Chromium Browser - unwanted ads (malware, solved)

[cobaka]

Hello to all and woof!

At the top LH corner of my screen 'junk' message appear. They seem to be associated with Chromium, the browser; I have not verified this - just a suspicion. You can see an example of this 'junk' below.

Chromium_browser--nuisance+virus.jpg (72.6 KiB) Viewed 1351 times

.
Anyone else experience this?
Any suggestions about how to rid myself of the troublesome 'junk'.

Cobaka

My system
Running uPupBB32 on a 64 bit machine.
Generally, when running, I have the following application software running: A bash terminal, x2 iterations of ROX file manager, Chromium (the browser) and Geany. Often use the Libre Office (but I open & close that as needed). Ditto for mtPaint & so on. Often leave my PC running overnight, with internet connected and running. Shutting down my system and re-booting does not seem to fix the problem. The firewall is 'on' and has been on since I installed this Puppy.

For me, this 'junk' is nuisance value only.
Everything seems to run etc.

[williams2]

You may have a virus. Where did you get Chromium from? Did you install any add-on packages?

What happens if you click the Home button?
What happens if you open a new tab?

[cobaka]

Hello @williams2

You may have a virus.

Uh-oh! Yay! I've always wanted one of those! I felt left out! But uh-oh! This isn't Windows - this is Puppy!
Puppy, (as I understand) is quite virus-resistant.

Where did you get Chromium from?

Good "Q". I really don't know - but my guess - a 'standard' Puppy source (whatever that may be).
I can say that I didn't see these nuisance messages appear at first. Only recently.
But I can tell you when I got Chromium. (See attached file: Chromium browser info.)

Also this info came from Chromium when I ran a 'safety check'.
Version 95.0.4638.69 (Official Build) from Snap packaged for Puppy Linux Run-As-Spot (32-bit)
I note Chromium offers some facility to check integrity. Running that I got the following report:

Safety check ran a moment ago
Version 95.0.4638.69 (Official Build) from Snap packaged for Puppy Linux Run-As-Spot (32-bit)
Passwords: Chromium can't check your passwords because you're not signed in
Safe Browsing: Enhanced protection is on
Extensions: You're protected from potentially harmful extensions

Did you install any add-on packages?

Answer No.

What happens if you click the Home button?

Answer The 'home' button and the new-page button present the same page. I see the "query/search" page for duck-duck-go. This is my 'home' page. I set that and that hasn't changed (visibly) for months. (Chromium_New_Page-alt+n.jpg)

What happens if you open a new tab?
Answer See above. I see the duck-duck-go search page.

I run one more page (see snapshot called "Chromium_my_page.jpg". This file comes from my hard-drive (sda2). I composed this - it's nothing more than a set of links with images written in html4. If some clever person got onto my computer, found this file (it's just text) modified it and saved it (to sda2) - then 'yes' - this could 'contain' some virus. But I figure 'unlikely'.

I think this is a very interesting problem I don't know much about computers, but I am curious to know what virus lurks within. Thanks for your observations, Williams#2
Will show Task Manager in the next posting.

[cobaka]

@williams2
As stated, I supply info about what's seen in Task Manager.
Not shown: Chromium and busybox. (Off the bottom of the snapshot).

Собака

Task_Manager.jpg (124.5 KiB) Viewed 1307 times

[williams2]

If you search (duckduckgo) for Chromium Browser - unwanted ads
you should get lots of hits
(unless your Chromium is blocking them.)

You could have a Chromium virus,
that is, the virus is in Chromium,
it is not a Puppy virus as such.

There are references to fake Chromium browsers.

Google is largely, from their point of view, about serving you ads.
so maybe it is working the way the Google gods intended.

I run Firefox mostly, the closest I get to Chromium is when I run Opera.
Actually, that's not true; mostly I run Links2.

I read somewhere, that a virus in a browser is better (from the evil hackers point of view) than a virus in the OS.

From https://geeksadvice.com/remove-chromium-virus/

Code: Select all

Symptoms of Chromium malware infection
 * Browser’s start page changed without your knowledge;
 * Clicking on new tab opens a specific and unknown website instead of blank page;
 * You notice pop-up and pop-under ads (these ads either appear on or under the window you’re currently using);
 * You notice suspicious redirects when browsing online;
 * New tabs open automatically and load promotional content;
 * Noticeable computer slowdown;
 * You cannot access certain programs, f.e., antivirus.

