PDA

View Full Version : [ubuntu] Do I have a Virus?



suomalainen
July 25th, 2010, 08:26 AM
Ubunteros,

I'm using 10.04LTS. I also use Firefox 3.6.7 / Mozilla Firefox for Ubuntu canonical - 1.0.

The following appears to be a virus to me and maybe others can add/suggest/add insight/advise etc... etc....

Two times I have been using Firefox and all of a sudden everything that is in English gets turned into what appears to be "thai". Even the names of icons on my desktop are turned into thai. To me it looks as if a graphical image is appearing over the "english" names and again in Thai. With this point in mind this is why I don't use the word "translate" in my description. Translate infers that a word is literally translated into its foreign equivalent and then takes its place in a specific context and in this case this isn't what is happening. Some sort of graphical image is taking over and within that image is the word in thai..

Has anyone ever seen this before? I quickly do a re-boot and everything is fine again but I do wonder if this may be what appears ad a virus???

Does Ubuntu 10.04 LTS have any tests I can before to see if I caught a virus????

Thank you!

MichealH
July 25th, 2010, 08:35 AM
This was a quick one second reply:

Ubuntu can get viruses but cannot run them so your system is safe.
If you have wine you can execute viruses but It will not affect your Ubuntu... Just purge wine and start over if that was the case.

suomalainen
July 25th, 2010, 08:45 AM
MichealH, Thanks for your response.

Firstly, Ubuntu is susceptible to infection via viruses. This is a fact.

Second, I never made mention of using Wine.

Finally, what shall we call the phenomena that I'm experiencing????

Res2216firestar
July 25th, 2010, 08:52 AM
Is it possible to give us a screenshot so it's more clear what is happening?

suomalainen
July 25th, 2010, 08:53 AM
No. I already rebooted and problem went away. Besides, as I stated everything is in Thai and I don't speak Thai.

k3lt01
July 25th, 2010, 08:55 AM
If you can save your important settings in Firefox I would do so at this point in time. I'd then create a new profile and see what happens with that. If it is ok then transfer your settings over to your new profile and delete your old one.

LovingLinux is the guy who seems to know about FireFox issues. I doubt it is a virus but I wouldn't discount a problem of some sort. Can you take a screenshot of it?

khelben1979
July 25th, 2010, 08:56 AM
To answer the topic, I wouldn't be so sure as the previous poster to say that your system is not infected with a Linux virus, however, if do have clamav (http://en.wikipedia.org/wiki/Clamav) anti-virus installed and that you do virus scans once a week, that should be pretty sufficient to say that you're system would be alright.

Also make sure to not run your web browser when you have been logged on as root, that's definitely not safe and that can indeed damage your Linux system.

So I would recommend clamav (http://en.wikipedia.org/wiki/Clamav) and if that does not find any viruses, you should be safe.

k3lt01
July 25th, 2010, 08:57 AM
No. I already rebooted and problem went away. Besides, as I stated everything is in Thai and I don't speak Thai.How do you know it's Thai then?

suomalainen
July 25th, 2010, 09:02 AM
Hummm..... How do I know it's Thai????? Hum... How do I know what Greek looks like???? Hum.. how about Russian???? Er... How about Korean.....

How about if I just answer "I just do!" How about that?

k3lt01
July 25th, 2010, 09:07 AM
Hummm..... How do I know it's Thai????? Hum... How do I know what Greek looks like???? Hum.. how about Russian???? Er... How about Korean.....

How about if I just answer "I just do!" How about that?Whatever.

Just trying to help. A screenshot or something would be a great start if it does it again. If it doesn't do it again you don't have a virus.

HermanAB
July 25th, 2010, 09:13 AM
Howdy,

If anybody ever find a working Linux virus, please forward it to me. I have been using Linux since 1996 and still haven't seen one.

robert shearer
July 25th, 2010, 09:14 AM
Hummm..... How do I know it's Thai????? Hum... How do I know what Greek looks like???? Hum.. how about Russian???? Er... How about Korean.....

