0

When I was on Youtube, an error message from Microsoft appeared but I am not even using Windows. I am using Ubuntu. Why does this happen?

My "Error" screenshot

wjandrea
  • 14,236
  • 4
  • 48
  • 98

1 Answers1

10

Welcome to the world of "Scam Domains and Popups and Advertisements"! This is one of the most obvious* scams observed on the Internet today. As you're an Ubuntu user, a little bit of "common sense" tends to go a long way: "I'm not using Windows, this is an Ubuntu system, and this is most likely a scam." Fortunately, you caught this and asked about it, but a lot of people don't always do that.

In the IT Security world this is a well known scam. Nothing Ubuntu related or Microsoft related is actually at play, what you're seeing is a scam site that's popped up in your browser. These 'scams' are not able to determine what OS you're actually using, but since a huge market share uses Microsoft, they usually try and target Microsoft for various reasons. (You'd be surprised how many times, though, the 'average person' thinks it's a legitimate site and fall for the scam, though.)

Most of the time the reason you're getting this is because there's a dodgy advertisement-network plugin on the website you're using, and this scam site is one of the 'served' advertisement domains/sites. This typically tends to happen on dodgy websites, such as porn sites, 'questionably legal' sites, a number of hijacked websites, and other websites where people are less than picky about ad revenue generation with their site (and use dodgy advertisement services). You should steer clear of those sites, if this happens, and stop browsing those sites in the future when this type of thing pops up.

If this persists after you close your browser, you should strongly consider nuking your browser profile and starting over from scratch (which is explained in this other thread)

If even after you do that it persists, change your DNS to 8.8.8.8 and 8.8.4.4 (refer to What is the proper way to change the DNS IP? for Desktop installations), and then nuke your browser again, and see if it still persists. If it does, it's possible there's some nasty malware on your system, at which point you should probably start considering a completely fresh installation from scratch (to "Nuke it from Orbit" as we call it) and making sure the issue doesn't persist at that point.

The big problem is if this continues after that - after that, you have to start hunting other network resources such as your router, etc. as the potential cause of the problem, but this is usually not the case.

However, your question does not ask how to determine if it's malware-caused or not, so I will not be explaining this any further here; if this type of investigation is necessary, it's probably better to start in a new question/thread specific to that case.


I would take down the domain that's displayed in your address bar in a separate file, and provide that to Microsoft as a report of a phishing attempt, since that looks like a 'legitimate' Microsoft website to the untrained eye. Microsoft has more resources to 'shut down' this stuff than the average user would.


* Disclaimer: I'm an IT Security professional, and this is one of the most easily implemented and most often observed types of 'scams' done online (that is, not email or phone call scam attempts, and involving an actual type of online website interaction for the scam to work) to users in general; the "most obvious" claim is from my background in being able to spot the bad websites from the good, and to identify which ones are or are not legitimate sites

Thomas Ward
  • 74,764
  • What if resetting the browser doesn't fix it? I mean could it be caused by a malicious program? – wjandrea Jul 02 '18 at 20:33
  • @wjandrea in an Ubuntu environment that's less likely, but at that point you're going to be going down the rabbit hole and hunting any of several dozen potential causes, and at that point it's usually easier to just Nuke It From Orbit(TM) and start with a fresh installation. – Thomas Ward Jul 02 '18 at 20:46
  • @wjandrea details added, but this was not the question being asked so I am not going into major detail on it here. – Thomas Ward Jul 02 '18 at 20:50