wierd issue. possible adware?

[metalgs78]

1 down vote favorite
Recently i have noticed when browsing a web page will be redirected to something other than what i click on. For instance, when i tried going to www.askubuntu.com via a link on ubuntu.com it redirected me to some other site than this one.
Also when on a page with no flash videos of any kind or pop up windows an ad will start playing. The only way to get it to stop is to wait for it to finish or close the browser and start over again. I have run Clam AV but it has not found anything.

antivirus malware
shareeditflag
edited 1 hour ago


cprofitt
3,069626

asked 2 hours ago


Tim
61



1 Could it be that something has been changed to your DNS, or someone has been fscking around in your /etc/hosts file? – Nanne 2 hours ago

I am a newbie to ubuntu. I know what a host file but not sure where to find it in Linux to check. I am the only user of this laptop and i know i haven't. – Tim 1 hour ago

Well, you could type something like less /etc/hosts in a console, and see if something funky is going on there. You might for good measure do the same with /etc/resolv.conf – Nanne 1 hour ago

@Tim - is this while you are on Ubuntu or are you also running Windows on the machine? – cprofitt 1 hour ago

the host file looks normal. It has the standard 1270.0.1 in there but nothing else. The other one shows nothing out of the ordinary either. – Tim 1 hour ago

@cprofitt in ubuntu not in a windows. Windows is not running on this machine. – Tim 1 hour ago

Odd -- I have heard of malware that does that in Windows, but not OS X or Linux. The music / ads playing in the background makes this interesting. I was hoping you were running Windows in a VM or Ubuntu in a VM because then the issue might have been easier to fix. – cprofitt 1 hour ago

my thoughts exactly. – Tim 1 hour ago

@Tim -- you might want to run a rootkit detector. rootkit.nl/projects/rootkit_hunter.html – cprofitt 1 hour ago

I tried looking up how to install from a tar.gz but it is not working. i typed in "tar zxvf rkhunter-1.4.0.tar.gz" but i keep getting errors and it won't do it. do i have to be a root user? – Tim 56 mins ago

@Tim sudo apt-get install rkhunter – cprofitt 34 mins ago





I posted this on askubuntu.com and i was told to post this here I'm hoping we can get this resolved. Please read through and let me know your thoughts on this. I have done the last hting i was told to do but where do i go to start the rootkit scan?

[westie457]

A lot of sites these days use 'pop-under' advertising. Clicking anywhere on the page will usually open another window to an outside site. I think they do this to generate revenue for themselves and the site you are re-directed to. Pop-up links are easier to block than pop-under ones.

Not of any technical help to you, just general advice of observations in my own surfing habits.


Try 'chkrootkit' it is in the repo's