afr.php - Adblock Plus causes download requests

[Tomoms]

Hi everyone, I'd like to write my problem in just a couple of lines. I use Ubuntu 16.04, Firefox 47 and Adblock Plus (plus some other plug-ins for FF). It's simple: since 3 or 4 days, whenever I open the XDA forums (http://forum.xda-developers.com/) Firefox asks me to download a file called "afr.php" from http://cas.criteo.com. The pop up I get is the regular download popup we are used to get when we want to download something (there's the Save file option, the Open with... option, etc.). This strange behaviour ceases as soon as I disable Adblock. Does anybody knows what's going on? I've already reset my Firefox, cleared all of its data, reinstalled it... As soon as I install Adblock, the problem comes back.
EDIT: no problems when using Chrome + Adblock plus.

[fanboy]

You have other software interfering with your pc.

[Tomoms]

You have other software interfering with your pc.

I don't think so. I'm not new to linux and I know how to mantain my linux system. There aren't viruses on Linux and I know how to keep my computer clean from junk. My problem didn't exist until 3 days ago. And I faced it on 2 others computers, both of them running Linux, firefox, Adblock plus and only on XDA. As soon as I disable Adblock, the issue is gone.

[Wladimir Palant]

The fact that you are using Linux doesn't mean that you cannot have a malicious Firefox extension. It could even be that one of the formerly benign extensions you have installed turned evil. If you search the web, cas.criteo.com is clearly associated with malware. The fact that Adblock Plus affects the behavior of this malware is somewhat unusual but doesn't make Adblock Plus the cause of it. So I suggest that you keep looking - try disabling the other extensions that you have installed.

Note that a malicious extension might be hiding itself in the Add-ons Manager. You might want to check about:support page and compare extensions listed there to the ones you see in Add-ons Manager (usually they won't bother messing with about:support as well).

[Tomoms]

The fact that you are using Linux doesn't mean that you cannot have a malicious Firefox extension. It could even be that one of the formerly benign extensions you have installed turned evil. If you search the web, cas.criteo.com is clearly associated with malware. The fact that Adblock Plus affects the behavior of this malware is somewhat unusual but doesn't make Adblock Plus the cause of it. So I suggest that you keep looking - try disabling the other extensions that you have installed.

Note that a malicious extension might be hiding itself in the Add-ons Manager. You might want to check about:support page and compare extensions listed there to the ones you see in Add-ons Manager (usually they won't bother messing with about:support as well).

Hello, thanks for your answer. The other extensions I had on Firefox were: the Ubuntu Integration extension, which is not malware for sure (it's a built-in extension that comes pre-loaded on Firefox on Ubuntu) and Greasemonkey, that, by the way, is disabled because currently I haven't installed any Greasemonkey script. What's more, I have completley reset my Firefox, uninstalled it, reinstalled it with zero plug-ins or extensions, then I installed only Adblock plus and the problem is still there.

[Wladimir Palant]

Sounds like the problem is outside of Firefox then

Can you give us the exact URL where you see this issue, just in case XDA itself causes it?

[smed79]

@Tomoms Boot a Linux from Live USB Drive, install ABP, browse XDA to test again.

[Wladimir Palant]

@smed79: This is not going to help if the problem is the network router.

[Tomoms]

Sounds like the problem is outside of Firefox then

Can you give us the exact URL where you see this issue, just in case XDA itself causes it?

For example, the issue happens on this section of the forum: http://forum.xda-developers.com/xperia-sp/
but I've also tried some other sub-forums and the problem is always there. Keep in mind that on Chrome + Adblock plus the problem does not occur.

@Tomoms Boot a Linux from Live USB Drive, install ABP, browse XDA to test again.

It's not a problem for me to try, so even if it doesn't help, tomorrow I'll try a Live USB. Just to verify that it happens in all the situations.

[Wladimir Palant]

Ok, that's better - now I can reproduce, meaning that it's an issue with the website itself. Caused by this script actually.

[Wladimir Palant]

We reached out to Criteo, they will hopefully fix this soon.

[lewisje]

There aren't viruses on Linux

MY SIDES

[Illogan]

I too am pestered (twice each time) when I visit some sites - - particularly

Code: Select all

http://www.digitallook.com/equity/

And I've not found a way to stop it.

the cas.criteo.com site displays instructions to prevent the pop-up - - - by browser, but they certainly don't work on my Apple/Firefox combo.

[Wladimir Palant]

Last feedback from Criteo was three days ago: they found what they consider the reason for this issue and are working on it. Our own testing indicates that this issue is limited to non-Windows operating system, not because of the user agent string however.

[Wladimir Palant]

Criteo wrote back to say that they fixed the issue and the fix will be part of their next release (whenever that's going to be).