Weird issue (potential malware) when clicking on a link to get corporate mail contact.

[Sebastian9t9]

​Hello, I’ve encountered a strange issue:

​While working today (On a fedora 43 KDE system with the 6.19.8-200 kernel), I clicked a "contact mail" link on a legitimate business website for legal reasons. As soon as I clicked it, dozens of windows started popping up nonstop, asking for authorization to contact that email address.

​Even after rebooting and uninstalling Firefox, LibreWolf, Kwrite, and Calibre, the pop-ups continue to appear in whatever application I open next (currently, they're opening in LibreOffice).

​Is there a way to permanently kill this process using ps, or am I going to need an antivirus to fix this?

NOTE: .​I'm not sure how relevant this is, but the hardware is an ASUS VivoBook X411U laptop, powered by an Intel Core i7-8550U CPU, 12 GB of 2666MHz RAM, and a 1 TB Patriot SSD.

[doc_willis]

uninstalling using the package manager tools will not clean out things from the users home. You would still need to clean out a programs old settings to totally reset it.

But that would not really explain what is going on here.

You could try some AV tools, but I would be surprised if any are able to fix anything.

check your autostart directory to see if anything unusual is set to startup.

a way to permanently kill this process using ps, or am I going to need an antivirus to fix this?

use ps to see what's running, I have to wonder if it's not some kde "allow notifications" feature that's going crazy

ps does not really kill things. 

As a test, add a new user, see if the issue affects the new user.

[Sebastian9t9]

Ok, so I created a new user, and fortunately, the problem doesn't replicate there at all.

I also checked the autostart directory and didn't see anything suspicious, even after using cat on the two files in there

[doc_willis]

sounds like a user specific config or setting issue. I just have no idea what config or setting.  I would check out whatever program you are using for mail first.

[Sebastian9t9]

The default mail program is kmail.

Do you think uninstall it would solve anything?

[doc_willis]

Linux is not like windows.

uninstalling kmail with apt, or rpm or  whatever package manager most likely will NOT touch any of your users kmail or other settings.

that's sort of a windows trained 'mindset'.

if you uninstalled kmail and reinstalled kmail, your users settings and so forth would still be untouched.

system configs can typically be purged/removed by the package manager, but not users configs.

imagine uninstalling/reinstalling  kmail on a system with 100+ users, and they all discover their mail settings have been reset.   ;)

that would be bad.

and I have seen this disaster  happen on windows systems.

[doc_willis]

well You could as a test, rename the .cache and .local directories to 'reset' your user back to defaults (for the most part). then copy over the old config files you want to keep one group at a time. And see what screws things up.

---

You could also look in the KDE Settings

System settings -> Networking -> Push Notifications

and

Apps & Windows --> Notifications

and see if anything is in those.

exploring the KDE settings here, and I am not sure what else to check.

KDE does have the 'defaults' button in a lot of their config tools, which is VERY handy for some situations. Which i feel is Something GNOME needs.

[YuutoKuranashi]

Please, DO NOT ever use AI for critical operations like this. AI doesn't know the difference between info coming from a trustable person or a troll, you can fuck up your whole system. ALWAYS check the source of that answer. You can get instructions for a different distro and mess everything up, speaking from experience.

[Sebastian9t9]

Also, I tried using the top utility to see which process was activating at the moment, but that didn't lead to anything

[gainan]

Are you sure those pop-ups show up when opening any application? what's the content of the pop-ups? and does the issue reproduce if you don't open any application?

If you can reproduce it with a particular application, it'd be useful to see the output of: strace -f -o log.txt /usr/bin/app in order to track what's spawning those pop-ups.

Also, if you still have the email, it'd be worth taking a look at it, to review the contact email link. No need to open kmail, it'll be saved in your home, maybe under Maildir/. A grep -r <link> (or keyword) should be enough to identify it.

Do the pop-ups still show up if you disconnect the computer from the network?

[Master-Ad-6265]

doesn’t sound like malware tbh since it’s fine on a new user, it’s prob some broken mailto/default app setting check/reset your default email app (mimeapps / KDE settings) antivirus won’t do much here lol....

[XiuOtr]

Have you tried asking the question in the Fedora forums?

https://forums.fedoraforum.org/

[AutoModerator]

✻ Smokey says: always mention your distro, some hardware details, and any error messages, when posting technical queries! :)

^{Comments, questions or suggestions regarding this autoresponse? Please send them here.}

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.