Adware for Ubuntu?

[guyminuslife]

Just a minute ago, I noticed an odd icon in the GNOME notification area. I hadn't installed anything to warrant such a thing, so I clicked it. It opened up Firefox and took me to a site (easy-forex.com) that was trying to sell me stuff.

My first impression was: "Holy crap, how did I get adware on this computer?"

I have a lot of ports that stay open and I've been pretty lax about security, but everything I've installed on it (except Django, which was from the official website) has been from the official repositories. I'm sure whatever it was doesn't have root access, but all the same, I decided that this was the appropriate time to upgrade from Hardy to Intrepid.

Any thoughts? Anybody else get adware on their Linux box? Did I do something I should not have, or didn't do something I should?

I'm not sure if this is reproducible, but I'm not going to stick around to find out.

[hyper_ch]

without knowing what that icon is it's hard to tell...

[guyminuslife]

Yeah I know. I'm not really looking for solutions---I don't need anyone to tell me how to fix it. Just wondering if anyone's seen this kind of thing before, or if there are any known security flaws that would allow that to happen.

[SunnyRabbiera]

Yeah I know. I'm not really looking for solutions---I don't need anyone to tell me how to fix it. Just wondering if anyone's seen this kind of thing before, or if there are any known security flaws that would allow that to happen.

Not that I am aware of, maybe it was a site you visited?
As far as I am aware of ubuntu has no addware, but firefox can attract some malware.
Its not system wide thank goodness but it is annoying.

[gjoellee]

If you got it, you must have trigged it manually

[SunnyRabbiera]

If you got it, you must have trigged it manually

I am personally leaning toward a firefox issue here, I mean yes firefox is great for security and is better at it then IE but there are many who say it is open to addware right now in some cases.
Or bad sites, just watch browsing habits and you will be fine

[guyminuslife]

UPDATE: Ended up waiting it out. This computer doesn't have anything sensitive on it, I could reformat and not care, and so far I've been too lazy to upgrade to Intrepid.

The problem has not persisted. After I killed the process, it was gone and has not come back. As far as malware is concerned, it was pretty lame. Nothing unusual has happened in the past few weeks. (Well, nothing computer-related.)

I use my computer for a lot of browsing, and I go to various sites indiscriminately (even sites I know for a fact are promulgating Windows viruses...) so a Firefox exploit would be possible. However, since the icon showed up in the system tray/notification area, I would assume that the code used was specifically targeted toward Gnome and possibly KDE/Freedesktop WMs. Correct me if I'm wrong.

I did not set off anything manually that would have done this, unless someone was able to sneak adware code into the repositories. But my system hasn't behaved like it's been infected since then, so I'm going to assume it was <i>some</i> sort of fluke.

[OpressedCalamity]

I'm having adware issues.. Whenever i try to go to youtube or some othersite it
It just redirects me to some site trying to sell me a fake antivirus or telling me I won a prize.. How do i get rid of it? :(

[Rubi1200]

Firstly, go to Tools > Clear Recent History and clear everything out.

Then, install the Firefox addons NoScript and AdBlock (I also use BetterPrivacy and can recommend it).

Also look here:

http://ubuntuforums.org/showthread.php?t=671604

[uRock]

Rubi1200 hit the nail on the head. I use those two add-ons to protect my system. Clearing the cookies should fix your problem with being redirected.

[needhelppeeps]

How do you know the add ons are not some kind of spyware? One of the most clever ways to get it installed would be to pose it as a security add on and a damn good one at that.

[bodhi.zazen]

How do you know the add ons are not some kind of spyware? One of the most clever ways to get it installed would be to pose it as a security add on and a damn good one at that.

You read the source code or if it is close source you monitor the application.