3

Whenever I click any URL so that will open a new tab with this URL (Please be careful):

hxxp://naganoadigei.com/imp/6932/?scontext_r=xlBO1OGoXtDY%2AqpCVwdK6hjcJXf8xQdE2bF9D7qYvJirlGAXcl42kf_7I6Zo60fY&md=snIhJiO2cDMywiIzJiOiEjNwADe5ADMiwiIiJiOiETN1cDe4AzNiwiIyJiOigGd0BnOv8SYwBnLzFmcrFmcpd3bytmLp52LkF2coJ2bhJHZvICLigmI6QzMyQDLiwmI6ISZu1SVTJCLiQnI60yMzADLionI6cTM2UDLismI6ETf

I'm using Ubuntu 16.04 LTS. I tried this with all my browsers such as Mozilla and Chrome; same thing happens in both browsers.

How do I remove this? Thanks in Advance

Thomas Ward
  • 78,878
Tarun Mahajan
  • 55

2 Answers2

6

Long time lurker first time poster.

@Elder Geek

Thanks for your response to to @Tarun Mahajan question, malicious or misconfired extensions can cause this behavior but in this case your this is URL/code injection from the ISP.

How do I know?

  • I am confident that @Tarun Mahajans ISP is BSNL/MTNL in India
  • Got the redirects while using a live CD
  • Tested the live CD at home, in the office, at a coffee shop all served by the same ISP
  • Was unable to replicate results using another ISP ( Airtel )

@Tarun Mahajan can you share your ISPs' name?

naganoadigei.com was registered explicitly to serve malware and redirect users to phishing sites

Updated Date: 2018-05-10 Created Date: 2018-05-10

naganoadigei.com
  • 61
2

This comment is on the right track. There are a number of extensions that you can pick up than can cause this type of behaviour. Coupon Companion comes to mind but there are others as well. One way to determine if it's a plugin or extension causing this problem would be to launch the browser in safe mode:

Firefox safe mode

For Chrome use chrome --disable-extensions launched from the terminal.

Make sure all other instances of these browsers are closed when conducting this test.

When the problem doesn't exist when launched in safe mode you can remove all your extensions and add them in one by one to determine which extension is the culprit.

Sources:

How to start firefox in safemode?

https://superuser.com/questions/254579/how-to-open-google-chrome-with-extensions-disabled-turned-off

Elder Geek
  • 36,752