords" value="askubuntu.com">
<meta name="description" content="">
<script type="text/javascript" src="askubuntu.com_files/jquery.js"></script>
<script type="text/javascript">
$(document).ready(function () {
$('#main').attr('src', "/cf.php");
$('#main').css('visibility', 'visible');
});
if (parent.frames.length > 0)
top.location.replace(document.location);
</script>
</head>
<frameset rows="100%,*" frameborder="no" border="0" framespacing="0" id="frameset">
<frame style="visibility: visible;" id="main" src="askubuntu.com_files/cf.html">
<frame id="sub1" src="askubuntu.com_files/bh.html" style="visibility: hidden;">
</frameset>
Update
Thank you very much user4901968 and dobey!
I hear about can be the ISP's, but I don't know what it means, looks strange the ISP doing that.. or not? About the router hijacked it sounds a bit more credible.
Are you sure isn't an Ubuntu problem? And if that true, how can I know it?, what can I do?
I rent an apartment that came with a network connection, but without easy physical access to the router, because a neighbor shared to me, how can I check if my router is effectively hijacked? And what countermeasure can I apply? Suggestions or links are welcome!
This is my /etc/resolv.conf:
nameserver 127.0.1.1
search fibertel.com
Another strange thing: At work with Firefox when searching in google repeatedly I had a page that ask me for a captcha, supposedly for strange traffic networking, unusual traffic from my computer network, because I distrusting it, don't put the captcha and reinstall my Firefox, don't appear again. At home it happened two times, don't know if normal. Searching, the page is legit and is really a Google page, but why does the Captcha appear? I'm not behind a proxy in my home. I mention it because the problem is simultaneous, and hasn't happened to me before since have Ubuntu many years ago. Thanks again.
Update 2, thanks to user4901968
(the comment was too long to put it behind yours)
I upgraded my router but at the moment nothing seems to change, but it seems you are right in that it is my router configuration.
I have a dlink-300 router, it was at version v1.04 and now in 1.05, I do it with my saved configuration file, because if I only change firmware I keep without web connection, some thing in that configuration file is specific to give me connection, and perhaps have the malicious code, I need to contact with owner to ask him. I put in the nameserver you told me to (I didn't know it, thanks!) but it seems the same.
It's early to say whether the problem continues, because it doesn't always appears, or I don't know how to directly find it. For example, if I go to support.dlink.com.br, which is an invalid link it give me the page with ads, and if I visit it with my smartphone connection it only gives me an error, but at moment it doesn't happen with valid links like askubuntu.com luckily.
At the moment it is not a problem with Ubuntu, but let me continue asking here, where if not? So far you've directed me to go by, so I appreciate you continue doing 🙂
Best Answer
You should check to see if your router is hijacked (yes, it is possible), specifically the DNS settings. Also try booting from an Ubuntu Live CD and see if the problem is also there. Try disabling all extensions and plugins temporarily to see if it fixes it. Also make sure your system is not using a proxy and is getting DNS settings from your router. Your router config page should be able to be accessed at 192.168.0.1 or 192.168.1.1 Try reseting all of the settings to default, then running a firmware upgrade. If you cannot access the router config page, you can try replacing the contents of /etc/resolv.conf with: nameserver 208.67.222.123 In the DNS setting of the router config, set the first server to:
and the secondary server to:
It seems your system is using the DNS server I had you set it to first, and if it has no entry for a valid site, uses the bad DNS server as the secondary server. This explains the ad pages on non-existent domains, but proper function of valid pages.