FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Ubuntu > Ubuntu User

 
 
LinkBack Thread Tools
 
Old 11-18-2009, 08:33 PM
arshad
 
Default Strange files (probably linux virus?) found in flash drives

hi all,

i mounted my flash drive in two different points. and if i access the drive through each point i see strange two files in each point. screen shot added. please tell me what the problem is:



at point one:









at point two:






--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 11-19-2009, 07:49 AM
Nils Kassube
 
Default Strange files (probably linux virus?) found in flash drives

arshad wrote:
> i mounted my flash drive in two different points. and if i access the
> drive through each point i see strange two files in each point.
> screen shot added. please tell me what the problem is:

It sure doesn't look like a Linux virus. A virus would hide itself
inside some other file or make itself look like a "normal" file so you
don't panic but instead execute the file.

About your screenshots:

The file Screenshot.png shows the message of the application launcher
which has found a file with the extension ".desktop". Files with the
extension ".desktop" are meant to be application shortcuts for your
desktop and they include information about the command to start. However
those files don't need to have the executable flag set to start a
program and are therefore potentially dangerous. Some time ago this was
found to be a problem especially if the file was executed by the system
from untrusted locations like USB sticks or email attachments. It looks
like this situation is now handled by the system in a useful manner,
i.e. warning the user. I wouldn't execute that file unless I first
verified with a text editor that the contents of the file is harmless.

I have no idea what the problem might be with the file "Computer" in
your attached Screenshot-1.png.


Nils

--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 11-19-2009, 07:53 AM
Andrew Farris
 
Default Strange files (probably linux virus?) found in flash drives

On Thu, 2009-11-19 at 03:03 +0530, arshad wrote:
> hi all,
> i mounted my flash drive in two different points. and if i access the
> drive through each point i see strange two files in each point. screen
> shot added. please tell me what the problem is:

As a rule... a lot of people here filter their mail based on HTML
content, and size, so by dumping those pictures into the email, you may
have ensured that far fewer people will have read your message. In the
future, try posting your pictures on someplace like imageshack, and just
include a URL in your message explaining what it is. Additionally, the
second image came out as an all black box for me, so it tells me
nothing.

However, it's doubtful that the icon indicated in the first screenshot
is a virus of any kind... it just looks like a launcher icon to open
nautilus (possibly created on another linux computer?). you can verify
by right-clicking it and going to 'properties' check the 'Command' field
under the 'basic' tab, to see what exactly the launcher is intended to
launch...then you can decide weather you want it or not.

as another note: Ubuntu has started having this message pop up for
launcher files that do not currently have executable permissions (for
whatever reason)... Most likely this launcher was created by something,
and the popup is essentially telling you that the file can be executed
(because it's a launcher) but it won't do it automatically, because you
haven't given it permission to do so. If you mark it as 'trusted'
basically all you do is give it executable permission.

Hope that helps

--
Andrew
_____________________________
Registered Linux User: 473690
Registered Ubuntu User: 22747


--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 11-19-2009, 08:02 AM
"Amedee Van Gasse (ub)"
 
Default Strange files (probably linux virus?) found in flash drives

On Wed, November 18, 2009 22:33, arshad wrote:
> hi all,
> i mounted my flash drive in two different points. and if i access the
> drive through each point i see strange two files in each point. screen
> shot added. please tell me what the problem is:
>
> at point one:
>
>
>
>
> at point two:


Hi,

I'm sorry but I didn't see any screen shot.
You should know that I read the mails in Squirrelmail, and it presents
them as text-only. So if your screen shots were attached, I'd have to take
an extra action and I just cannot be bothered. Please make it easy for me
to help you.

The best thing that you can do, is upload your screenshots to one of the
free image sharing websites. I often use Twitpic, but any other will do.

It is also nice to give an indication of file size. Some Ubuntu users live
in 3rd world countries with slow dialup links.


Could you do an "ls" on the flash drives? Go to a console and type:

ls -al /media/flash

Substitute /media/flash with your actual mount point.
Reply to this list with the result. If the result is too big, (use common
sense) then put it on pastebin.com (or any other pastebin site). Clean up
for privacy sensitive stuff.


Next, do a "file" on the suspicious file. This is to determine the file type:

file /media/file/suspicious_file

Post back to the list.


Next, do a "cat" on the file to see what is inside:

cat /media/flash/suspicious_file

If the output is all gobblygook, ignore it. But if it is readable plain
text, report back.


That's all the info that I need for now.
It's very unlikely that you have a linux virus.


