How could I possibly be infected by "s0.2mdn.net" virus? [closed]

Question

I'm running Ubuntu 14.04, I don't install software from repositories I don't trust, and particularly I didn't install anything rare recently, but it seems that I got infested with a Firefox virus called "s0.2mdn.net" which wants to convince me in giving it permissions to use my camera, and seems like an adware for most users.

The most worrying thing about this is, how did I get this virus?, because if I don't know how did I get it, then I can get dozens of these without realizing :(

I use Ubuntu because I believe it's safer, but this was unexpected. Any ideas on how to delete this virus, and do not ever face this problem again?

Thank you, I love this community :)

Answer 1

Any ideas on how to delete this virus, and do not ever face this problem again?

Generic method (in order of less to very destructive):

• remove all extensions, and addons you installed in firefox. One by one and check each time if it got removed. Then do not install that extension or addon ever again. If that does not fix it ...

• ... purge firefox, and check manually through command line all files in /home/$USER (including hidden directories) are clear of anything related to firefox. This will also remove saved passwords, bookmarks unless you saved them to online so they get synched again.

• Install firefox again and see if it got removed.

• If that does not fix it you got to check all the regular locations for commands that got inserted or settings that got changed. To name a few: crontab, /etc/crobtab, /etc/hosts, /etc/profile, /etc/network/interfaces all the .bash* files in your home that get sourced. Also check with command top if you can locate an executable responsible for this. If you find any outside your /home/ I would suggest a re-install since that software then will have been given your admin password. All bets are off if that is the case.

---

And it is not a virus: 2mdn.net (links to wiki-domains) is the name of a domain owned by google which is used for loading ad content for Doubleclik.com (links to wikipedia) from the google CDN (content delivery network).

So you call it a virus, I call it malware but it basically is considered a service from google by google.

I use Ubuntu because I believe it's safer, but this was unexpected.

Ubuntu does not stop you from installing software, that includes virusses, malware, rootkits, keyloggers. It is your task to know when to give software your admin accont so it is you that keeps your Ubuntu save from this kind of junk ;)