It may not be a virus or fake Chromium, it might be possible to configure it to show fewer and less intrusive ads.

Attached, a screen shot of the Links2 browser.

Links2 browser

links2.jpg (150.67 KiB) Viewed 1301 times

[williams2]

Your home page seems ok (your own home page on sda2)
A new tab seems ok (the duckduckgo page)

So, less likely to be a browser virus.

You could try running it in a pristine environment, by booting with no save file (pfix=ram if you are running Puppy.) to see if it makes any difference.

Firefox downloads and loads the Wildvine extension every time it starts, without asking permission.
(although I do have it configured to be able to play drm encrypted video (wildvine.))

[p310don]

Looks like you've visited "dailymail.co.uk" and when it asked for permission to show notifications you've clicked yes instead of block.

Have a look here:

https://support.google.com/chrome/answe ... %3DDesktop

[xenial]

My guess...
The dailymail has planted a supercookie (LSO) on to your system and is probably residing in the local storage file.

Have you run a cleaner like bleachbit.?
As for chromium i would definately use the builds provided by peebee here on the forum.

[cobaka]

Hello @p310don & @xenial

My guess...
The dailymail has planted a supercookie (LSO) on to your system and is probably residing in the local storage file.

At the moment I can't confirm your suspicion, but this is a good place to start.

I'm following @williams2's advice and (at this moment) running without pfix=RAM. Thank god (and whoever made this option available - probably @BarryK). Will take some time as I swap between pFix on & off to locate the problem. The time is 04:40 (local). Winter. Cold. A warm bed calls.

When I have more info - after following Williams2 - I'll try the next step in debugging this.
I will be away for a day or so; I will follow a deliberate debugging process. I believe in a deliberate, step by step approach to debugging. I don't use the 'just try whatever comes into my mind first ...' approach to problem solving.

To all: Thanks for some good info.

Woof from cobaka

[cobaka]

To all:
I have the malware described in the first posting in this thread on my PC.
Believe it is malware, not a virus (but without proof at the moment).
Here is my method to locate this malware:

(1) Is the malware on my PC or remote? (I understand a scheme exists where malware is associated with a server not the local PC.)
(2) Is the malware associated with Chromium browser or not? (Easily discovered.)
(3) If "yes" to #2, is the malware internal to the browser (i.e. something like an app) or does the browser execute code somewhere on my PC?

All this is given as a concise summary of my intent/method.
For the moment I don't seek advice on "how to" as the methods needed to do this are obvious.
Just posting a summary for anyone who has/may have this malware.

All the best and woof to all good-hearted Puppians!

Собака

[mikeslr]

More drastic measures may be necessary. But I'd start with simple steps which are generally advisable to have as browser extensions to avoid problems in the first place.

The attached screenshot are the extensions I have in Iron. They're all from google webstore, so available for all Chromium & clones. ['Though adding them to Ungoogled-Chromium is a PITA].

Extensions-Security-Privacy.png (107.02 KiB) Viewed 1417 times

Including the built-in Menu>More Tools>Clear Browsing Data (configure it to clear everything for all time --I don't keep passwords online, but you may want to) that makes 3. I originally only added Click & Clean, but probably configured it wrong. So added Clear History whose choices were obvious. The builtin will actually do the job. But unlike the others it's not staring you in the face from the taskbar so you have to remember. Everyone want to store their crap on your computer. Even if it isn't a virus, it wastes your resources, especially if your browser's cache is in RAM. From time to time before opening a new tab, I'll just click the Clear History icon. Currently I use Click&Clean to securely shut down.
See if you have a problem after you've cleared cache and history.
Primarily the other extensions are supposed to keep mostly 3rd party crap from getting into your computer.

[cobaka]

In brief: The problem is described in the first posting in this thread.
In the thread immediately below @mikeslr suggested clearing all cookies, apps, cache and it turned out that once this was done the unwanted malware messages no longer appeared. Thanks to all who replied.

собака

[amethyst]

It was a sour cookie.....