How about if I just answer "I just do!" How about that?

So how do you 'know' its a virus ???

Screenshot needed to validate your assertions.

Funkey Monkey
July 25th, 2010, 09:36 AM
Hummm..... How do I know it's Thai????? Hum... How do I know what Greek looks like???? Hum.. how about Russian???? Er... How about Korean.....

How about if I just answer "I just do!" How about that?

Suomalainen... chill dude, k3lt01 was just making a little comic remark.

suomalainen
July 25th, 2010, 09:43 AM
Screenshot needed to validate your assertions.

Bull Crap

robert shearer
July 25th, 2010, 09:50 AM
Finally, what shall we call the phenomena that I'm experiencing????

An attitude, get over it.

k3lt01
July 25th, 2010, 09:54 AM
Suomalainen... chill dude, k3lt01 was just making a little comic remark.I wouldn't worry to much Funkey, try to help with a little humour and you get bitten. We can't help unless he supplies something to work from and he has already said bullcrap to that.

I'll just watch this thread now until I see some positive action from the OP.

beew
July 25th, 2010, 10:00 AM
A bit off topic here. I am curious why so many people like to recommend clamav while it seems to be a very crappy av program based on actual testing.

http://en.wikipedia.org/wiki/Clam_AntiVirus

It is one thing to say that you don't need an av for Linux, but if you are going to get one, what is the point of getting one that is quite useless and apparently consumes a lot of cpu resources?

Sir Jasper
July 25th, 2010, 10:15 AM
Hi,

Just in case it may possibly be of interest:

Firefox 3.6.8 followed almost immediately after 3.6.7 to rectify some defect(s).

My regards

HermanAB
July 25th, 2010, 10:23 AM
Re. ClamAV:
It actually works against real viruses. It doesn't work against 20 year old obsolete viruses...

beew
July 25th, 2010, 10:29 AM
Re. ClamAV:
It actually works against real viruses. It doesn't work against 20 year old obsolete viruses...

Do you have any source to back it up?

suomalainen
July 25th, 2010, 10:48 AM
Thank you Very Much to the last couple of posters that got us back on track!!!

Thank you!!!!!

HermanAB
July 25th, 2010, 11:52 AM
Do you have any source to back it up?

Yes - I've been doing email systems for more than ten years. Email viruses do not get through ClamAV. It works well enough.

masque7
July 25th, 2010, 12:32 PM
Isn't Clam the only open source AV out there? I'd consider using it to scan Windows partitions! :)

beew
July 25th, 2010, 12:43 PM
Yes - I've been doing email systems for more than ten years. Email viruses do not get through ClamAV. It works well enough.


What about other viruses? Email virus is a very small sub-genre of viruses by the way. Masque7 is going to use ClamAv to scan his/her Windows partition, there are a million ways a Windows system can get infected besides email. I wouldn't trust it given its reputation of failure to detect viruses.

If you are using Linux chances are you don't need any AV, if you are using Windows why would you even care whether the AV is open source? My point remains, if you think you don't need an AV for Linux, don't get one. If you are getting one anyway, there is no reason to get a known crappy one just because it is open source.

theozzlives
July 25th, 2010, 12:43 PM
Until you post a screenshot, there's not much that can be done. If you don't know thai then you can't be sure of the language. It may be gibberish from a binary file. Without a screenshot, who knows!

WRDN
July 25th, 2010, 12:45 PM
Isn't Clam the only open source AV out there? I'd consider using it to scan Windows partitions! :)

It's the only one I know of, but as someone else mentioned, it has poor detection rates, so you may be better of using a closed source AV program for Linux e.g. AVG, Avast, NOD32 or Avira.

