Some suspicious software making request to nmcheck.gnome.org

Question

In the last few days, my system has started popping up an Ubuntu default web-browser and making a request to nmcheck.gnome.org website and immediately shutting off.

Since this happened, I cannot run system updates.

Also, I am a php developer and cannot run composer install or composer update

How can I find this script and delete it forever?

Solution 1

nmcheck.gnome.org is not malware. It is the gnome network manager connectivity check (for captive portals/hotspots). Click the link and you will see a single text file with a text in it. It should be "NetworkManager is online".

Check /etc/NetworkManager/NetworkManager.conf. There probably is a section with this in it:

[Connectivity] 
uri=http://nmcheck.gnome.org/check_network_status.txt

Solution 2

on Ubuntu 20.04 no [Connectivity] line like accepted answer in /etc/NetworkManager/NetworkManager.conf.

But you can disable the auto connectivity check by:

1. Go to Settings app
2. Go to Privacy menu
3. On Connectivity tab, uncheck Connectivity Checking

Solution 3

nmcheck.gnome.org is a host used by NetworkManager to verify that it has Internet connectivity. gnome.org is owned by the Gnome project. This is not a suspicious domain.

nmcheck.gnome.org hosts a single file; network_status.txt, which indicates that NM is actually connected to the Internet.

In short, nothing to worry over.

Comments

[Soren A]

Chech which plugin's / add-on's there are installed in your browser(s).

[Rushabh Joshi]

I am using Firefox and I already disabled each extension but it is not opening Firefox it is using Ubuntu default browser

[user535733]

What leads you to believe that "Ubuntu software update blocked my IP"? Please answer questions by editing your original question. Comments are not intended for conversation.

[NickT]

Most Linux distributions come with Firefox installed and set as the default browser.

[goo]

sudo lsof -i will show internet connections. Adding namechk.com to your /etc/hosts with an IP of 127.0.0.1 will prevent the connection.

[Rushabh Joshi]

suddenly one time this popup browser did not shut and I finally know the url of the request and it is nmcheck.gnome.org, sorry previously I can not see url properly. Thank you

[Rinzwind]

Sorry but you mention namechk.com and nmcheck.gnome.org. Which is it?

[Rushabh Joshi]

nmcheck.gnome.org for sure previously I did not see the url properly so I search nmcheck in google and it suggested me namechk.com but it is nmcheck.gnome.org for sure

[Sergiy Kolodyazhnyy]

Typically, you should use sudo netstat -tulpan to see connection and corresponding process name and PID that make the connection.

[Rushabh Joshi]

but it is alway popup around 5 minutes and this is occurring all of a sudden still I can not update software see image That I have attached

[Rushabh Joshi]

any suggestion why software update is not running?

[Rushabh Joshi]

any suggestion why software update is not running?

[vidarlo]

I suggest that you ask your actual question, and not what you imagine the problem to be. Make a new question (or edit the current one) about why updates fail.

[nobjta_9x_tq]

This feature is weird

[Roel Van de Paar]

No such line in NetworkManager.conf. and my popup happens on a standard always-live RJ45-to-router-to-large-ISP connection. imgur.com/a/hTQ2aiu

[Rinzwind]

please do not use rules for Ubuntu 18.04 for 20.04 ;-) It probably is set differently in 20.04

[bakcsa83]

It should at least use SSL.

[Muhammad Dyas Yaskur]

@bakcsa83 Wi-Fi/hotspot login usually don't support SSL.

[Admin]

Actually there is, if you type NetworkManager --print-config you'll see that option, it's just that's inside /etc/NeworkManager/conf.d/20-connectivity.conf.