malware - How to remove gocloudly.com malwaare from firefox on ubuntu 16.04 - Ask Ubuntu

i have ad block plus on firefox, clicking on links, randomly opens new window redirecting web pages strating gocloudly.com.

i found it's sort of malware , found instructions remove in windows can't find remove in ubuntu.

also if there way remove keeping browser history , settings please tell me.

thanks in advance.

the first thing you'll want find out if system effecting 1 browser, user account, or device. this, firstly see if device on network seeing issue. if is, have problem on network, see network problem section below. if not, try different browser on computer - if still see issue, you'll want computer problem section. if don't see issue still, try create new user profile - if doesn't show issue, check user profile section. if error show new user profile, check browser installation section.

network problem

the network compromised. because dns servers using have been changed on network, means whenever request address of given site, request goes shouldn't, gives address of pay click advert or similar (thus profiteering web browsing). best way fix configure routers dns settings - there many options, recommend asking isp ones provide, or using google's free ones (4.4.4.4 , 8.8.8.8 if memory serves). if you're unsure how this, might perform factory reset. keep in mind may need information set router again isp, make sure contact center open before proceeding.

computer problem

here, believe have local dns issue. computer configured same way router above, default dhcp server on network tells computer use dns server wants to. possible override , tell computer use dns server, , has happened. can try looking @ of network configurations including network-manager, wpa-supplicant, dnsmasq, , on. won't go individual detail, should point in right direction.

user profile

this nasty script has been attached profile using either tampermonkey script, or plugin in own right. in instance should disable plugins , confirm issue not reproduce. if does, want start looking in user profile directory find nasty stuff. if doesn't, re-enable plugins 1 one in browser see 1 causes problem, uninstall , check user profile directory ensure traces of removed.

browser installation

this things bit difficult, i'm not sure how difficult do, believe it's possible either add modified binary, modify launcher (e.g firefox.desktop) file, or modify applications configuration starts process hijacks requests, or makes changes application runs modify requests (e.g through memory manipulation or through giving specific environment variables/launch parameters set dns). @ point, best option remove browser , install ppa. if not work, try portable version - if work, might want install manually somewhere such /opt/, remove ability update using apt package manager. difficult, really, malware still exists on system @ point , without forensics analysis, impossible predict has done or how remove it.