Jazzy_Jeff
July 25th, 2010, 12:45 PM
Until you post a screenshot, there's not much that can be done. If you don't know thai then you can't be sure of the language. It may be gibberish from a binary file. Without a screenshot, who knows!

You could also type the words into google translator to see what language it is.

Not much we can do without a screenshot or someone else posting with similar issues.

pmn9393
July 25th, 2010, 12:52 PM
I would say that it may have been a temporary glitch in your graphics driver. Sometimes timing can mess things up like that. Emerald sometimes loads too slow and I have no window decoration when I boot up my computer. Like mine I restart, and that seems to have worked in this situation too.

eyeofreason
July 25th, 2010, 01:01 PM
It's the only one I know of, but as someone else mentioned, it has poor detection rates, so you may be better of using a closed source AV program for Linux e.g. AVG, Avast, NOD32 or Avira.

Bit-defender also.

lovinglinux
July 25th, 2010, 01:11 PM
That smells like an extension behaving badly. Check if you don't have anything like Quick Locale Switcher (https://addons.mozilla.org/en-US/firefox/addon/1333/) installed and disable it.

You can start Firefox in safe mode to test if this is the case:


firefox -safe-mode

This will disable all extensions temporarily.

If that doesn't help, then create a new profile like suggested by k3lt01. See Firefox General Troubleshooting Steps (http://firefox-tutorials.blogspot.com/2010/05/general-troubleshooting-steps.html) tutorial.

corncob
July 25th, 2010, 01:29 PM
You could also type the words into google translator to see what language it is.

Not much we can do without a screenshot or someone else posting with similar issues.

If I'm not mistaken Thai uses a different alphabet so, without a Thai keyboard, he couldn't type it in but he could try copy and paste. Also, I've heard on this forum about everything coming up in Greek. It turned out to be really English but printed in a Greek font. Thinking of that, he might try changing fonts.

Gone fishing
July 25th, 2010, 01:41 PM
Do you have a virus almost certainly no.

Can Linux get viruses - yes - but are they in the wild? and can they effect your system? Well linux-slapper can effect vulnerable apache servers not common and not a desktop virus.

For a virus to effect the system it would need root privileges, you would need to give it them, sudo runvirus.pl or it would need a vulnerability not easy to exploit as there are many Linuxes running different kernels, base applications, etc and they are frequently patched.

Male-ware effecting the users home folders where the virus wouldn't need to escalate privileges would seem more likely but has anyone seen an example? It would still probably need the user to assist its infection and could be easily cleaned.

I fully expect to see Ubuntu maleware in the fullness of time but of the social engineering type.

I would be shocked if the symptoms you see are caused by a virus or other maleware.

suomalainen
July 25th, 2010, 04:26 PM
Thanks everyone for the replies and insight! You all provided great feedback.

For those of you placing posts that DO NOT harp on the Thai issue thanks for your genuine support. I will ignore the Thai posts here forward and if more are added ask a moderator to delete them as they only serve as graffiti.

I'll keep this thread open and post a pic should this issue occur again.

Thank you everyone!!!!

suomalainen
September 1st, 2010, 07:56 AM
O.K. folks over 2 months has gone by and just moments ago it has happened again!!!!!!

And as promised, I'm attaching two pics for reference.

The only thing to note was that as I was surfing the web I also had an update manager open downloading and installing updates.....

What are your thoughts?

trikster_x
September 1st, 2010, 08:36 AM
I don't think it is a virus, probably a corruption somewhere in your language packs. The characters seem to be taken from several different languages and character sets. It could even be a problem with gnome, considering the applications and mail icons are scrambled in one of the screenshots. If it was a virus I would think it would happen a bit more often than once every couple months.

woodmaster
September 1st, 2010, 09:06 AM
seems like corrupted file(s) somewhere's...did an fsck fix it? I had my filesystem on an external drive corrupted and all the filenames and the drive name looked like that...my $.02

limestone
September 1st, 2010, 09:07 AM
Upgrade or try to purge launges