Timeline for Suspect malware behaviour when accessing askubuntu and or any stack exchange site from firefox
Current License: CC BY-SA 3.0
25 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 23, 2017 at 12:39 | history | edited | CommunityBot |
replaced http://stackoverflow.com/ with https://stackoverflow.com/
|
|
| Jan 9, 2017 at 9:27 | comment | added | Oded Staff | If this issue goes away when you access the site over HTTPS then - someone is injecting the ads and they are not coming from us (the ISP, possibly someone between them and us or between them and yourself - such as malware). If it is still happening when on HTTPS, then we are serving these (very unlikely, but...). Let us know, one way or another, please. | |
| Jan 3, 2017 at 18:43 | answer | added | stevvveStaffMod | timeline score: 5 | |
| Jan 3, 2017 at 13:18 | comment | added | George Udosen | I am also looking at my ISP for possible injections coming from them but it only occurs when on stack exchange, if it were my ISP then I would see it on other pages but I am still trying that route. | |
| Jan 3, 2017 at 13:15 | history | edited | George Udosen | CC BY-SA 3.0 |
updated answer
|
| Jan 3, 2017 at 13:08 | comment | added | Thomas Ward Mod | @George that's not what I was implying and I was imprecise in my wording. I meant the config data folder in your home dir config stuff, for Linux, or the appdata for WIndows (I can't tell what you use from here :P) | |
| Jan 3, 2017 at 13:07 | comment | added | George Udosen | Let me weep up a screen shot. | |
| Jan 3, 2017 at 13:06 | comment | added | George Udosen | @ThomasWard I don't use windows I use linux. | |
| Jan 3, 2017 at 13:04 | comment | added | Thomas Ward Mod | @George (also for future reference, just moving your Firefox config folder out of your config data folder in your Linux home dir, or your appdata folder on Windows, will keep the rest of your stuff intact, and generate a fresh profile - this would help rule out malware too as I said in the chat pings I sent you) | |
| Jan 3, 2017 at 13:04 | comment | added | user403807 | That is odd. Especially as it behaves in Chrome. | |
| Jan 3, 2017 at 13:03 | comment | added | Thomas Ward Mod | @George A screenshot of what you're specifically seeing might be useful here. Currently we're not able to tell if it's a whole-page ad, or if it's popup ads, or what. We also can't rule out ISP injection of ads either. | |
| Jan 3, 2017 at 13:03 | comment | added | George Udosen | @ChrisF, I had to remove all my extensions, bookmarks, history, cookies, firefox sync etc you just name it. And I need these records for work but had to remove all as I didn't know what was causing this issue. Even scanned firefox folder to see if a malware was lurking there! | |
| Jan 3, 2017 at 12:59 | comment | added | user403807 | This doesn't sound like the sort of thing SE would allow. I'd suspect something injected between SE and the user. Have you tried disabling all/any extensions? | |
| Jan 3, 2017 at 12:55 | comment | added | George Udosen | Also that iframe if I am correct covers my whole page ensuring that where ever I click I get those pop-ups. | |
| Jan 3, 2017 at 12:53 | comment | added | Thomas Ward Mod | @George if it's bringing up popups, that's bad. I'll see if someone on the CM team is able to comment on this. | |
| Jan 3, 2017 at 12:52 | comment | added | George Udosen | I believed it to be so because it kept bringing up pop-up windows and preventing me from using my firefox properly. Chrome seem to be able to control it, and also i noticed it only happened when I was on a stack exchange site. So I looked around on the web and suggestions were made as to this behaviour being characteristic of malware behaviour. For one it interrupts my visits to stack exchange. Is good I finally know where its coming from. | |
| Jan 3, 2017 at 12:44 | comment | added | Thomas Ward Mod | First glance, this is AdZerk, and is StackExchange's Ads system. (see this post here on "What criteria determines whether a Stack Exchange site should carry ads?"). Secondly, I'm not sure why it's showing an iFrame for you, but in Chrome if you look at the source for the page and search for "AdZerk" you get it inside of scripts, so it's importing some JS for the ads. Not sure this is malware though, may I ask why you think this? | |
| Jan 3, 2017 at 2:59 | comment | added | George Udosen | Yes I have removed all of them and even remove my bookmarks. | |
| Jan 3, 2017 at 1:28 | comment | added | TheWanderer | Have you checked your installed extensions? | |
| Jan 3, 2017 at 1:10 | history | edited | Thomas WardMod |
edited tags
|
|
| Jan 3, 2017 at 1:09 | history | migrated | from askubuntu.com (revisions) | ||
| Jan 2, 2017 at 18:16 | comment | added | Mark Kirby | I sent it to review for moving but IDK if it will get moved from there any time soon. If you want it moved quickly, just custom flag it and a mod will do it. | |
| Jan 2, 2017 at 17:39 | comment | added | George Udosen | Sure would be ok, as this issue is really annoying. | |
| Jan 2, 2017 at 17:33 | comment | added | Mark Kirby | You might have more luck with this on meta, the question is about askubuntu after all and as SE devs do go there, they have more chance to see it. I put in a vote to move it but it is really up to you. | |
| Jan 2, 2017 at 5:29 | history | asked | George Udosen | CC BY-SA 3.0 |