--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 11-19-2009, 08:08 AM
Xandros Pilosa
 
Default Strange files (probably linux virus?) found in flash drives

Dne 19.11.2009 (čet) ob 03:03 +0530 je arshad zapisal(a):
> hi all,
> i mounted my flash drive in two different points. and if i access the
> drive through each point i see strange two files in each point. screen
> shot added. please tell me what the problem is:

<snip> a large one

It is a desktop configuration file (right-click --> properties), same as
in Places menu (Computer icon).
My bet is, that you accidentally dragged it in the file browser window.
You can verify this by comparing both files:
drag the Computer icon from Places menu to the desktop (if you don't
have it there already, start text editor, from within editor navigate
(file--> open) to the Desktop folder and open nautilus-computer.desktop
file. It should contain similar as:

[Desktop Entry]
Encoding=UTF-8
Name=Computer
Name[af]=Rekenaar
... many more Name=...
Comment=Browse all local and remote disks and folders accessible from
this computer
...many more Comment=...
TryExec=nautilus
Exec=nautilus --no-desktop computer:
Icon=computer
Terminal=false
StartupNotify=true
Type=Application
Categories=GNOME;GTK;Core;
OnlyShowIn=GNOME;
X-GNOME-Bugzilla-Bugzilla=GNOME
X-GNOME-Bugzilla-Product=nautilus
X-GNOME-Bugzilla-Component=general
X-GNOME-Bugzilla-Version=2.22.5.1
X-Ubuntu-Gettext-Domain=nautilus

This is from Hardy, but there should be no much differences in other
versions.

Do the same with the file on your Pendrive an see, if there is any
differences (you can also use "diff" or "cat" and other tools in
Terminal or Meld - gui Diff Viewer) with spec. attention to:

TryExec=nautilus
Exec=nautilus --no-desktop computer:

As I wrote above - I think it is no virus, just a little bit
heavy/snappy click/drag.

Regards


--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 11-19-2009, 08:09 AM
arshad
 
Default Strange files (probably linux virus?) found in flash drives

may be the mods deleted the file i added two screenshot



On Thu, 2009-11-19 at 10:02 +0100, Amedee Van Gasse (ub) wrote:


On Wed, November 18, 2009 22:33, arshad wrote:
> hi all,
> i mounted my flash drive in two different points. and if i access the
> drive through each point i see strange two files in each point. screen
> shot added. please tell me what the problem is:
>
> at point one:
>
>
>
>
> at point two:


Hi,

I'm sorry but I didn't see any screen shot.
You should know that I read the mails in Squirrelmail, and it presents
them as text-only. So if your screen shots were attached, I'd have to take
an extra action and I just cannot be bothered. Please make it easy for me
to help you.

The best thing that you can do, is upload your screenshots to one of the
free image sharing websites. I often use Twitpic, but any other will do.

It is also nice to give an indication of file size. Some Ubuntu users live
in 3rd world countries with slow dialup links.


Could you do an "ls" on the flash drives? Go to a console and type:

ls -al /media/flash

Substitute /media/flash with your actual mount point.
Reply to this list with the result. If the result is too big, (use common
sense) then put it on pastebin.com (or any other pastebin site). Clean up
for privacy sensitive stuff.


Next, do a "file" on the suspicious file. This is to determine the file type:

file /media/file/suspicious_file

Post back to the list.


Next, do a "cat" on the file to see what is inside:

cat /media/flash/suspicious_file

If the output is all gobblygook, ignore it. But if it is readable plain
text, report back.


That's all the info that I need for now.
It's very unlikely that you have a linux virus.






--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 11-19-2009, 09:29 AM
Rashkae
 
Default Strange files (probably linux virus?) found in flash drives

arshad wrote:
> hi all,
> i mounted my flash drive in two different points. and if i access the
> drive through each point i see strange two files in each point. screen
> shot added. please tell me what the problem is:
>
>

It's a .desktop file. They are gnome launchers. In this case, I'm
assuming it's exactly what it says, a launcher to the "Computer" location.

Not so long ago, there was security concern that Gnome would simply
execute .desktop files without needing the execution bit to be set. I
see from your screenshots that now Gnome keeps a list of .desktop files
that are "trusted.", and doesn't automatically treat them as launchers.
I figure you must have, deliberately or accidentally, copied the
launcher from the Places menu to your thumb drive and it was
automatically added to the trust list, hence why it appears as
"Computer." However, when you mount the thumb drive to a different
location, the file is no longer regarded as trusted, so Nautilus then
displays the actual filename.

If you examine the file with a text editor, it should contain:

Name=Computer
Comment=Browse all local and remote disks and folders accessible from
this computer
TryExec=nautilus
Exec=nautilus --no-desktop computer:
Icon=gnome-fs-client
Terminal=false
StartupNotify=true
Type=Application
Categories=GNOME;GTK;Core;


(as well as a great deal of internationalization I left out)

--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 
Old 11-19-2009, 09:50 AM
"Amedee Van Gasse (ub)"
 
Default Strange files (probably linux virus?) found in flash drives

On Thu, November 19, 2009 10:09, arshad wrote:
> may be the mods deleted the file i added two screenshot

No, they didn't.
As I wrote, I'm using Squirrelmail in plain text mode, and I cannot be
arsed to switch it to html mode.


--
ubuntu-users mailing list
ubuntu-users@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users
 

Thread Tools




All times are GMT. The time now is 09:59 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org