Virus and Malware

[gifford]

Good advice and information on all the above.
When I run ClamTK, the only "infected files" I ever get are in the google chrome cache. Malware scripts for windows.
My solution is to clear the chrome cache in an overabundance of caution whenever any are found.

[nemilar]

Not to beat a dead horse, but like gifford mentioned, his Clam AV is only detecting Windows viruses - that's because the primary purpose of antivirus on Linux is to detect Windows viruses, to prevent them from spreading. This is particularly important on fileservers, mailservers, and the like. You may find the following interesting: Do I need an antivirus program on Linux?

[Aparajita]

http://www.makeuseof.com/tag/free-li...irus-programs/

What you were asking for in the first place
It's not required doesn't mean no one invented it

[1clue]

I'd like to redirect to post 11 on this thread http://ubuntuforums.org/showthread.p...8#post12719668

What you need to do is right there, including the part about detecting malware on Linux, which is aimed at Linux.

[Abraham_Holmes]

My problem is more serious or I should say that my daughters problem is more serious; she phoned me to say that her Ubuntu 12.4 has a virus. She can't get into her computer to do any work. A year ago I persuaded her that she should ditch Windows as it was too slow and prone to viruses; she has been happy ever since, since of course she phoned. Apparently the malware presents itself with threats of dire consequences and will destroy her system peradventure should she continue to use the system. What does she do? I could reinstall Ubuntu but she would lose work. The malware will not allow her into the system as it reboots within seconds.

What to do my fine Linux friends? Could she reinstall Linux in a different partition and migrate her stuff or would the virus migrate too? I live in Spain and she in Bonny Scotland!

Any advice would be most welcome....

Regards.

[1clue]

Boot off an installer CD, or a system rescue cd (not ubuntu but wonderful -- http://www.sysresccd.org/SystemRescueCd_Homepage) and then mount the /home directory, get her files off it and start over.

IMO the things to get for sure are a zipped copy of /etc and another for /home. In most cases everything else can be rebuilt easily enough.

Keep in mind that you don't want to restore either of these things in place. /home might still contain copies of the malware, and /etc will have settings for things that aren't in your system yet.

You should reinstall, mount your backups in a directory which has nothing to do with your normal work, perform a malware scan on it and then copy out only the things you need after you inspect them for damage.

[Cyphrex]

Agreed with TNFrank. ClamTK, I've used windows XP discs to create virtual drives in virtual box in case windows gets a virus could reload windows from the snapshot. Linux is almost virus proof, and if you can't do it on Linux can try my virtual drive trick.

[VMC]

Normally I don't read much along the lines of security. Not that I don't care or pay attention. I keep my system up to date, take precautions regarding email, watch my logs.

Today was a little different. I read a post regarding "Hand of Thief malware", that can and has attached itself to several Linux distributions, Ubuntu included.
Read the story so you can be informed...I have taken my head out of the sand.

[gregz41]

anyone heard of this:
Linux Malware Detect http://forumubuntusoftware.info/index.php


its in ultimate edition. I have tried it dont know anyone else aware of this or did i just make a major boo boo......... lol not sure

[monkeybrain20122]

Your Firefox problem was solved by quitting Firefox, not by the remove and reinstall

I'm not sure I understand the "quitting" part of the statement. I did "quit" firefox several times, rebooted the machine several times, which would also constitute quitting firefox. However, the stupid little window would always materialize and redirect.
The problem did not go away, until I uninstalled firefox, and reinstalled it.
Thanks for the help

No, instead of reinstalling you should remove the .mozilla folder in your home. That is a hidden folder and you have to press ctr+h to show it (or use file manager's show hidden file) This I guarantee would work but also kind of drastic in that it erases all your Firefox settings.

I have encountered something like that. A guy I installed lubuntu for came back complaining very slow internet, then I found out whenever Firefox was opened it always got redirected to a certain site. I can't remember the details but google said it was a Windows malware though it did have an effect on this guy's box (presumably the consequences would be more serious in Windows because it was supposed to modify the registry) After trying to remove some suspicious strings in about://config with no avail I just nuked the .mozilla folder and it was gone.